After upgrading vSRX from 20.4R3-S3.4 to 21.2R3-S5.4, all the OSPF neighbors went down.

Roll back to previous version resolved the issue.

On replicating customer config in Jtac lab, issue was reproduced, when the VPN was established via custom routing instance.

Using default routing instance, issue is not observed.

Below is the topology:

vSRX1(jtac-vSRX-EXT) >>>>>>>>>>>>vSRX2>>>>>>>>>>>>>>>>>SRX/vSRX3

[>>>>>>>>>>>>>>>>>GRE<<<<<<<<<<<<<<]

[>>>>>>>>>>>>>>>>>>>>>>>>>>>IPSEC<<<<<<<<<<<<<<<<<<<<<<<<](Via custom routing instance)

[>>>>>>>>>>>>>>>>>>>>>>>OSPF via IPSEC tunnel<<<<<<<<<<<<<<<<<<<]

After upgrading vSRX from 20.4R3-S3.4 to 21.2R3-S5.4, all the OSPF neighbors went down and stays in INIT state.

root@jtac-vSRX-EXT> show security packet-drop records 
00:38:32.416634:LSYS-ID-00 10.36.9.169/1-->224.0.0.5/1;ospf,ipid-62130,lo0.10,Dropped by IPSEC:Encrypt failed with expired lifetime
Total packet-drop records: 1


root@jtac-vSRX-EXT> show security flow session 
Session ID: 1, Policy name: N/A, State: Stand-alone, Timeout: N/A, Valid
  In: 10.1.1.1/0 --> 10.44.3.1/0;esp, Conn Tag: 0x0, If: gr-0/0/0.1008, Pkts: 0, Bytes: 0, 

Session ID: 2, Policy name: N/A, State: Stand-alone, Timeout: N/A, Valid
  In: 172.18.1.137/1 --> 172.18.1.138/1;gre, Conn Tag: 0x0, If: ge-0/0/0.0, Pkts: 0, Bytes: 0, 

Session ID: 5, Policy name: self-traffic-policy/1, State: Stand-alone, Timeout: 52, Valid
  In: 10.36.9.170/1 --> 224.0.0.5/1;ospf, Conn Tag: 0x0, If: st0.2007, Pkts: 14132, Bytes: 1639216, 
  Out: 224.0.0.5/1 --> 10.36.9.170/1;ospf, Conn Tag: 0x0, If: .local..0, Pkts: 0, Bytes: 0, 

Session ID: 174, Policy name: N/A, State: Stand-alone, Timeout: N/A, Valid
  In: 10.1.1.1/988 --> 10.44.3.1/64387;esp, Conn Tag: 0x0, If: lo0.10, Pkts: 132, Bytes: 24816, 
Total sessions: 4

Issue is fixed in the version 22.2R3-S2

Other fixed releases

junos:21.3R3 junos:21.4R3 junos:22.1R2 junos:22.2R1 junos:22.3R1