I'm having trouble establishing a route-based multipoint tunnel from an SRX5400 running 12.3x48 code to an ISG1000, pretty sure the issue is on the SRX side. The security association appears to be up on both sides, but I can't pass any traffic over it. Here is the output from looking at the SRX SA:
show security ipsec security-associations index 131090 detail
node1:
--------------------------------------------------------------------------
ID: 131090 Virtual-system: root, VPN Name: JAXS
Local Gateway: x.x.132.44, Remote Gateway: x.x.72.44
Local Identity: ipv4(any:0,[0..3]=x.x.132.44)
Remote Identity: ipv4(any:0,[0..3]=x.x.72.44)
Version: IKEv1
DF-bit: copy, Bind-interface: st0.1
Port: 500, Nego#: 3581, Fail#: 3566, Def-Del#: 0 Flag: 0x600a21
Tunnel events:
Tue May 15 2018 21:31:36: IPSec SA rekey successfully completed (1 times)
Tue May 15 2018 21:31:36: IKE SA negotiation successfully completed (17 times)
Mon May 14 2018 21:41:43: IPSec SA negotiation successfully completed (2 times)
Mon May 14 2018 21:41:33: Tunnel configuration changed. Corresponding IKE/IPSec SAs are deleted (1 times)
Mon May 14 2018 21:33:28: IPSec SA negotiation successfully completed (1 times)
Mon May 14 2018 21:33:24: Tunnel configuration changed. Corresponding IKE/IPSec SAs are deleted (1 times)
Mon May 14 2018 20:15:27: IPSec SA negotiation successfully completed (1 times)
Mon May 14 2018 20:15:22: IPSec SA delete payload received from peer, corresponding IPSec SAs cleared (1 times)
Mon May 14 2018 07:36:17: IPSec SA negotiation successfully completed (1 times)
Location: FPC 0, PIC 1, KMD-Instance 2
Direction: inbound, SPI: c1f70cac, AUX-SPI: 0
It appears to be up, right? The only issue I can find is that sometimes the following error message appears :
"IPSec negotiation failed with error: Received nexthop-tunnel IP address from peer, is not in bind-interface's subnet. Negotiation failed. "
Does this mean that the tunnel interfaces on both sides of the VPN need to be in the same subnet? I have been able to successfully build tunnels from Netscreen to Netscreen using different tunnel interface subnets, so I'm not sure swhy it wouldn't work Netscreen to SRX.
Please let me know if you need more information.