This article explains the difference in behavior between configuring multiple IPsec traffic selectors and configuring multiple terms within a single traffic selector in Junos OS.

Multiple Traffic Selectors

• Each traffic selector triggers a separate Phase 2 (IPsec) negotiation.
• This results in multiple IPsec Security Associations (SAs) and therefore multiple tunnels being established.

Multiple Terms within a Single Traffic Selector

• Multiple terms defined under a single traffic selector result in one IPsec Phase 2 negotiation.
• A single IPsec SA (single tunnel) is established.
• This single SA carries traffic for multiple local and remote subnets, ports, and protocols.

set security ipsec vpn VPN_NAME bind-interface st0.0
set security ipsec vpn VPN_NAME ike gateway IKE_GATEWAY
set security ipsec vpn VPN_NAME ike ipsec-policy ipsec-phase2-policy
set security ipsec vpn VPN_NAME traffic-selector TS1 term 1 local-ip 192.168.1.0/24
set security ipsec vpn VPN_NAME traffic-selector TS1 term 1 remote-ip 172.16.1.0/24
set security ipsec vpn VPN_NAME traffic-selector TS1 term 2 local-ip 192.168.2.0/24
set security ipsec vpn VPN_NAME traffic-selector TS1 term 2 remote-ip 172.16.2.0/24.0/24
set security ipsec vpn VPN_NAME establish-tunnels immediately

IPSec shows only one tunnel created for gateway 10.10.10.1

root@vSRX-Virtual3# run show security ipsec security-associations 
  Total active tunnels: 4     Total IPsec sas: 4
  ID      Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway

  <500035 ESP:aes-cbc-256/sha1 0xa61401df 1272/ unlim - root 500 10.10.10.1   
  >500035 ESP:aes-cbc-256/sha1 0x374a9826 1272/ unlim - root 500 10.10.10.1 

 

Details for the SA shows multiple networks negotiated on the same TS. Same SA will carry traffic for all the subnets. 

root@vSRX-Virtual3# run show security ipsec security-associations index 50035
ID: 500035 Virtual-system: root, VPN Name: VPN_NAME
  Local Gateway: 10.10.10.10, Remote Gateway: 10.10.10.1 
  Traffic Selector Name: TS1
  TS Local Identity:
  Protocol     Port           IP
  0/Any        0-65535        ipv4(192.168.1.0-192.168.1.255).
  0/Any        0-65535        ipv4(192.168.2.0-192.168.2.255)
  TS Remote Identity:
  Protocol     Port           IP
  0/Any        0-65535        ipv4(172.16.1.0-172.16.1.255)
  0/Any        0-65535        ipv4(172.16.2.0-172.16.2.255)
  TS Type: traffic-selector
  Version: IKEv2