Description

This article describes the tunnel interface flapping due to a mismatch of traffic selector attributes.
The traffic selector is an attribute which negotiates the IKE parameters to establish a tunnel. Cisco ASA is using obsolete TS attributes which results in tunnel flapping with SRX.

Symptoms

The customer reported that the SRX has an issue with the IPSEC tunnel which is repetitively flapping.
During the analysis of the logs, it was observed that the Tunnel flaps were due to peer sending unrecognized traffic selector attributes.

Device Logs:
Jun 22 17:54:42 lab03_SRX kmd[20715]: IPSec negotiation failed with error: Peer proposed unsupported multiple traffic-selector attributes for a single IPSec SA. Negotiation failed.. IKE Version: 2, VPN: MSS-VPN Gateway: MSS-GW, Local: 100.64.20.22/500, Remote: 100.65.21.121/500, Local IKE-ID: 100.64.20.22, Remote IKE-ID: 100.65.21.121, VR-ID: 0
Jun 22 17:54:42 lab03_SRX kmd[20715]: KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: MSS-VPN, Peer Proposed traffic-selector local-ip: ipv4(10.19.78.128),ipv4(10.19.78.128-10.19.78.191), Peer Proposed traffic-selector remote-ip: ipv4(100.66.19.10)
Jun 22 18:05:01 lab03_SRX kmd[20715]: KMD_PM_SA_ESTABLISHED: Local gateway: 100.64.20.22, Remote gateway: 100.64.22.120, Local ID: ipv4(172.18.26.112-172.18.26.127), Remote ID: ipv4(100.64.22.120-100.64.22.141), Direction: inbound, SPI: 0x7dd54054, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: TS_2 FC Name:
Jun 22 18:24:34 lab03_SRX kmd[20715]: KMD_VPN_DOWN_ALARM_USER: VPN MSS-VPN from 100.65.21.121 is down. Local-ip: 100.64.20.22, gateway name: MSS-GW, vpn name: MSS-VPN, tunnel-id: 67108877, local tunnel-if: st0.2, remote tunnel-ip: Not-Available, Local IKE-ID: 100.64.20.22, Remote IKE-ID: 100.65.21.121, AAA username: Not-Applicable, VR id: 0, Traffic-selector: net6, Traffic-selector local ID: ipv4(10.196.78.128-10.196.78.191), Traffic-selector remote ID: ipv4(100.64.64.20), SA Type: Static, Reason: Hard lifetime of IPSec SA expired
Jun 22 18:24:34 lab03_SRX kmd[20715]: KMD_VPN_DOWN_ALARM_USER: VPN MSS-VPN from 100.65.21.121 is down. Local-ip: 100.64.20.22, gateway name: MSS-GW, vpn name: MSS-VPN, tunnel-id: 67108878, local tunnel-if: st0.2, remote tunnel-ip: Not-Available, Local IKE-ID: 100.64.20.22, Remote IKE-ID: 100.65.21.121, AAA username: Not-Applicable, VR id: 0, Traffic-selector: net7, Traffic-selector local ID: ipv4(10.196.78.128-10.196.78.191), Traffic-selector remote ID: ipv4(100.64.64.23), SA Type: Static, Reason: Hard lifetime of IPSec SA expired
Jun 22 18:25:11 lab03_SRX kmd[20715]: KMD_DPD_PEER_DOWN: DPD detected peer 100.65.21.121 is dead, so dropping the tunnel

As per the logs, peer end device Cisco ASA is sending the unsupported traffic selectors By default when Cisco is the initiator, it'll include proxy IDs as well as IP originating connection (for example 192.160.0.0/24,192.160.0.100) and share it with a peer (which is Juniper in this case).

However, Juniper does not understand this format and will reject this with such a given error, resulting in dropping the tunnel.

Cisco ASA uses an obsolete traffic selector format which is not accepted by Juniper SRX.
Juniper is following the latest RFC for traffic selectors.
The TS syntax used by ASA is as per the old RFC 5996 (https://datatracker.ietf.org/doc/html/rfc5996#section-2.9) while the SRX is using the syntax from a new updated RFC 7296 (https://datatracker.ietf.org/doc/html/rfc7296#page-42). If we look at RFC 7296, it clearly says, it obsoletes RFC5996.
"This document describes version 2 of the Internet Key Exchange (IKE)
protocol. IKE is a component of IPsec used for performing mutual authentication and establishing and maintaining Security Associations
(SAs). This document obsoletes RFC 5996 and includes all of the errata for it. It advances IKEv2 to be an Internet Standard."
The below-given juniper doc says SRX is using an updated RFC 7296:

https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/ref/statement/traffic-selector-edit-security.html

Solution

The scenario in which ASA is using an obsolete traffic selector to negotiate a tunnel will always result in a peer end(Juniper SRX )dropping the tunnel.
This will happen when the ASA will initiate the tunnel. To avoid this, one should set Juniper as initiator always or Cisco as responder always by configuring both IKE and IPSEC life timer values shorter than the ASA side to always have SRX become the initiator.

Below is the documentation for setting the life timer values.

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/ref/statement/lifetime-seconds-edit-security.html

Modification History

.