Description

This article explains how to resolve the problem of tunnel events missing in "show security ipsec security-associations detail" .

Symptoms

  • SRX HE series installed with SPC3 card and running with Junos versions 19.2 , 19.3 , 20.2.
  • When user executes "show security ipsec security-associations detail" tunnel events will not be listes as shown below. 

test@snpsrx5600q> show security ipsec security-associations detail

ID: 500047 Virtual-system: root, VPN Name: vpn-15
  Local Gateway: 1.0.15.1, Remote Gateway: 1.0.15.2
  Local Identity: ipv4(0.0.0.0-255.255.255.255)
  Remote Identity: ipv4(0.0.0.0-255.255.255.255)
  TS Type: proxy-id
  Version: IKEv2
  Quantum Secured: No
  PFS group: DH-group-20
  Passive mode tunneling: Disabled
  DF-bit: clear, Copy-Outer-DSCP: Disabled, Bind-interface: st0.14, Policy-name: ipsec-1
  Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0 
    Location: FPC 4, PIC 1
  Anchorship: Thread 3
  Distribution-Profile: default-profile
  Direction: inbound, SPI: 0x8a871054, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 254 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 191 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64
    Extended-Sequence-Number: Disabled
    tunnel-establishment: establish-tunnels-on-traffic
  Direction: outbound, SPI: 0x683fa1a5, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 254 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 191 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64
    Extended-Sequence-Number: Disabled
    tunnel-establishment: establish-tunnels-on-traffic

Solution

  • This is known limitation when SRX HE series installed with SPC3 card and running with Junos versions 19.2 , 19.3 , 20.2
  • "Tunnel events" details is supported for SPC3 card from Junos version 20.4 or later. 
  • Here is the sample cli output with tunnel events in supported Junos versoin. 

test@snpsrx5600q> show security ipsec security-associations detail

ID: 500047 Virtual-system: root, VPN Name: vpn-15
  Local Gateway: 1.0.15.1, Remote Gateway: 1.0.15.2
  Local Identity: ipv4(0.0.0.0-255.255.255.255)
  Remote Identity: ipv4(0.0.0.0-255.255.255.255)
  TS Type: proxy-id
  Version: IKEv2
  Quantum Secured: No
  PFS group: DH-group-20
  Passive mode tunneling: Disabled
  DF-bit: clear, Copy-Outer-DSCP: Disabled, Bind-interface: st0.14, Policy-name: ipsec-1
  Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0 
  Tunnel events:
    Sun Jul 07 2024 22:09:31: IPSec SA is deleted because IPSec SA hard life-time expired, sent DEL notification (1 times)
    Sun Jul 07 2024 22:09:29: IPsec SA rekey succeeds (1 times)
    Sun Jul 07 2024 22:09:29: IPSEC SA rekey initiated because soft life timer expired (1 times)
    Sun Jul 07 2024 22:05:37: IPsec SA negotiation succeeds (1 times)
  Location: FPC 4, PIC 1
  Anchorship: Thread 3
  Distribution-Profile: default-profile
  Direction: inbound, SPI: 0x8a871054, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 254 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 191 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64
    Extended-Sequence-Number: Disabled
    tunnel-establishment: establish-tunnels-on-traffic
    IKE SA Index: 47
  Direction: outbound, SPI: 0x683fa1a5, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 254 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 191 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64
    Extended-Sequence-Number: Disabled
    tunnel-establishment: establish-tunnels-on-traffic
    IKE SA Index: 47

Modification History

v1