Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've connected Juniper SRX5800 and another enodeB device (don't know the vendor) by an IPSec tunnel. It uses IKEv1 for negotiation of keys. there are 10 ACLs on the enodeB side and on Juniper SRX, I have configured ip-to-any ACLs for all 10 enodeB IP addresses.

When in this setup, I observe that only 5 SA get created. Juniper although successfully negotiates the last three SAs, sends a delete notification again and again. So, the the last three SA get deleted. I want to know whether anyone in this community knows of a limitation in the Juniper SRX5800 series which makes it behave like this. The version of the OS with me is 11.4R2.14

share|improve this question
    
It's a policy based VPN. Also the policy has 8 ACL rules. All 8 ACL rules are under the same policy. Under normal circumstances, I expect Juniper to create 8 seperate SAs under the same policy with the same peer. There is one more thing to the problem. If I create ip-to-ip ACLs, then all 8 SAs are created; but if the ACLs are ip-to-any, then only 5 are created. This is the problem. I've updated the same in the problem statement. –  arun Dec 31 '12 at 4:41

2 Answers 2

I don't know the answer to this specific case, but from my experience with Juniper devices, when they do anything that doesn't seem to make sense I open a JTAC case. Each release usually has a number of bugs which could explain this issue. There could also be a licensing restriction on the number of SAs created.

share|improve this answer
    
oh, I didn't know about the JTAC. I searched through all their release notes, documentation. Will raise a query on JTAC right away. Thanks for the info. Will update here, if I get any update on JTAC. –  arun Dec 28 '12 at 9:18
    
I tried to do this but I met some non-technical problems. I don't own the SRX device. My client's client is the owner. My client is hesitant to contact the owner for support. I searched through all of Juniper's release notes, documentation. But I found nothing in that. This is a pretty high end device, 10 SAs is too less a number for a server device like SRX5800, so I don't expect licensing issues. –  arun Dec 28 '12 at 9:27
    
You can create a free Juniper account and log a case using the serial number of the device you're working on. JTAC will check to see if it has an up to date support contract, and if so, should be able to work on your case. Just be open with them! –  Andrew H Dec 28 '12 at 13:35
    
Thank you very much. I'll try to see if this is possible. –  arun Dec 31 '12 at 5:41

The SRX5800 can certainly handle a lot more SA's then that.

It can handle 15,000 tunnels per the datasheet at: http://www.juniper.net/us/en/local/pdf/datasheets/1000254-en.pdf

So I would think, no there is not a limit, it's probably tearing down the other SA's for a configuration mismatch. Is this a route or policy based VPN?

share|improve this answer
    
You really need to find out what type of device is on the other end. –  SpacemanSpiff Dec 29 '12 at 3:38
    
It's a policy based VPN. Also the policy has 8 ACL rules. All 8 ACL rules are under the same policy. Under normal circumstances, I expect Juniper to create 8 seperate SAs under the same policy with the same peer. There is one more thing to the problem. If I create ip-to-ip ACLs, then all 8 SAs are created; but if the ACLs are ip-to-any, then only 5 are created. This is the problem. I've updated the same in the problem statement. And the device on the other side is a client side eNodeB device. –  arun Dec 31 '12 at 4:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.