Hi Paul - In my experience, I have used a looback interface address of the SRX as the destination of the GRE tunnel on both sides then just send the /32 route of the loopback at the other end to the st0.0 address. I've always used OSPF to carry the routes over the tunnel. The only other thing to keep in mind was setting proxy ID's on the VPN.
Doing it this way, I've never seen what your describing and tunnels are solid. I hope this helps - -----Original Message----- From: Paul Stewart [mailto:[email protected]] Sent: Friday, January 20, 2012 6:55 PM To: [email protected] Subject: [j-nsp] SRX Site-to-Site Question Hey there. Having a bunch of grief with site to site VPN on SRX220. This box connects out on a GRE tunnel carrying voice traffic to one location along with a couple of IPSec tunnels to other remote offices (2 at the moment). Sometimes it works and sometimes it doesn't . I know that's a loaded statement ... just getting traceoptions setup now and going to troubleshoot further. Without getting into a length email on this, my question is specific to routing across the st interface. We have it setup to route traffic to the next hop (far end) of the st0.0 interface for example. This works for a few hours approximately and then no traffic will pass. Should the route be to the st0.0 interface itself or the next hop? The Juniper docs clearly state the st0.0 interface specifically, but we have a lot of these deployed without any issues and always route to the next layer3 hop. A reboot of the SRX causes everything to start working again and since it does work for a period of time *usually* after a reboot I'm thinking the routing question above is not relevant. A little while ago, the GRE tunnel stopped passing traffic but the IPSec continued to work properly. After the reboot, the GRE started to work properly and the IPSec stopped working... nothing logical to that in my opinion.. When traffic stops passing, IKE and IPSec are up/up.. The gr interface shows up as well.. Scratching my head - obviously I have to do a lot more troubleshooting yet but wondering if this sounds familiar to anyone by chance? It's running 10.4R7.5 and I'm just upgrading it to 10.4R8.5 as I write this.. Thanks ;) Paul _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
