Description

This knowledge base article provides troubleshooting steps for resolving an issue where Juniper Secure Connect fails to support more than two users on a VPN, even when the appropriate license is applied to the SRX.

Symptoms

  • The correct license has been applied to the system.
  • Verification through the command >show system license confirms that the correct license is active and applied to the system.

root@JTAC-SRX> show system license

 

License usage:

                 Licenses   Licenses  Licenses  Expiry

 Feature name            used  installed   needed

 remote-access-ipsec-vpn-client    0      2      0  permanent

 remote-access-juniper-std       2      27      0  2025-03-09 20:00:00 EDT

 

Licenses installed:

 License identifier: JUNOS####

 License version: 4

 Valid for device: XYZ

 Customer ID: XYZ

 Features:

  remote-access-juniper-std-25 - remote-access-juniper-std 25 users >>>>>

   date-based, 2024-02-07 19:00:00 EST - 2025-03-09 20:00:00 EDT

  • Rebooting the device has been attempted as a troubleshooting step to resolve the issue.
  • When attempting to connect to the VPN using more than two users, specific log messages are observed. Examples of these log messages may include:

root@JTAC-SRX> show log messages | last 10

Feb 15 13:51:29 [host-name] kmd[2006]: KMD_VPN_DOWN_ALARM_USER: VPN [VPN-NAME] from [IP] is down. Local-ip: [IP], gateway name: [GATEWAY-NAME], vpn name: [VPN-NAME], tunnel-id: [TUNNEL-ID], local tunnel-if: st0.0, remote tunnel-ip: [IP], Local IKE-ID: [IP], Remote IKE-ID: [IKE-ID], AAA username: [USERNAME], VR id: 0, Traffic-selector: AWS, Traffic-selector local ID: ipv4(0.0.0.0-255.255.255.255), Traffic-selector remote ID:[ ], SA Type: Static, Reason: IKE negotiation request from user disallowed as remote-access user license limit exceeded.

Solution

Remove and Reapply License:

  • Eliminate the existing license by removing it from the system.
  • Reapply the license to ensure it is properly activated and configured.
  • Verify the license status using the command >show system license to ensure it is correctly applied.

Documentation Reference

Modification History

2024-02-21 : Article Created