This article describes a scenario where a site-to-site IPsec VPN appears to be operational, with both IKE and IPsec Security Associations (SAs) established successfully, but user traffic fails to pass through the tunnel.

The following symptoms may be observed:

• Both IKE and IPsec Security Associations are in the UP state.
• The VPN is active on both the Routing Engine (RE) and the Packet Forwarding Engine (PFE).
• Traffic matching the VPN selectors does not pass through the tunnel as expected.
• Re-establishing the VPN by deleting and reconfiguring it restores traffic flow.
• No configuration issues are identified with the VPN settings.

To proactively detect and recover from this condition, configure VPN Monitoring for the affected IPsec VPN.

Example configuration:

set security ipsec vpn vpn1 vpn-monitor optimized
set security ipsec vpn vpn1 vpn-monitor destination-ip 192.168.10.11
set security ipsec vpn vpn1 vpn-monitor source-interface ge-0/0/1

set security ipsec vpn-monitor-options interval 10
set security ipsec vpn-monitor-options threshold 10

VPN Monitoring periodically sends probes through the VPN tunnel and verifies end-to-end reachability. If the configured destination becomes unreachable for the specified threshold, the VPN is renegotiated automatically, helping recover from scenarios where the VPN is established but traffic is not forwarded correctly.