Description

After migrating from SPC II to SPC3, the VPN daemon was upgraded from KMD to IKED. However, some VPN tunnels are not establishing, and there are no logs available in the log file for these tunnels.

Symptoms

Syslogs are not generated when VPN tunnels fail to establish due to authentication failures, potentially obscuring critical details needed for diagnosing and resolving connectivity issues. This lack of logging may hinder the timely identification of the root cause.

Solution

VPN tunnels are failing to establish due to authentication errors, as indicated by the IKE trace options.

Jun 10 14:32:10.465243 [DET] [ATEC] [10.35.254.100 <-> 10.183.0.6] (srxpfe)< -- > (iked) ike rsa public key verify response,send result to stack Jun 10 14:32:10.465342 [DET] [TIME] [10.35.254.100 <-> 10.183.0.6] ike_timer_wheel_stop_timer, stopped timer 10420697 cb 0x62c930 cbp 0xa045234, module Jun 10 14:32:10.465407 [DET] [ATEC] [10.35.254.100 <-> 10.183.0.6] ike-sa-done, sanity check failed status Authentication failed

When authentication is not the failure reason, log messages are generated by the SRX. Some examples are provided below:
 

Jun 12 13:19:31 iked[88566]: IKE_GATEWAY_PROPOSAL_MISMATCH: IKE: Gateway N:enbs_NGNR_S1U_gw_ORANGE C:10.35.254.100:500 R:10.183.0.6:500 Failed Role:R 
Jun 12 13:21:31 iked[88566]: IKE_GATEWAY_LOOKUP_FAIL: IKE: R:10.183.0.6:500 Role:R Gateway lookup failed

 

Based on discussions with the developer, it appears that the logs for IKE_GATEWAY_AUTH_FAILED were missing in some versions of the software. These logs were later included in RLI 51411, but the updates were not backported to older versions that support IKED.
 

It seems some logging details were initially overlooked when IKED was introduced and were subsequently addressed. Unfortunately, these fixes were not retroactively applied to the older codes that supported IKED.
 

Devices were upgraded to version 22.4, and the failure logs are now visible in the upgraded devices:
 

Jun 21 15:52:22   iked[31035]: IKE_GATEWAY_AUTH_FAILED: IKE: Gateway N:enbs_NGNR_S1U_gw_ORANGE C:10.35.254.100:500 R:10.183.0.6:500 Failed Role:Responder AuthValidation Pre-shared-keys
Jun 21 15:52:24   iked[31035]: IKE_GATEWAY_AUTH_FAILED: IKE: Gateway N:enbs_NGNR_S1U_gw_ORANGE C:10.35.254.100:500 R:10.183.0.6:500 Failed Role:Responder AuthValidation Pre-shared-keys

The customer can use IKE trace options to diagnose failures if no logs are available. However, if logs are required, the customer must upgrade to version 22.4R1 and above.

Modification History

2024-07-08 : Article Created