MX480 build IPSEC tunnel with MX304 in other location. While customer disable the interface on MX480 and once bring up the interface, the IPSEC tunnel between MX480 and MX304 take up 20 minutes to restore traffic.

MX480 have IPSEC tunnel between MX104 and MX304 in other locations respectively. Customer has maintenance window which need to take down the connectivity by disable the port on MX480. After the maintenance activity, customer restore the connectivity and noticed that IPSEC tunnel between MX480 and MX104 come up instantly, but the IPSEC tunnel between MX480 and MX304 takes 20+ minutes to restore.

MX304 support inline IPSEC and only IKEv2 supported. MX480 have MS-MIC-16G installed to support IPSEC and support both IKEv1 and IKEv2.

In configuration of MX480 end, the IKE policy has not specified IKE version and configure IKE as main mode as follow:

[edit services ipsec-vpn ike policy ]

 policy ike-policy {

        mode main;

        proposals ike-proposal;

        pre-shared-key ascii-text ""; ## SECRET-DATA

  }

As main mode configured which is IKEv1 specific, once MX480 interface link restored, the IKE SA initiated from the MX480 was failing with no-proposal-chosen error as MX304 was expecting negotiation of IKE version 2 only until old IPSEC SA on MX304 lifetime expired and then MX304 initiate SA successfully. that's why IPSEC tunnel between MX480 and MX304 takes long time to restore As IPSEC SA lifetime configured as 3600 seconds:

Oct 25 13:48:13.670 MX304 iked[23089]: IKE_GATEWAY_LOOKUP_FAIL: IKE: R:192.168.1.229:500 Role:R Gateway lookup failed

Oct 25 13:48:13.670 MX304 iked[23089]: IKE_GATEWAY_PEER_FAILED: L:192.168.2.229:500, R:192.168.1.229:500, Peer-Role: Initiator, Exchange-Type: Main, Authentication-Method: Pre-shared-keys, NATT-Detection: Not Detected, Negotiation-Phase: INIT, IKE-Gateway: N/A, Remote-ID: N/A, ID-Type: N/A, AAA-Username: N/A, Reason: No proposal chosen

Oct 25 13:48:23.304 MX304 iked[23089]: IKE_VPN_DOWN_ALARM_USER: VPN tunnel-to-mx480 from 192.168.1.229 is down. Local-ip: 192.168.2.229, gateway name: mx480-gateway, vpn name: tunnel-to-mx480, tunnel-id: 500045, local tunnel-if: st0.225, remote tunnel-ip: 192.168.1.229, Local IKE-ID: 192.168.2.229, Remote IKE-ID: 192.168.1.229, AAA username: Not-applicable, VR id: root, Traffic-selector: default_any_any_v4, Traffic-selector local ID: ipv4(0,0-65535,0.0.0.0-255.255.255.255) , Traffic-selector remote ID: ipv4(0,0-65535,0.0.0.0-255.255.255.255) , SA Type: dynamic, Reason: IKE SA is deleted

The solution of the issue is to remove the IKEv1 mode configuration and specify IKE version 2 on MX480 end.

[edit services ipsec-vpn ike policy ike-policy]

- mode main;

+ version 2;

After link restored at MX480 end, the IPSEC tunnel between MX480 and MX304 will delete the old SA and create new SA shortly:

Oct 25 13:55:28.700 MX304 iked[23089]: IKE_VPN_DOWN_ALARM_USER: VPN tunnel-to-mx480 from 192.168.1.229 is down. Local-ip: 192.168.2.229, gateway name: mx480-gateway, vpn name: tunnel-to-mx480, tunnel-id: 500047, local tunnel-if: st0.225, remote tunnel-ip: 192.168.1.229, Local IKE-ID: 192.168.2.229, Remote IKE-ID: 192.168.1.229, AAA username: Not-applicable, VR id: root, Traffic-selector: default_any_any_v4, Traffic-selector local ID: ipv4(0,0-65535,0.0.0.0-255.255.255.255) , Traffic-selector remote ID: ipv4(0,0-65535,0.0.0.0-255.255.255.255) , SA Type: dynamic, Reason: Duplicate user detected, cleared old one

2024-10-27 : Article Created

2024-11-25: adjust output font style and highlight text