This article explains an issue where the routes pointing towards secure tunnel interface (st0) are installed in the routing table but cannot be seen in the forwarding table.

There will be connectivity issues with the remote resources accessible via st0 interfaces, as the routes can be be seen correctly in the routing table but cannot be seen in the forwarding table. This is shown in the example below:

User@srx>show route 172.23.251.192/28

inet.0: 117 destinations, 117 routes (117 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

172.23.251.192/28  *[Static/5] 07:23:39
                    >  to 1.1.1.47 via st0.1

User@srx>show route forwarding-table destination 172.23.251.192/28
Routing table: default.inet
Internet:
Destination        Type RtRef Next hop           Type Index    NhRef Netif
default            user     1 0:0:c:7:ac:1       ucst     1342     8 reth1.0
default            perm     0                    rjct       36     1

There will be 'ENOENT' errors for such routes in the krt queue output, as shown below:

User@srx>show krt queue
Routing table add queue: 0 queued
Interface add/delete/change queue: 0 queued
Top-priority deletion queue: 0 queued
Top-priority change queue: 0 queued
Top-priority add queue: 0 queued
high priority V4oV6 tcnh delete queue: 0 queued
high prioriy anchor gencfg delete queue: 0 queued
High-priority multicast add/change: 0 queued
Indirect next hop top priority add/change: 0 queued
Indirect next hop add/change: 0 queued
high prioriy anchor gencfg add-change queue: 0 queued
MPLS add queue: 0 queued
Indirect next hop delete: 0 queued
High-priority deletion queue: 0 queued
MPLS change queue: 0 queued
High-priority change queue: 0 queued
High-priority add queue: 0 queued
Normal-priority indirect next hop queue: 0 queued
Normal-priority deletion queue: 0 queued
Normal-priority composite next hop deletion queue: 0 queued
Low prioriy Statistics-id-group deletion queue: 0 queued
Normal-priority change queue: 0 queued
Normal-priority add queue: 5 queued
                ADD gf 1 inst id 0 172.23.250.0/26 nexthop
         1.1.1.47, st0.1
         (3442)
                    error 'ENOENT -- Item not found'
                    kqp '0x5bf40b0'
                ADD gf 1 inst id 0 172.23.251.208/28 nexthop
         1.1.1.47, st0.1
         (3443)
                    error 'ENOENT -- Item not found'
                    kqp '0x5bf42c0'
                ADD gf 1 inst id 0 172.23.251.0/26 nexthop
         1.1.1.47, st0.1
         (3443)

This issue is seen after the ipsec tunnel for a multipoint secure tunnel interface flaps multiple times resulting in the route flap for the associated tunnels. After the tunnel flaps, SRX fails to instal few random routes associated with that tunnel in its forwarding table resulting in the connectivity issues. This is a known issue and is being tracked via PR1817807.

This issue has been fixed in the following JunOS versions:

22.2R3-S6-EVO

24.4R1-EVO

25.1R1-EVO

22.2R3-S4-J5

22.2R3-S5-J1

24.4R1

25.1R1