This article goes over an issue seen on IKEv2 VPN SRX-Cisco setups running on 15.1X49 after the SRX is upgraded to newer releases.

• IKEv2 Certificate VPN with Cisco was working on 15.1X49, after the upgrade, it will not come up, SA negotiation failure.
• Deleting and adding back the VPN does not fix the issue, using Proxy-ID or Traffic Selector config does not make a difference.
• If IKE traceoptions are done, the following logs will be found:

IKEv2 payloads received: mID=1, HDR, Vid, IDr, CERT, AUTH, SA, TSi, TSr, N(SET_WINDOW_SIZE), N(ESP_TFC_PADDING_NOT_SUPPORTED), N(NON_FIRST_FRAGMENTS_ALSO)

ikev2_decode_packet: [91d3c00/9294800] Extra junk after packet len(369)

ikev2_state_error: [91d3c00/9294800] Negotiation failed because of error Invalid syntax (7)

RFC change for IKEv2 fragmentation was implemented in 15.1X49-D70-75. Per RFC change on SRX, IKE-Frag is enabled by default and the IPv4 ike-fragment size is 1280.

 If ike-frag is supported on peer then there will be a negotiation between peers on the size of the ike-frag (srx default ike-frag size=1280)

This issue happens when the peer device is not sending the expected fragment size, a workaround on Cisco side is to delete "crypto ikev2 fragmentation mtu 1300" from the config (if configured), and a workaround on the SRX is to disable IKEv2 fragmentation:

"set security ike gateway gateway-name fragmentation disable"