0

I've connected Juniper SRX5800 and another enodeB device (don't know the vendor) by an IPSec tunnel. It uses IKEv1 for negotiation of keys. there are 10 ACLs on the enodeB side and on Juniper SRX, I have configured ip-to-any ACLs for all 10 enodeB IP addresses.

When in this setup, I observe that only 5 SA get created. Juniper although successfully negotiates the last three SAs, sends a delete notification again and again. So, the the last three SA get deleted. I want to know whether anyone in this community knows of a limitation in the Juniper SRX5800 series which makes it behave like this. The version of the OS with me is 11.4R2.14

1
  • It's a policy based VPN. Also the policy has 8 ACL rules. All 8 ACL rules are under the same policy. Under normal circumstances, I expect Juniper to create 8 seperate SAs under the same policy with the same peer. There is one more thing to the problem. If I create ip-to-ip ACLs, then all 8 SAs are created; but if the ACLs are ip-to-any, then only 5 are created. This is the problem. I've updated the same in the problem statement. – Arun Kumar M S Dec 31 '12 at 4:41
0

I don't know the answer to this specific case, but from my experience with Juniper devices, when they do anything that doesn't seem to make sense I open a JTAC case. Each release usually has a number of bugs which could explain this issue. There could also be a licensing restriction on the number of SAs created.

4
  • oh, I didn't know about the JTAC. I searched through all their release notes, documentation. Will raise a query on JTAC right away. Thanks for the info. Will update here, if I get any update on JTAC. – Arun Kumar M S Dec 28 '12 at 9:18
  • I tried to do this but I met some non-technical problems. I don't own the SRX device. My client's client is the owner. My client is hesitant to contact the owner for support. I searched through all of Juniper's release notes, documentation. But I found nothing in that. This is a pretty high end device, 10 SAs is too less a number for a server device like SRX5800, so I don't expect licensing issues. – Arun Kumar M S Dec 28 '12 at 9:27
  • You can create a free Juniper account and log a case using the serial number of the device you're working on. JTAC will check to see if it has an up to date support contract, and if so, should be able to work on your case. Just be open with them! – user1804 Dec 28 '12 at 13:35
  • Thank you very much. I'll try to see if this is possible. – Arun Kumar M S Dec 31 '12 at 5:41
0

The SRX5800 can certainly handle a lot more SA's then that.

It can handle 15,000 tunnels per the datasheet at: http://www.juniper.net/us/en/local/pdf/datasheets/1000254-en.pdf

So I would think, no there is not a limit, it's probably tearing down the other SA's for a configuration mismatch. Is this a route or policy based VPN?

2
  • You really need to find out what type of device is on the other end. – SpacemanSpiff Dec 29 '12 at 3:38
  • It's a policy based VPN. Also the policy has 8 ACL rules. All 8 ACL rules are under the same policy. Under normal circumstances, I expect Juniper to create 8 seperate SAs under the same policy with the same peer. There is one more thing to the problem. If I create ip-to-ip ACLs, then all 8 SAs are created; but if the ACLs are ip-to-any, then only 5 are created. This is the problem. I've updated the same in the problem statement. And the device on the other side is a client side eNodeB device. – Arun Kumar M S Dec 31 '12 at 4:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.