This shows a quick behavior of an IPsec tunnel which appears to be up when running the command >show security ipsec security-associations but the st0.X interface appears down
When running the command:
> show security ipsec security-associations, the IPsec tunnel appears up, but no traffic is flowing through it, same with the IKE tunnel.
A static route is configured for the remote lan
# set routing-options static route 192.168.10.0/24 next-hop st0.X
> show route <remote LAN> (remote LAN is the destination for the tunnel) the route appears not tied to the st0.X interface, but it shows going to a different area
> show interfaces terse | match st0.X, the interface appears down even with the tunnel being up
A possible explanation for this behavior is the security associations for the tunnel were not sent to the PFE, making the interface still appear down.
Run the command:
> show security ipsec security-associations & > show security ike security-associations
Pick the index numbers of the specific tunnel having the issue and run the command
> clear security ike security-associations index <intex number> & > clear security ipsec security-associations index <intex number>
After this the tunnel should flap, check once more the route to the remote LAN and the st0.X interface status to see if it's now up, tunnel should now work properly.