Description

VPN between SRX1600(iked) and other device is failing if there are more than one GW configured each with different policy and proposals linked to it.

Symptoms

logs indicate no-proposal-chosen

 

Oct 28 09:46:01.861443 [TER] [ATEC] [*.*.*.* <-> *.*.*.*] IKEv1 packet S(*.*.*.*:500 -> *.*.*.*:500): len= 64, mID=bc38c616, HDR, N(NO_PROPOSAL_CHOSEN)

Oct 28 09:46:01.861624 [TER] [ATEC] [*.*.*.* <-> *.*.*.*] IKEv1 Error : No proposal chosen

Oct 28 09:47:01.860681 [TER] [ATEC] [*.*.*.* <-> *.*.*.*] IKEv1 packet R(*.*.*.*:500 <- *.*.*.*:500): len=499, mID=00000000, HDR, SA, KE, Nonce, ID, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, Vid, T

Oct 28 09:47:01.860851 [ERR] [ATEC] [*.*.*.* <-> *.*.*.*] ike-sa negotiation failed due to invalid sa-slection

Solution

In IKEv1 aggressive mode, the Responder receives the Remote Identity of the Initiator in the first IKE message itself. 
This could be used to select the correct gateway from the list of gateways anchored to same interface/IP address. 
The issue reported is addressed and fixed in Junos release, junos:23.4R2-S4 junos:24.4R2 junos:25.1R1

Modification History

2024-12-13 : Article Created