JSC client fails to establish VPN tunnel due to "ERROR - 4021: IKEv2(INIT) - Could not contact Gateway. Please check your internet connection."

ERROR - 4021: IKEv2(INIT) - Could not contact Gateway. Please check your internet connection
 

If you get "ERROR - 4021: IKEv2(INIT) - Could not contact Gateway. Please check your internet connection." when trying to establish a tunnel between the JSC client and the SRX then please check IP connectivity, connectivity on UDP port 500 and 4500 and reachability on TCP port 443.

If there is connectivity on the above mentioned protocols and ports and the SRX just doesn't seem to be responding then consider setting IKE traceoptions to see how the SRX is processing the IKE packets and why it may not be responding to the IKE messages.

This article however focuses on a scenario where this is caused due to the IKE proposal using rsa-signatures as authentication algorithm and the IKE policy calling a self signed certificate, note that using a self signed certificate for the IKE negotiation may cause internal IKE conflicts and will not allow the SRX to respond to the IKE_SA_INIT message (hence the "Could not contact Gateway.") even if TCP ENCAP is used.

If you set IKE traceoptions you will see something like the following:

<date>IKED-PKID-IPC Failed to delete cert chain patricia node
<date> iked_pm_ike_get_certificates_callback: CA certificate find failed
<date> ikev2_reply_cb_get_cas: [1377800/1497000] Error: Get CAs failed: 65539
<date> ikev2_state_error: [1377800/1497000] Negotiation failed because of error Crypto operation failed (65539)
<date> IKE negotiation fail for local:172.16.60.117, remote:172.16.60.24 IKEv2 with status: Crypto operation failed

The self signed cert is used for https access from JSC; for ike cert, you must get a certificate from an external CA:

set system services web-management https pki-local-certificate TEST-CERT >>> Can be self signed
set security ike policy IKE-TEST-POLICY certificate local-certificate TEST-CERT >>>Must be CA signed cert

As mentioned above this error will not allow the SRX to respond to the IKE_SA_INIT message, in this case consider setting Pre Shared Key (PSK)as authentication method instead.

To keep using a self signed certificate.The following config changes can be applied:

[edit security ike proposal IKE-TEST-PROPOSAL]

- authentication-method rsa-signatures;
+ authentication-method pre-shared-keys;

[edit security ike policy IKE-TEST-POLICY]
-  certificate {
-   local-certificate TEST-CERT;
-  }
+  pre-shared-key ascii-text Juniper123

[edit security ike gateway IKE-TEST-GATEWAY]
- version v2-only;

Please refer to https://www.juniper.net/documentation/us/en/software/secure-connect/secure-connect-administrator-guide/topics/task/local-authentication-with-local-ip-pool-cli-procedure.html on how to configure IKE with PSK.

2024-02-28 : Article Created

2025-06-23: Article Updated. Added more information regarding SRX error Negotiation failed because of error Crypto operation failed and workaround