1

IPSec tunnel to Amazon cloud doesn't work.

My local subnet is 192.168.42.0/24. I'm trying to access Amazon cloud private subnet 172.0.3.0/24.

My firewall model is Juniper SRX550. Tunnel is up (I can see IPSEC and IKE security associations. And I can ping remote IP address of the tunnel interface on the Amazon end of the tunnel. But packet from my internal subnet is not entering tunnel correctly. When I ping from host 192.168.42.131 address 172.0.3.12 I can see this session:

Session ID: 278828, Policy name: trust-to-trust/17, State: Active, Timeout: 6, Valid
  In: 192.168.42.131/2135 --> 172.0.3.12/1;icmp, If: reth1.480, Pkts: 63, Bytes: 3780
  Out: 172.0.3.12/1 --> 192.168.42.131/2135;icmp, If: st0.9, Pkts: 0, Bytes: 0

I.e. size of the packet on internal interface is not zero, but when it enters tunnel it's zero.

When I enabled debug this is what I see:

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:<192.168.42.131/1580->172.0.3.12/1;1> matched filter filter1:

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:packet [60] ipid = 21642, @0x43cda0d2

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:---- flow_process_pkt: (thd 5): flow_ctxt type 1, common flag 0x0, mbuf 0x43cd9e80, rtbl_idx = 0

Oct 27 01:03:40 01:03:40.108989:CID-1:RT: in_ifp <trust:st0.9>

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:flow_process_pkt_exception: setting rtt in lpak to 0x5391d5b0

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:pkt out of tunnel.Proceed normally

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:  st0.9:192.168.42.131->172.0.3.12, icmp, (8/0)

Oct 27 01:03:40 01:03:40.108989:CID-1:RT: find flow: table 0x51acfe50, hash 8971(0xffff), sa 192.168.42.131, da 172.0.3.12, sp 1580, dp 1, proto 1, tok 8

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:  flow got session.

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:  flow session id 247797

Oct 27 01:03:40 01:03:40.108989:CID-1:RT: vector bits 0x10224 vector 0x4ad53040

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:  vsd 1 is active

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:ttl vector, out_tunnel = 0x59c7cc90

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:pre-frag not needed: ipsize: 60, mtu: 1436, nsp2->pmtu: 1436

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:  encap vector

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:  going into tunnel 131082 (nsp_tunnel=0x59c7cc90).

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:  flow_encrypt: tun 0x59c7cc90, type 1

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:mbuf 0x43cd9e80, exit nh 0x1d0010

Oct 27 01:03:40 01:03:40.108989:CID-1:RT:flow_process_pkt_exception: Freeing lpak 0x5128ee38 associated with mbuf 0x43cd9e80

Oct 27 01:03:40 01:03:40.108989:CID-1:RT: ----- flow_process_pkt rc 0x0 (fp rc 0)

Seems normal to me.

Does anybody know how to solve it?

Thanks.

0

Problem was on Amazon private cloud end - some routing issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.