This article a specific scenario where "Can not send UDP datagram" or "Ignoring SA_CFG since IFF is down" can be seen as symptoms.

• Phase 1 will not show as up:

juniper> show security ike security-associations 

Index State Initiator cookie Responder cookie Mode   Remote Address  

1 DOWN c5342cfe5b8b22de 0000000000000000 IKEv2   10.10.10.1

• The SRX device will not send any IKE messages at all, even with "establish-tunnel immediately". (This can be confirmed with a PCAP)

• If IKE debugging is configured (trace-options), either "Can not send UDP datagram" or "Ignoring SA_CFG since IFF is down" will show us as logs.

These symptoms can be seen if you have both "external-interface" and "local-address" commands in the IKE Gateway config, and the local address specified does not exist in the referenced external interface.

Example:

set interfaces ge-0/0/0.0 family inet address 192.168.0.1/24

set security ike gateway Example-GW external-interface ge-0/0/0.0

set security ike gateway Example-GW local-address 172.16.0.1