Description

A VPN between SRX device and Palo Alto is flapping. The reason is a Traffic Selector mismatch as per the below log.

 

KMD_VPN_TS_MISMATCH: Traffic-selector mismatch, vpn name: VPN-NAME, Peer Proposed traffic-selector local-ip: ipv4(0.0.0.0-255.255.255.255),ipv6(::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff), Peer Proposed traffic-selector remote-ip: ipv4(0.0.0.0-255.255.255.255),ipv6(::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)

Symptoms

This issue is most likely between SRX and Palo Alto (PA).

 

According to the information gathered, PA is on default configuration and sends Traffic Selector for IPv4 & IPv6 as well. That is something the PA Team had explained. When the SRX receives a TS with 2 values (1 for ipv4 & another for ipv6) they are treated as 2 TSs due to different IP protocols.

 

So, the SRX seems to be recognizing this situation on either modes, initiator and responder however, it is more sensitive when working as a responder.  

 

When the SRX works as initiator, PA is recognizing the mismatch and sends the "delete payload" message since there is something that does not match, this time, the TS.

 

I also got documentation explaining the SRX platform was improved to accept both, IPv4 and IPv6 in a single TS. This is with the purpose to be in compliance with the RFC 7296.  

 

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traffic-selector-edit-security.html

"The terms in a single traffic selector can have both IPv4 and IPv6 address. Hence a single IPsec SA has both IPv4 and IPv6 as both local and remote IP addresses."

 

There is also another document about it. 

 

https://apps.juniper.net/feature-explorer/feature-info.html?fKey=10807&fn=Enhancements%20to%20increase%20traffic%20selector%20flexibility

Solution

 The Traffic selector enhancements ("term") is available only the with new 'junos-ike' architecture.

 

Junos-ike architecture is currently supported only in SRX5K-SPC3 (SRX5400, 5600 and 5800), NFX350, vsrx3.0 devices.

 

Currently, there are no plans to support the same in srx-branch-series of devices which includes srx-3xx devices and the documentation is in process to be updated.

 

So, for now, the fix from the SRX side is make it the initiator. Palo Alto has a feature to make it as "passive" thus, it will be the VPN responder.

Modification History

2024-03-15 : Article Created