This article explains how to resolve the problem of dynamic VPN tunnels are not forming automatically between the sites even though Dynamic VPN thresholds are met.

• Spoke sites (SRX4x00 , NFX250 etc) were onboarded and traffic working fine with out any issues.
• SRX image upgraded from 20.4X15.1 to 22.2R3-S4.11.
• Post Junos image upgrade , Dynamic VPN tunnels are not getting formed automatically between the sites.
• Template is pushed from CSO and job is successful but CLI commands are not present ( DVNP template job is successful but config is not pushed as expected)

CSO relies on Application tracking messages to evaluate how many traffic flows between the sites are getting created and closed. Refer to [CSO] Decoding DVPN creation for more details.   

As per Junos Application tracking feature documentation [  https://www.juniper.net/documentation/us/en/software/junos/application-identification/topics/topic-map/security-application-tracking.html#example-configuring-apptrack ] , Apptrack session logs are disabled by default from Junos OS 21.1R1. 

Starting in Junos OS 21.1R1, note the changes in the following logs:

AppTrack session create logs (APPTRACK_SESSION_CREATE) are disabled by default. Use the following command to enable it:

user@host# set security application-tracking log-session-create

AppTrack session close logs (APPTRACK_SESSION_CLOSE) are disabled by default. Use the following statement to enable it:

user@host# set security application-tracking log-session-close

According to CSO 6.3 release notes https://www.juniper.net/documentation/us/en/software/cso6.3.0/release-notes/cso-6.3.0-release-notes/cso-release-notes-6.3.0/topics/concept/known-behavior.html , following known behavior is also documented.

• Starting from Junos OS Release 21.1R1 and above if you want to view Application Traffic logs, you must apply the following commands:
  • set security application-tracking log-session-create
  • set security application-tracking log-session-close

So in order to devices send Application tracking logs to CSO, below steps can be followed to add a stage2 template in CSO so  that respective application tracking configuration can be deployed on all sites post upgrading to Junos 21.1R1 to later. 
 

• Downolad the Application-Tracking.zip file from https://juniper.my.salesforce.com/sfc/p/C0000000PzDx/a/Dp000001b0YO/h.bqg5SQuAHS8B0u6sPcIN8L_7Koj8EloaIKURR1ITg 
• Log in to CSO portal and navigate to Resources -> Templates. 
• Drop down More and click on Import and provide details as shown below screenshot. 

• Once the stage2 template is imported, deploy the template to the devices by enabling the application tracking knob as shown in below example screenshots. 

• Once the template is deployed successfully, DVPN tunnels will be formed automatically based on the Dynamic VPN threshold configured per site / teanant.

2025-2-3 : Added new symptom and how to fix it  
2024-08-15 : Article Created