Quantcast
Channel: SRX Services Gateway topics
Viewing all articles
Browse latest Browse all 3959

SRX 240 IPSEC S-to-S VPN - Traffic not passing

$
0
0

Hi,

Have SRX 240 in a cluster and configured ipsec vpn... the Tunnel is up and the policies seems to be ok... but the traffic is not passing through the tunnel (st0.0)... I have used lo0 as the external interface.  The setup is that incoming and outgoing is same interface/zone.. So the packet flow is 

incoming---> ip packet ---->reth4.0----->SRX

outgoing -----> encrypted---->st0.0---->reth4.0

I have not configured any NAT... 

Please find the below logs which was taken using the flow traceoptions basic-datapath... please let me know if any other information is required... 

 

========================log======================================

Jan 17 12:48:51 12:48:51.233634:CID-1:RTSmiley Surprisedut_ifp reth4.0 not tunnel if

Jan 17 12:48:51 12:48:51.233634:CID-1:RT:get_tunnel_out_ha_ifp: out_ifp reth4.0

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:flow_ipv4_rt_lkup success SOURCE-IP0, iifl 0x59, oifl 0x59

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:flow_ipv4_rt_lkup success DEST-IP, iifl 0x59, oifl 0x5c

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:flow_ipv4_rt_lkup success SOURCE-IP, iifl 0x59, oifl 0x59

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: SOURCE-IP0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: reth4.0->st0.0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: SOURCE-IP0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: reth4.0->st0.0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: SOURCE-IP

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: reth4.0->st0.0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: DEST-IP

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: st0.0->st0.0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: DEST-IP

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: st0.0->st0.0

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:gate create. num=4, pid 26, alg_id 63

 

Jan 17 12:48:51 12:48:51.234127:CID-1:RT:search gate for public:0.0.0.0/0->SOURCE-IP0/50026,17

 

Jan 17 12:48:51 12:48:51.234622:CID-1:RT:gate_search_specific_bucket: no gate found

 

Jan 17 12:48:51 12:48:51.234622:CID-1:RT:search gate for public:0.0.0.0/0->SOURCE-IP0/50027,17

 

Jan 17 12:48:51 12:48:51.234622:CID-1:RT:gate_search_specific_bucket: no gate found

 

Jan 17 12:48:51 12:48:51.234622:CID-1:RT:search gate for public:0.0.0.0/0->SOURCE-IP/5060,17

 

----------------------------------------------------------end-of-log-----------------------------------------------------------------

Thanks


Viewing all articles
Browse latest Browse all 3959

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>