Description

This article explains the reason for multiple Phase 2 (IPSec) security association (SA) for same Network Control Protocol (NCP) client/user on SRX. To prevent this, make sure to select "local IP address" under "IPSec Address Assignment" on NCP.





 

Symptoms

The following example shows multiple Phase 2 SAs for the same NCP peer. 

root@SRX> show security ipsec security-associations
  Total active tunnels: 2
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway 
  <67108867 ESP:3des/md5 f50302cf 28791/unlim  -   root 500   116.197.187.152
  >67108867 ESP:3des/md5 7fac1918 28791/unlim  -   root 500   116.197.187.152
  <67108868 ESP:3des/md5 2ce5f4b1 28791/unlim  -   root 500   116.197.187.152
  >67108868 ESP:3des/md5 fbdb5ed2 28791/unlim  -   root 500   116.197.187.152


 

Solution

This can happen in two scenarios:

  1. When we have enabled multiple traffic selectors on SRX and NCP.  In this scenario, we expect to see multiple SAs.

  2. When we select "local IP address" under "IPSec Address Assignment" on NCP. We are supposed to select "IKE config mode", but instead we select "local IP address" SRX. We receive an additional traffic selector with remote IP (IP assigned to VPN client by SRX) and the local-IP (remote protected resources) additional to the traffic selectors specified on SRX.



 

Make sure to select

Profile Settings > IPSec Address Assignment > local IP address

on NCP.


alt