Description

This article demonstrates how the SRX series does not support a PPPoE (pp0) interface as an IKE external interface in a High Availability (HA) environment.

Symptoms

When an external interface of an IPsec tunnel is on a PPPoE interface over a reth interface, the IPsec Phase2 sessions flap after an RG0 failover.

Topology:

  • PPPoE interface is configured over reth0 interface  
    set interfaces pp0 unit 0 pppoe-options underlying-interface reth0.0
  • PPPoE interface is configured as IKE external-interface 
    set security ike gateway TEST-VPN external-interface pp0.0​

 

Observation

After an RG0 failover, the IPsec Phase2 SA is deleted and the Phase2 negotiation is run. Traffic is impacted during the negotiation.

Before failover 
{primary:node0}
root@Cluster> show security ipsec security-associations
node0:
--------------------------------------------------------------------------
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway
  <131073 ESP:3des/sha1 d6d55201 2815/ unlim   -   root 500   3.3.3.2
  >131073 ESP:3des/sha1 1dcc1ddb 2815/ unlim   -   root 500   3.3.3.2

After failover 
{primary:node1}
root@Cluster> show security ipsec security-associations
node1:
--------------------------------------------------------------------------
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway
  <131073 ESP:3des/sha1 d1367895 1634/ unlim   -   root 500   3.3.3.2  <<  SPI value changed after IPsec SA re-establishment.
  >131073 ESP:3des/sha1 f5834eca  1634/ unlim   -   root 500   3.3.3.2  <<  SPI value changed after ​IPsec SA re-establishment.

  • Change of SPI value indicates that there was IPsec Phase2 negotiation after RG0 failover. 

Solution

This behavior is by design.

The redundant Ethernet (reth) interface is supported as an IKE external interface on all the SRX platforms in an HA environment. However, a PPPoE interface is NOT supported as an IKE external interface in an HA environment.

Avoid using a PPPoE interface as an IKE external Interface.

In case that PPPoE connection is required, consider an external solution, e.g. terminating the PPPoE session on other network device in front of the SRX cluster.

Related Information