CA (Certificate Authority) enrollment fails on the management interface (re0:mgmt-0) when it is used within a non-default routing instance.

In the current EVO releases, enrollment cannot be sourced from a revenue interface. The enrollment source must be the management interface (re0:mgmt).

Behavior:

• When the mgmt_junos routing instance is configured and re0:mgmt is associated with it, the connection to the server fails.

• When mgmt_junos is not configured and the connection is sourced directly from re0:mgmt, both the server connection and enrollment succeed.

Sample Configuration:

set security pki ca-profile testinfra ca-identity testinfra
set security pki ca-profile testinfra source-address 2001:bbbb:0:xx::xx
set security pki ca-profile testinfra routing-instance mgmt_junos
set security pki ca-profile testinfra enrollment url "http://[2001:bbbb:0:1:xxxx:xxxx:xxxx:xxxx:xx/cgi-bin/pkiclient.exe"
set security pki auto-re-enrollment scep certificate-id testinfra ca-profile-name testinfra
set security pki auto-re-enrollment scep certificate-id testinfra re-enroll-trigger-time-percentage 70
set security pki auto-re-enrollment scep certificate-id testinfra challenge-password "testing"
set security pki traceoptions flag all
!

set security pki ca-profile testinfra ca-identity testinfra
set security pki ca-profile testinfra source-address 10.85.xx.xx
set security pki ca-profile testinfra routing-instance mgmt_junos
set security pki ca-profile testinfra enrollment url "http://10.85.xx:xx/cgi-bin/pkiclient.exe"
set security pki auto-re-enrollment scep certificate-id testinfra ca-profile-name testinfra
set security pki auto-re-enrollment scep certificate-id testinfra re-enroll-trigger-time-percentage 50
set security pki auto-re-enrollment scep certificate-id testinfra challenge-password "testing"
set security pki traceoptions flag all

!

## Interface re0:mgmt-0:
set interfaces re0:mgmt-0 unit 0 family inet address 10.13.xx.xx/24
set interfaces re0:mgmt-0 unit 0 family inet6 address 2001:bbbb:xx:xx::xx/64

!

## Routing-instances mgmt_junos:
set routing-instances mgmt_junos description "Management VRF"

set routing-instances mgmt_junos routing-options rib mgmt_junos.inet6.0 static route ::/0 next-hop 2620:0:xxxx:xx::xx
set routing-instances mgmt_junos routing-options rib mgmt_junos.inet6.0 static route ::/0 retain
set routing-instances mgmt_junos routing-options rib mgmt_junos.inet6.0 static route ::/0 no-readvertise
set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 next-hop 10.85.xx.xx
set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 retain
set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 no-readvertise

!

## Groups default for re0:mgmt-0
set groups default interfaces re0:mgmt-0 unit 0 family inet address 10.85.xx.xx/25

!

## System management-instance
set system management-instance

user@router> show route 2001:bbbb:0:1:3efd:feff:xx:xx

inet6.0: 1154 destinations, 1154 routes (1154 active, 0 holddown, 0 hidden)=

+ = Active Route, - = Last Active, * = Both

::/0        *[IS-IS/15] 11:46:17, metric 800

> to fe80::ee13:dbff:fe6c:df5c via ae1031.0

            to fe80::ee13:dbff:fe6e:1f5e via ae1331.0

mgmt_junos.inet6.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

2001:bbxx:x:x::/64 *[Direct/0] 02:32:31

> via re0:mgmt-0.0

alternative-path-management-1.inet6.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

::/0        *[Static/5] 3d 08:44:51

            to table inet6.0

PKID Enrollment Log: 

Sep 30 18:14:24 routing-instance: mgmt_junos source-ip 10.85.xx.xx Sep 30 18:14:24 failed to get routing-index -1 for routing-instance mgmt_junos <<<--- Routing index for the routing instance is not fetched.

Sep 30 18:14:24 failed to open socket 1000

Sep 30 18:14:24 openHttpConnection: Failed to open socket

Non-default routing instances are not currently supported by PKID in JunOS EVO. A software enhancement request has been made to include support in future JunOS EVO releases. Get in touch with the Juniper Support Team or your local Juniper Accounts Team for more information about this enhancement.