A VPN is going up and down because of a negotiation loop is detected. There is a log generated:

ipsec sa negotiation loop detected for peer_ip=REMOTE_IP_ADDRESS, local_ip=LOCAL_IP_ADDRESS ; reject the negotiation

A negotiation loop is detected when there is more than 5 IPsec re keys within 5 seconds in single tunnel, and the VPN tunnel will keep in that loop (locked) state. Normally, IPsec rekey is done one time when IPsec SA software lifetime is expired. There should be something wrong on either, the SRX device or peer device.

Possible causes are:

- Any VPN configuration issues (Phase 1 or 2).

- Traffic selectors mismatch configuration such as using the public IP address within the Traffic Selectors configuration which is a mistake. 

- There should be something wrong on either, the SRX or the peer device with any configuration such as a typo.

As part of the solution:

• Check the configuration carefully on both VPN peer devices.
• Clear the Security Association looking to recover from the rekey loop.
• Restart the VPN. This is done deactivating the IKE Gateway and IPsec VPN, commit and then reactivated them again. This way the devices should be able to recover from the rekey loop.
• In case previous steps did not work, think about a reboot or,
• In case the software version is end of live, think about upgrading the version.

2024-02-13 : Article Created

2025-08-06 : added SRX in categories