This article explains how to troubleshoot the connectivity issues between SRX and CSO.

Customers can face difficulties connecting SRX to CSO. In some cases we can see an onboarded SRX as unavailable for managing. So we can classify the issues as Onboarding issues and issues after onboarding. 

Onboarding issues

- Ensure the SRX interface has DHCP IP/static IP to reach the internet.
- Ensure the DNS server is configured (or obtained from DHCP) and resolution is working.
- Ensure redirect.juniper.net is reachable from SRX.

show version
show interfaces terse | no-more
show interfaces routing-instance all terse |no-more 
show route | no-more

Debug:

set system phone-home traceoptions file ph-trace size 5m
set system phone-home traceoptions flag all

VPN issues 

Collect these for any VPN issues, for eg, VPN issues between Hub to Spoke, Spoke to Spoke etc.

show route | no-more | save /var/log/route-table 
show security ike security-association | no-more 
show security ipsec security-association | no-more 
show security ipsec inactive-tunnels | no-more 
show interfaces terse | no-more
show interfaces routing-instance all terse |no-more 
show route instance detail | no-more
show bgp summary | no-more
show bgp neighbor | no-more

Traceoptions:

set security ike traceoptions file ike-debug set security ike traceoptions flag all
set security ike traceoptions level 15

Per-tunnel debugging:

request security ike debug-enable level <1-15> local <local-ip> remote <peer-ip>

Either apply IKE trace OR ike-debug (per tunnel debug); not both. If all VPNs are down then prefer IKE traceoptions. If only one tunnel is down, then prefer ike-debug’

In some instances we might observe SRX as unavailable in the CSO portal, If connectivity is not the culprit, as a last resort we can try bouncing the tunnel between CSO and SRX or rebooting the SRX.