Juniper SRX Site-to-Site VPN Issues – Changing IP and Default Route

juniper-srxvpn

so, we have a SRX100 in one site (call it site B) and a SRX240 on our main site (Site A). the ISP at site B asked us to change our IP address from one network to another. (due to some routing issues they were faceing). the problem is that we have a site2site vpn between the two (ike).

so, tonight I am sitting at site B, and want to fix this.

I change all the setting on the VPN on both sites, to reflect the changes, and update any firewall rule that need updating for this to work.

note 1) on site B, at this point I ADD the IP address in addition to the old ip address (I dit not replace it), but I did replace the default route, and the vpn connection end points.

I then commit at site A first (since I have to do it while I can still reach it by vpn). then commit site B.

I notice that I have internet stil on site B, which is good, but the VPN did NOT come up at all.

I look in the logfiles on both sides (I have a secondary vpn to reach the site A switch). and there is nothing there! no trace of the vpn at all.. which is strange.

then I notice that my ip as seen from outside is still the old ip address on site B (whatismyip.org or such).

to, then I remove the old ip from the firewall.. and committ again (siteb).

then, the VPN comes UP, and it shows in the logfiles like it should.

so, I try to add the ip address back again to test, and the vpn goes down.

and finally I try to remove the old ip on site B again… but the VPN does NOT come up.. and again nothing in the logs..

Best Answer

so, I think I have found the solution finally.

at both sides I run this command:

show security ike security-associations

Site B showed 

Index   State  Initiator cookie  Responder cookie  Mode           Remote Address   
<anumber> DOWN   <some data>  <0000000000000000>  Main           <correct ip>

which is logical, since the vpn IS down.

then I ran same on the other side (side A)

it showed this: Index Remote Address State Initiator cookie Responder cookie Mode UP Main UP Main
UP Main

which is strange since again, the vpn is DOWN..

so, I tried to run this command:

clear security ike security-associations index <index from first one above>

and then the vpn came up again... and I finally alro removed the other "old ip" line, and now only have one line (site A)

    <anumber> <newip>   UP     <some data>  <some data>  Main

and similarly site B shows 

<anumber> UP     <some data>  <some data>  Main           <correct ip>

and the vpn seems stable.

I did not find this solution on any of the juniper FAQ, and googled a lot, but managed by a bit of luck to solve it. so I wanted to document it a bit here just in case someone (like me) need it.

IF: I am completely wrong here, and what happened here just luck and not related, I do hope that you will comment or edit thanks!

Related Topic