When the device initiating an IPSec VPN is connected to SRX, the IPsec VPN does not come up.

Both peers report "peer not responding" errors.

Consider topology:

VPN-Peer-1 <---> SRX <---> VPN-Peer-2

When VPN-Peer-2 initiates a VPN connection, the VPN stays down.

However, when VPN-Peer-1 initiates a VPN connection, the VPN comes UP.

The connectivity between the peers is verified via ping, and there are no issues in both directions.

When the traffic is via SRX, and if the traffic is NATed before it is sent out of SRX, by default Port-Address-Translation(PAT) will be applied.

In the IPSec VPN scenario, when the VPN-Peer-2 initiates the traffic, the source port will be UDP500 which will be translated to a random port by SRX, for example, 4646.

And when VPN-Peer-1 responds, the destination port will be UDP 4646.

But the VPN-Peer-2 is expecting a response on port UDP500, hence this packet will be dropped.

This results in a continuous loop when both the peers will be waiting and re-transmitting packets.

The solution is to disable PAT on SRX so the source port is not changed when NAT is applied to the traffic.

set security nat source pool src-nat-pool-1 address x.x.x.x/x 
set security nat source pool src-nat-pool-1 port no-translation 
set security nat source rule-set rs1 from zone LAN
set security nat source rule-set rs1 to zone WAB
set security nat source rule-set rs1 rule1 match source address 0.0.0.0/0
set security nat source rule-set rs1 rule r1 then source src-nat-pool-1