r/Juniper•
ckozler

Understanding ESP configuration in SRX

To expand, take two SRX's and configure ESP on the proposal for a VPN and then on the remote side, dont configure ESP. I see the tunnels come up fine and work and passing traffic fine but sometimes when one side clears their security association the TCP sessions die and the entire stack resets, then not traffic is passed. However, both sides still show tunnel as UP

Is this a result of ESP configured on one side and not the other? Juniper cant seem to answer this and its not something I can reliably create on the fly / on demand so I am curious

I would expect if one side is ESP and the other not, that the tunnels wouldnt come up. In testing, if one side is ESP and the other is AH then it doesnt come up (expected too)...and Juniper has said it does not default to ESP or at least they cannot find any docs that say they do

Posted Apr 26, 2017, 5:56 PM UTC

111
Loading comments…