Description

For a site connected to the Internet via PPPoE, an IP address is dynamically assigned to interface pp0.0. The interface pp0.0 is configured as the external-interface for an IKE gateway (phase1 of vpn). When the vpn-monitor option is enabled, the IPsec starts flapping. This article describes how to avoid this situation.

Symptoms

 Given the following configuration:

[SRX-Branch] <pp0.0> ------------ [INTERNET]- --------------- <ge-0/0/0.0> [SRX-HUB]

st0.0 : 10.99.99.10/24                                   st0.0 : 10.99.99.1/24

Then the vpn-monitor option is configured on both SRX-Branch and SRX-HUB. The IPsec starts flapping.

# On SRX-Branch:

set security ipsec vpn To-HUB vpn-monitor

# On SRX-HUB:

set security ipsec vpn To-Branch vpn-monitor
  • What causes the IPsec to flap?

  • How does a user overcome this situation?



Solution

With the traceoption added into IKE and IPSec configuration:

set security ike traceoptions file log-ike
set security ike traceoptions file size 10m
set security ike traceoptions flag ike
set security ike traceoptions flag all
set security ipsec traceoptions flag all

In the trace file log-ike, the following messages are seen:

Jun 20 19:36:59 Deleted (spi=0xab667702, protocol=ESP dst=10.1.1.1) entry from the peer hash table. Reason: VPN monitoring
Jun 20 19:36:59 Deleted (spi=0xc7ac1fab, protocol=ESP dst=10.2.2.2) entry from the peer hash table. Reason: VPN monitoring

The cause of IPsec flapping is VPN monitoring.


















Change the vpn-monitor "source-interface" and "destination-ip" settings to the local st0.0. Its peer IP address will relieve the flapping.

# On SRX-Branch

set security ipsec vpn To-HUB vpn-monitor source-interface st0.0
set security ipsec vpn To-HUB vpn-monitor destination-ip 10.99.99.1

# On SRX-HUB

set security ipsec vpn To-Branch vpn-monitor source-interface st0.0
set security ipsec vpn To-Branch vpn-monitor destination-ip 10.99.99.10

This is because the st0.0 is always on and reachable without additional security policy configured, compared to the pp0.0 interface which is dynamically assigned by the PPPoE concentrator.