Configuring an IPsec proposal with a low lifetime-kilobytes option will result in excessive logging events, a frequent change in IPsec SA SPIs and frequent IPsec renegotiations.
Example IPsec Topology[SRX1] [st0.0] IP: 22.0.0.1 <-----IPsec-----> 22.0.0.2 [st0.0] [SRX2]
IPsec example configuration:set security ipsec proposal ipsec-proposal-1 protocol espset security ipsec proposal ipsec-proposal-1 authentication-algorithm hmac-sha1-96set security ipsec proposal ipsec-proposal-1 encryption-algorithm 3des-cbcset security ipsec proposal ipsec-proposal-1 lifetime-kilobytes 3600 <<< setting an improper lifetime-kilobytes valueset security ipsec policy ipsec-policy-cfgr proposals ipsec-proposal-1set security ipsec vpn ipsec-vpn-cfgr bind-interface st0.0set security ipsec vpn ipsec-vpn-cfgr ike gateway ike-gate-cfgrset security ipsec vpn ipsec-vpn-cfgr ike ipsec-policy ipsec-policy-cfgrset security ipsec vpn ipsec-vpn-cfgr establish-tunnels immediately
The results are seen in the logs with the following messages repeating:Oct 18 13:01:41 SRX1 kmd[14008]: IPSec sa negotiation loop detected for peer_ip=22.0.0.2, local_ip=22.0.0.1 ; rejecting the negotiationOct 18 13:01:41 SRX1 kmd[14008]: IPSec negotiation failed with error: Internal Error: IPSec SA installation failed. IKE Version: 1, VPN: ipsec-vpn-cfgr Gateway: ike-gate-cfgr, Local: 22.0.0.1/500, Remote: 22.0.0.2/500, Local IKE-ID: 22.0.0.1, Remote IKE-ID: 22.0.0.2, VR-ID: 0Oct 18 13:01:41 SRX1 kmd[14008]: KMD_PM_SA_ESTABLISHED: Local gateway: 22.0.0.1, Remote gateway: 22.0.0.2, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0x964d154d, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: FC Name:Oct 18 13:01:41 SRX1 kmd[14008]: KMD_PM_SA_ESTABLISHED: Local gateway: 22.0.0.1, Remote gateway: 22.0.0.2, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0x224633dd, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: FC Name:Oct 18 13:01:41 SRX1 kmd[14008]: KMD_PM_SA_ESTABLISHED: Local gateway: 22.0.0.1, Remote gateway: 22.0.0.2, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xfc6e77c6, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: FC Name:Oct 18 13:01:41 SRX1 kmd[14008]: KMD_PM_SA_ESTABLISHED: Local gateway: 22.0.0.1, Remote gateway: 22.0.0.2, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0xc3ad9ee, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: FC Name:Oct 18 13:01:41 SRX1 kmd[14008]: KMD_PM_SA_ESTABLISHED: Local gateway: 22.0.0.1, Remote gateway: 22.0.0.2, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: inbound, SPI: 0xb7f0a9bc, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: FC Name:Oct 18 13:01:41 SRX1 kmd[14008]: KMD_PM_SA_ESTABLISHED: Local gateway: 22.0.0.1, Remote gateway: 22.0.0.2, Local ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Remote ID: ipv4_subnet(any:0,[0..7]=0.0.0.0/0), Direction: outbound, SPI: 0x33a10def, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: FC Name:
In the IPsec SA details you will see multiple prompts of “IPSec negotiation loop detected with peer, Rejecting negotiation” && “SA negotiation successfully completed”
root@SRX1> show security ipsec sa detailOct 18 13:09:21ID: 131073 Virtual-system: root, VPN Name: ipsec-vpn-cfgr Local Gateway: 22.0.0.1, Remote Gateway: 22.0.0.2 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv1 DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.0 Port: 500, Nego#: 569, Fail#: 109, Def-Del#: 0 Flag: 0x600a29 Multi-sa, Configured SAs# 1, Negotiated SAs#: 1 Tunnel events: Fri Oct 18 2024 13:05:51: IPSec SA negotiation successfully completed (1 times) Fri Oct 18 2024 13:05:51: IPSec negotiation loop detected with peer, Rejecting negotiation (1 times) Fri Oct 18 2024 13:05:50: IPSec SA rekey successfully completed (2 times) Fri Oct 18 2024 13:05:49: IPSec negotiation loop detected with peer, Rejecting negotiation (1 times) Fri Oct 18 2024 13:05:48: IPSec SA negotiation successfully completed (2 times) Fri Oct 18 2024 13:05:47: IPSec negotiation loop detected with peer, Rejecting negotiation (1 times) Fri Oct 18 2024 13:05:47: IPSec SA rekey successfully completed (3 times) Fri Oct 18 2024 13:05:44: IPSec negotiation loop detected with peer, Rejecting negotiation (1 times) Fri Oct 18 2024 11:34:41: IKE SA negotiation successfully completed (3 times) Fri Oct 18 2024 10:54:16: No response from peer. Negotiation failed (1 times) Direction: inbound, SPI: aea1de34, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 3390 seconds <<< lifetime seconds Lifesize Remaining: 3000 kilobytes <<< lifetime kilobytes Soft lifetime: Expires in 2817 seconds
With the “show security ipsec sa | refresh 2” command, we can see the lifetime setting and the SPI numbers constantly changing:
Total active tunnels: 1 Total Ipsec sas: 1 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP:3des/sha1 70a15823 3577/ 3000 - root 500 22.0.0.2 >131073 ESP:3des/sha1 2d624eef 3577/ 3000 - root 500 22.0.0.2 Total active tunnels: 1 Total Ipsec sas: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP:3des/sha1 3126de0b 3600/ 3000 - root 500 22.0.0.2 >131073 ESP:3des/sha1 1c2cb630 3600/ 3000 - root 500 22.0.0.2 <131073 ESP:3des/sha1 67bc77bf 3600/ 3000 - root 500 22.0.0.2 >131073 ESP:3des/sha1 24fadafb 3600/ 3000 - root 500 22.0.0.2 Total active tunnels: 1 Total Ipsec sas: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP:3des/sha1 bef89d39 0 / 3000 - root 500 22.0.0.2 >131073 ESP:3des/sha1 81b32556 5 / 3000 - root 500 22.0.0.2 <131073 ESP:3des/sha1 9723befa 3600/ 3000 - root 500 22.0.0.2 >131073 ESP:3des/sha1 897b75c5 3600/ 3000 - root 500 22.0.0.2
To avoid the behaviour remove the "lifetime-kilobytes" option from the IPsec proposal list or set a higher value. The range that can be set is between 64 and 4,294,967,294 kilobytes.
Reverting to the default unlimited value will result in the "show security ipsec security-associations" prompting the following:
Total active tunnels: 1 Total Ipsec sas: 1 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP:3des/sha1 fb149ca5 2536/ unlim - root 500 22.0.0.2 >131073 ESP:3des/sha1 953c24ff 2536/ unlim - root 500 22.0.0.2
21 Oct: Initial version
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/proposal-edit-security-ipsec.html