Hi all,
I'm trying to set up a site-to-site VPN tunnel from a Juniper SRX220 to a server running StrongSwan using IKEv1 with PSK. The problem is that even if the "ike" service is allowed in the host inbound traffic of the Internet (untrusted) zone, IKE phase 1 keeps timing out.
Here's the SRX's KMD log that indicates a timeout:
SRX220 kmd[4797]: IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: vpn-amsterdam-strongswan Gateway: gw-amsterdam-strongswan, Local: <srx-ip-address>/4500, Remote: <vpn-server-public-ip>/4500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 0
And here's the StrongSwan logs showing a lot of retransmits:
Jul 13 10:32:46 vpn-ams charon: 16[ENC] generating ID_PROT response 0 [ ID HASH ] Jul 13 10:32:46 vpn-ams charon: 16[NET] sending packet: from 10.18.0.5[4500] to <srx-ip-address>[4500] (92 bytes) Jul 13 10:32:46 vpn-ams charon: 16[IKE] destroying duplicate IKE_SA for peer '<redacted>', received INITIAL_CONTACT Jul 13 10:32:56 vpn-ams charon: 05[NET] received packet: from <srx-ip-address>[4500] to 10.18.0.5[4500] (108 bytes) Jul 13 10:32:56 vpn-ams charon: 05[IKE] received retransmit of request with ID 0, retransmitting response Jul 13 10:32:56 vpn-ams charon: 05[NET] sending packet: from 10.18.0.5[4500] to <srx-ip-address>[4500] (92 bytes) Jul 13 10:33:06 vpn-ams charon: 13[IKE] sending keep alive to <srx-ip-address>[4500] Jul 13 10:33:06 vpn-ams charon: 12[NET] received packet: from <srx-ip-address>[4500] to 10.18.0.5[4500] (108 bytes) Jul 13 10:33:06 vpn-ams charon: 12[IKE] received retransmit of request with ID 0, retransmitting response Jul 13 10:33:06 vpn-ams charon: 12[NET] sending packet: from 10.18.0.5[4500] to <srx-ip-address>[4500] (92 bytes)
Running 'show security ike sa' sometimes work and sometimes don't. This result appeared for a while after running 'restart ipsec-key-management', but would disappear after a while.
namo@SRX220> show security ike sa Index State Initiator cookie Responder cookie Mode Remote Address 594712 DOWN 3064dc3314993733 0000000000000000 Main <vpn-server-ip>
Any suggestions?