Hi,
Have SRX 240 in a cluster and configured ipsec vpn... the Tunnel is up and the policies seems to be ok... but the traffic is not passing through the tunnel (st0.0)... I have used lo0 as the external interface. The setup is that incoming and outgoing is same interface/zone.. So the packet flow is
incoming---> ip packet ---->reth4.0----->SRX
outgoing -----> encrypted---->st0.0---->reth4.0
I have not configured any NAT...
Please find the below logs which was taken using the flow traceoptions basic-datapath... please let me know if any other information is required...
========================log======================================
Jan 17 12:48:51 12:48:51.233634:CID-1:RTut_ifp reth4.0 not tunnel if
Jan 17 12:48:51 12:48:51.233634:CID-1:RT:get_tunnel_out_ha_ifp: out_ifp reth4.0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:flow_ipv4_rt_lkup success SOURCE-IP0, iifl 0x59, oifl 0x59
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:flow_ipv4_rt_lkup success DEST-IP, iifl 0x59, oifl 0x5c
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:flow_ipv4_rt_lkup success SOURCE-IP, iifl 0x59, oifl 0x59
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: SOURCE-IP0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: reth4.0->st0.0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: SOURCE-IP0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: reth4.0->st0.0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: SOURCE-IP
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: reth4.0->st0.0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: DEST-IP
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: st0.0->st0.0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: src_ip: DEST-IP
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: dst_ip: DEST-IP port:0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:ASL nat rule lookup: lsys:0, ifp: st0.0->st0.0
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:gate create. num=4, pid 26, alg_id 63
Jan 17 12:48:51 12:48:51.234127:CID-1:RT:search gate for public:0.0.0.0/0->SOURCE-IP0/50026,17
Jan 17 12:48:51 12:48:51.234622:CID-1:RT:gate_search_specific_bucket: no gate found
Jan 17 12:48:51 12:48:51.234622:CID-1:RT:search gate for public:0.0.0.0/0->SOURCE-IP0/50027,17
Jan 17 12:48:51 12:48:51.234622:CID-1:RT:gate_search_specific_bucket: no gate found
Jan 17 12:48:51 12:48:51.234622:CID-1:RT:search gate for public:0.0.0.0/0->SOURCE-IP/5060,17
----------------------------------------------------------end-of-log-----------------------------------------------------------------
Thanks