0

I've connected Juniper SRX5800 and another enodeB device (don't know the vendor) by an IPSec tunnel. It uses IKEv1 for negotiation of keys. there are 10 ACLs on the enodeB side and on Juniper SRX, I have configured ip-to-any ACLs for all 10 enodeB IP addresses.

When in this setup, I observe that only 5 SA get created. Juniper although successfully negotiates the last three SAs, sends a delete notification again and again. So, the the last three SA get deleted. I want to know whether anyone in this community knows of a limitation in the Juniper SRX5800 series which makes it behave like this. The version of the OS with me is 11.4R2.14

1
  • It's a policy based VPN. Also the policy has 8 ACL rules. All 8 ACL rules are under the same policy. Under normal circumstances, I expect Juniper to create 8 seperate SAs under the same policy with the same peer. There is one more thing to the problem. If I create ip-to-ip ACLs, then all 8 SAs are created; but if the ACLs are ip-to-any, then only 5 are created. This is the problem. I've updated the same in the problem statement. Dec 31, 2012 at 4:41

2 Answers 2

0

I don't know the answer to this specific case, but from my experience with Juniper devices, when they do anything that doesn't seem to make sense I open a JTAC case. Each release usually has a number of bugs which could explain this issue. There could also be a licensing restriction on the number of SAs created.

4
  • oh, I didn't know about the JTAC. I searched through all their release notes, documentation. Will raise a query on JTAC right away. Thanks for the info. Will update here, if I get any update on JTAC. Dec 28, 2012 at 9:18
  • I tried to do this but I met some non-technical problems. I don't own the SRX device. My client's client is the owner. My client is hesitant to contact the owner for support. I searched through all of Juniper's release notes, documentation. But I found nothing in that. This is a pretty high end device, 10 SAs is too less a number for a server device like SRX5800, so I don't expect licensing issues. Dec 28, 2012 at 9:27
  • You can create a free Juniper account and log a case using the serial number of the device you're working on. JTAC will check to see if it has an up to date support contract, and if so, should be able to work on your case. Just be open with them!
    – user1804
    Dec 28, 2012 at 13:35
  • Thank you very much. I'll try to see if this is possible. Dec 31, 2012 at 5:41
0

The SRX5800 can certainly handle a lot more SA's then that.

It can handle 15,000 tunnels per the datasheet at: http://www.juniper.net/us/en/local/pdf/datasheets/1000254-en.pdf

So I would think, no there is not a limit, it's probably tearing down the other SA's for a configuration mismatch. Is this a route or policy based VPN?

2
  • You really need to find out what type of device is on the other end. Dec 29, 2012 at 3:38
  • It's a policy based VPN. Also the policy has 8 ACL rules. All 8 ACL rules are under the same policy. Under normal circumstances, I expect Juniper to create 8 seperate SAs under the same policy with the same peer. There is one more thing to the problem. If I create ip-to-ip ACLs, then all 8 SAs are created; but if the ACLs are ip-to-any, then only 5 are created. This is the problem. I've updated the same in the problem statement. And the device on the other side is a client side eNodeB device. Dec 31, 2012 at 4:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .