4

In an office setting, multiple clients (Mac OSX, Ubuntu, iOS, Android and Windows 8) connect to a VPN server in another location. These clients are behind an SRX240B router which is connected to a PPPoE fiber uplink.

The SRX240B replaced the previous router, an SRX100H. The SRX100 was completely stable, but the SRX240B has some weird issues.

When clients connect to VPN, the connection usually works for a couple of minutes, but then all internet traffic disappears. Every device, every browser, every connection is lost.

I can SSH into the router, but pinging external hosts (8.8.8.8 for example) just times out. When a specific VPN connection is disconnected by the user, all internet traffic returns.

I have no idea what could cause this. The only thing I can imagine is that the SRX runs its own VPN software (and has active listening processes on UDP port 500 and 4500), and this somehow interferes with the client VPN. However, this does not explain why the SRX100 running exactly the same config has no issues.

For completeness, here is my router config on the SRX100. The only difference with the SRX240 is that all fe-*/*/*.*-interfaces are replaced with ge-*/*/*.*-interfaces.

## Last commit: 2015-02-19 15:37:07 UTC by root
version 12.1X44-D40.2;
system {
    host-name --obscured--;
    root-authentication {
        encrypted-password --obscured--;
    }
    name-server {
        8.8.8.8;
        8.8.4.4;
    }
    services {
        ssh;
        dns {
            dns-proxy {
                propogate-setting enable;
                interface {
                    vlan.0;
                }
                default-domain * {
                    forwarders {
                        --obscured--;
                        --obscured--;
                        --obscured--;
                    }
                }
            }
        }
        web-management {
            http {
                port 80;
                interface vlan.0;
            }
        }
        dhcp {
            pool 192.168.2.0/24 {
                address-range low 192.168.2.1 high 192.168.2.99;
                name-server {
                    192.168.2.254;
                }
                router {
                    192.168.2.254;
                }
                propagate-settings vlan.0;
            }
        }
    }
}
interfaces {
    interface-range interfaces-trust {
        member fe-0/0/1;
        member fe-0/0/2;
        member fe-0/0/3;
        member fe-0/0/4;
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/0 {
        unit 0 {
            encapsulation ppp-over-ether;
        }
    }
    pp0 {
        unit 0 {
            point-to-point;
            ppp-options {
                pap {
                    local-name --obscured--;
                    local-password --obscured--; ## SECRET-DATA
                    passive;
                }
            }
            pppoe-options {
                underlying-interface fe-0/0/0.0;
                idle-timeout 0;
                auto-reconnect 10;
                client;
            }
            family inet {
                mtu 1492;
                negotiate-address;
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                address 192.168.2.254/24;
            }
        }
    }
}
snmp {
    location --obscured--;
    contact --obscured--;
    community public {
        authorization read-only;
        clients {
            192.168.2.0/24;
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 {
            next-hop pp0.0;
            metric 0;
        }
    }
}
security {
    address-book {
        global {
            address --obscured-- --obscured--;
            address nagios02 192.168.2.249/32;
            address anywhere 0.0.0.0/0;
            address jeroen 192.168.2.170/32;
        }
    }
    flow {
        tcp-mss {
            all-tcp {
                mss 1300;
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
            limit-session {
                source-ip-based 50000;
                destination-ip-based 50000;
            }
        }
    }
    nat {
        source {
            rule-set untrust-to-trust {
                from zone trust;
                to zone untrust;
                rule outbound-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
        destination {
            pool --obscured-- {
                address 192.168.2.249/32;
            }
            pool --obscured-- {
                address 192.168.2.170/32;
            }
            rule-set ruleset-from-untrust {
                from interface pp0.0;
                rule --obscured-- {
                    match {
                        source-address --obscured--/32;
                        destination-address --obscured--/32;
                        destination-port 5666;
                    }
                    then {
                        destination-nat pool --obscured--;
                    }
                }
                rule port_17071 {
                    match {
                        destination-address --obscured--/32;
                        destination-port 17071;
                    }
                    then {
                        destination-nat pool --obscured--;
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy outbound {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone untrust to-zone trust {
            policy nrpe {
                match {
                    source-address --obscured--;
                    destination-address --obscured--;
                    application nrpe;
                }
                then {
                    permit;
                }
            }
            policy --obscured-- {
                match {
                    source-address anywhere;
                    destination-address --obscured--;
                    application --obscured--;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone untrust {
            screen untrust-screen;
            interfaces {
                pp0.0;
            }
        }
        security-zone trust {
            interfaces {
                vlan.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            ssh;
                            ping;
                            snmp;
                            http;
                            dns;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
    }
}
applications {
    application nrpe {
        protocol tcp;
        destination-port 5666;
    }
    application --obscured-- {
        protocol tcp;
        destination-port 17071;
    }
}
vlans {
    vlan-trust {
        vlan-id 10;
        l3-interface vlan.0;
    }
}

Update 1: Extra information, as requested by Jordan Head in the comments:

The SRX100 runs Junos 12.1X44-D40.2. The SRX240 runs Junos 12.1X46-D30.2, but the problem als occurred with an older version. I don't remember which version exactly, but I believe it was from the 11.4-series.

The problem occurs with any number of connected VPN clients (varying from 1 to 5 simultaneously).

I've checked the logs but nothing stood out.

The results of show system license:

root@router> show system license
License usage:
                                 Licenses     Licenses    Licenses    Expiry
  Feature name                       used    installed      needed
  dynamic-vpn                           0            2           0    permanent
  ax411-wlan-ap                         0            2           0    permanent

Licenses installed: none

Update 2: status when connection is lost

I needed some time to reproduce the problem because my users are depending on this uplink. I got the following status at the moment the problem occurs:

root@router> show interfaces pp0.0 detail | no-more 
  Logical interface pp0.0 (Index 71) (SNMP ifIndex 548) (Generation 145)
    Flags: Hardware-Down Point-To-Point SNMP-Traps 0x0 Encapsulation: PPPoE
    PPPoE:
      State: SessionDown, Session ID: None,
      Configured AC name: None, Service name: None,
      Auto-reconnect timeout: 10 seconds, Idle timeout: Never,
      Underlying interface: ge-0/0/0.0 (Index 70)
    Traffic statistics:
     Input  bytes  :               665311
     Output bytes  :             41008220
     Input  packets:                 2442
     Output packets:               114687
    Local statistics:
     Input  bytes  :               665311
     Output bytes  :               946794
     Input  packets:                 2442
     Output packets:                 6297
    Transit statistics:
     Input  bytes  :                    0                    0 bps
     Output bytes  :             40061426                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:               108390                    0 pps
  Keepalive settings: Interval 10 seconds, Up-count 1, Down-count 3
  Keepalive statistics:
    Input : 63 (last seen 00:03:17 ago)
    Output: 191 (last sent 00:03:19 ago)
  LCP state: Down
  NCP state: inet: Down, inet6: Down, iso: Not-configured, mpls: Not-configured
  CHAP state: Closed
  PAP state: Closed
    Security: Zone: untrust
    Flow Statistics :  
    Flow Input statistics :
      Self packets :                     2092
      ICMP packets :                     1385
      VPN packets :                      0
      Multicast packets :                5
      Bytes permitted by policy :        84103935
      Connections established :          52 
    Flow Output statistics: 
      Multicast packets :                0
      Bytes permitted by policy :        39000259 
    Flow error statistics (Packets dropped due to): 
      Address spoofing:                  0
      Authentication failed:             0
      Incoming NAT errors:               0
      Invalid zone received packet:      0
      Multiple user authentications:     0 
      Multiple incoming NAT:             0
      No parent for a gate:              0
      No one interested in self packets: 18       
      No minor session:                  0 
      No more sessions:                  0
      No NAT gate:                       0 
      No route present:                  409 
      No SA for incoming SPI:            0 
      No tunnel found:                   0
      No session for a gate:             0 
      No zone or NULL zone binding       0
      Policy denied:                     0
      Security association not active:   0 
      TCP sequence number out of window: 1
      Syn-attack protection:             0
      User authentication errors:        0
    Protocol inet, MTU: 1400, Generation: 158, Route table: 0
      Flags: Sendbcast-pkt-to-re, Protocol-Down, User-MTU, Negotiate-Address
    Protocol inet6, MTU: 1400, Generation: 159, Route table: 0
      Flags: Protocol-Down, User-MTU
      Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
        Destination: --obscured--/64, Local: --obscured--
    Generation: 162
      Addresses, Flags: Dest-route-down Is-Preferred
        Destination: fe80::/64, Local: fe80::56e0:320f:fcea:9480
    Generation: 164
root@router> show ethernet-switching table interface 
Ethernet-switching table: 30 entries, 28 learned, 0 persistent entries
  VLAN              MAC address       Type         Age Interfaces
  vlan-trust        *                 Flood          - All-members
  vlan-trust        00:00:aa:c3:3d:c0 Learn          0 ge-0/0/3.0
  vlan-trust        00:0c:29:c9:4e:ef Learn          0 ge-0/0/3.0
  vlan-trust        00:0c:29:ea:61:c0 Learn          0 ge-0/0/3.0
  vlan-trust        00:23:df:f7:e8:aa Learn          0 ge-0/0/3.0
  vlan-trust        00:25:00:ad:f2:44 Learn          0 ge-0/0/4.0
  vlan-trust        1c:b0:94:c0:56:51 Learn          0 ge-0/0/4.0
  vlan-trust        20:a2:e4:62:0d:ec Learn          0 ge-0/0/4.0
  vlan-trust        30:10:e4:77:da:f8 Learn          0 ge-0/0/4.0
  vlan-trust        30:19:66:f3:52:de Learn          0 ge-0/0/4.0
  vlan-trust        40:6c:8f:0a:bc:5f Learn          0 ge-0/0/3.0
  vlan-trust        40:6c:8f:36:99:0b Learn          0 ge-0/0/3.0
  vlan-trust        54:e0:32:ea:94:90 Static         - Router
  vlan-trust        54:e4:3a:2f:81:2b Learn          0 ge-0/0/4.0
  vlan-trust        68:5b:35:93:b2:ea Learn          0 ge-0/0/2.0
  vlan-trust        68:5b:35:cb:b8:b4 Learn          0 ge-0/0/1.0
  vlan-trust        70:de:e2:75:e0:5c Learn          0 ge-0/0/4.0
  vlan-trust        78:19:f7:85:1e:f0 Learn          0 ge-0/0/3.0
  vlan-trust        7c:6d:62:72:f8:0d Learn          0 ge-0/0/4.0
  vlan-trust        7c:c5:37:1b:6d:42 Learn          0 ge-0/0/4.0
  vlan-trust        8c:fa:ba:7d:81:a3 Learn          0 ge-0/0/4.0
  vlan-trust        9c:04:eb:b1:92:9f Learn          0 ge-0/0/4.0
  vlan-trust        ac:87:a3:29:77:57 Learn          0 ge-0/0/3.0
  vlan-trust        b4:75:0e:60:b1:65 Learn          0 ge-0/0/4.0
  vlan-trust        b8:09:8a:bd:5d:17 Learn          0 ge-0/0/4.0
  vlan-trust        bc:30:5b:e0:fa:1b Learn          0 ge-0/0/3.0
  vlan-trust        bc:5f:f4:3b:6e:8d Learn          0 ge-0/0/3.0
  vlan-trust        bc:92:6b:0e:44:d9 Learn          0 ge-0/0/4.0
  vlan-trust        e0:b5:2d:06:93:c6 Learn          0 ge-0/0/4.0
  vlan-trust        e8:50:8b:05:72:2f Learn          0 ge-0/0/4.0
root@root> show route 

inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

192.168.2.0/24     *[Direct/0] 00:34:54
                    > via vlan.0
192.168.2.254/32   *[Local/0] 00:34:54
                      Local via vlan.0

inet6.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

--obscured--/128
                   *[Local/0] 00:34:54
                      Reject
fe80::56e0:320f:fcea:9480/128
                   *[Local/0] 00:34:54
                      Reject

update 06 may - ppp logs

I'm sorry it took me a while to respond, but these are the logs when PPP goes down (at 12:03) and comes back up (at 12:11).

12:03:49 op change ifl pp0.0 idx 71 devindex 128 flags c010
12:03:49 op change ifl pp0.0 idx 71 devindex 128
12:03:49 IFL State TLV:          
12:03:49  State - Opened         
12:03:49  Auth Chap flags - 00   
12:03:49  Auth Pap flags - 0b    
12:03:49  Options:               
12:03:49   MRU: 1492             
12:03:49   Auth proto: PAP       
12:03:49   Magic Num: 1430297898 
12:03:49 IFL Config TLV:         
12:03:49  Media flags - 0000     
12:03:49  Auth protocol PAP - 0xc023
12:03:49  PPP flags - 00         
12:03:49  MRU - 1492             
12:03:49 pppd_iflm_handle_change: ifl->ifl_flags 0xc010 iflm->iflm_flags 0xc010
12:03:49 pp0.0: Session LCP max configuration request count 254 is set(254 default count)
12:03:49 pp0.0: pppd_ncp_close_proto
12:03:49 pp0.0: IPCP - State changed to: Closed
12:03:49 pp0.0: IFF af inet - Building TLV (changed 0xb)
12:03:49 pp0.0: IFF af inet - Building flags (0x80000000), cflags (0x1000804)
12:03:49 pp0.0: IFF af inet - Building NCP, proto 0x8021, len 16
12:03:49 pp0.0: IFF af inet - Building IFA delete
12:03:49 Upd iff pp0.0 af inet iflidx 71 devidx 128: done
12:03:49 pp0.0: pppd_ncp_close_proto
12:03:49 pp0.0: IPV6CP - Stopping protocol timer [local]
12:03:49 pp0.0: IPV6CP - State changed to: Closed
12:03:49 pp0.0: IFF af inet6 - Building TLV (changed 0x3)
12:03:49 pp0.0: IFF af inet6 - Building flags (0x0), cflags (0x804)
12:03:49 pp0.0: IFF af inet6 - Building NCP, proto 0x8057, len 16
12:03:49 Upd iff pp0.0 af inet6 iflidx 71 devidx 128: done
12:03:49 pp0.0: PAP - Stopping pap_proto timer
12:03:49 pp0.0: PAP - Stopping answer wait timer
12:03:49 pp0.0: IFL - Building TLV (changed 0x5)
12:03:49 pp0.0: IFL - Building flags (0xc011), cflags (0x1)
12:03:49 pp0.0: IFL - Building AUTH, len 3
12:03:49 Upd ifl pp0.0 iflidx 71 devidx 128: done
12:03:49 pp0.0: LCP - State changed to: Closed
12:03:49 pp0.0: IFL - Building TLV (changed 0x3)
12:03:49 pp0.0: IFL - Building flags (0xc011), cflags (0x1)
12:03:49 pp0.0: IFL - Building LCP, len 16
12:03:49 Upd ifl pp0.0 iflidx 71 devidx 128: done
12:03:49 pp0.0: Session phase changed Network -> Disabled
12:03:49 op delete ifa .0 af inet iflidx 71 devindex 128
12:03:49 Deleting ifa pp0.0 iflidx 71 af inet
12:03:49 op change ifl pp0.0 idx 71 devindex 128 flags c011
12:03:49 op change ifl pp0.0 idx 71 devindex 128
12:03:49 IFL State TLV:          
12:03:49  State - Closed         
12:03:49  Auth Chap flags - 00   
12:03:49  Auth Pap flags - 0a    
12:03:49  Options:               
12:03:49   MRU: 1492             
12:03:49   Magic Num: 2860994156 
12:03:49 IFL Config TLV:         
12:03:49  Media flags - 0000     
12:03:49  Auth protocol PAP - 0xc023
12:03:49  PPP flags - 00         
12:03:49  MRU - 1492             
12:03:49 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011
12:03:49 pp0.0: Session LCP max configuration request count 254 is set(254 default count)
12:03:49 op change iff pp0.0 af inet iflidx 71 devindex 128
12:03:49 IFF State TLV:          
12:03:49  State - Closed         
12:03:49  Options:               
12:03:49   Address: local 213.206.222.121, remote 213.207.113.2
12:03:49 op change iff pp0.0 af inet6 iflidx 71 devindex 128
12:03:49 IFF State TLV:          
12:03:49  State - Closed         
12:03:49  Options:               
12:03:49   Local interface ID: 56e0:320f:fcea:9480, remote interface ID: 0200:000f:fc00:0000
12:10:56 op change ifd ge-0/0/0 devidx 134 flags c001
12:10:56 op change ifd ge-0/0/0 devidx 134 (skipped)
12:11:00 op change ifd ge-0/0/0 devidx 134 flags c000
12:11:00 op change ifd ge-0/0/0 devidx 134 (skipped)
12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011
12:11:00 op change ifl pp0.0 idx 71 devindex 128
12:11:00 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011
12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011
12:11:00 op change ifl pp0.0 idx 71 devindex 128
12:11:00 IFL State TLV:          
12:11:00  State - Closed         
12:11:00  Auth Chap flags - 00   
12:11:00  Auth Pap flags - 0a    
12:11:00  Options:               
12:11:00   MRU: 1492             
12:11:00   Magic Num: 2860994156 
12:11:00 IFL Config TLV:         
12:11:00  Media flags - 0000     
12:11:00  Auth protocol PAP - 0xc023
12:11:00  PPP flags - 01         
12:11:00  MRU - 1492             
12:11:00 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011
12:11:00 pp0.0: Session LCP max configuration request count 254 is set(254 default count)
12:11:00 pp0.0: LCP - Starting protocol timer (3 sec, 0 nsec)
12:11:00 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x21 0xc0 0x13 0x01
12:11:00 pp0.0: LCP - State changed to: Creq-sent
12:11:00 pp0.0: Session phase changed Disabled -> Establish
12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x21 0x01
12:11:00 pp0.0: Sent 22 byte (14 data bytes) PPP packet: 0x21 0xc0 0x1c 0x02
12:11:00 pp0.0: LCP - State changed to: Ack-sent
12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x21 0x02
12:11:00 pp0.0: LCP - Stopping protocol timer
12:11:00 pp0.0: LCP - State changed to: Opened
12:11:00 pp0.0: IFL - Building TLV (changed 0xa)
12:11:00 pp0.0: IFL - Building magic 1430297898, len 8
12:11:00 pp0.0: IFL - Building LCP, len 16
12:11:00 Upd ifl pp0.0 iflidx 71 devidx 128: done
12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011
12:11:00 op change ifl pp0.0 idx 71 devindex 128
12:11:00 IFL State TLV:          
12:11:00  State - Opened         
12:11:00  Auth Chap flags - 00   
12:11:00  Auth Pap flags - 0b    
12:11:00  Options:               
12:11:00   MRU: 1492             
12:11:00   Auth proto: PAP       
12:11:00   Magic Num: 1430297898 
12:11:00 IFL Config TLV:         
12:11:00  Media flags - 0000     
12:11:00  Auth protocol PAP - 0xc023
12:11:00  PPP flags - 01         
12:11:00  MRU - 1492             
12:11:00 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011
12:11:00 pp0.0: Session LCP max configuration request count 254 is set(254 default count)
12:11:00 pp0.0: Sent 32 byte (24 data bytes) PPP packet: 0x23 0xc0 0x14 0x01
12:11:00 pp0.0: PAP - Stopping pap_proto timer
12:11:00 pp0.0: PAP - Starting pap_proto timer 2 sec, 0 nsec
12:11:00 pp0.0: Session phase changed Establish -> Authenticate
12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x23 0x02
12:11:00 pp0.0: PAP - PAP Authentication is succesful , ACK received interface pp0.0
12:11:00 pp0.0: PAP - Stopping pap_proto timer
12:11:00 pp0.0: PAP - Stopping answer wait timer
12:11:00 pp0.0: IFL - Building TLV (changed 0x5)
12:11:00 pp0.0: IFL - Building flags (0xc010), cflags (0x1)
12:11:00 pp0.0: IFL - Building AUTH, len 3
12:11:00 Upd ifl pp0.0 iflidx 71 devidx 128: done
12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:01 op change ifl pp0.0 idx 71 devindex 128 flags c010
12:11:01 op change ifl pp0.0 idx 71 devindex 128
12:11:01 IFL State TLV:          
12:11:01  State - Opened         
12:11:01  Auth Chap flags - 00   
12:11:01  Auth Pap flags - 0b    
12:11:01  Options:               
12:11:01   MRU: 1492             
12:11:01   Auth proto: PAP       
12:11:01   Magic Num: 1430297898 
12:11:01 IFL Config TLV:         
12:11:01  Media flags - 0000     
12:11:01  Auth protocol PAP - 0xc023
12:11:01  PPP flags - 01         
12:11:01  MRU - 1492             
12:11:01 pppd_iflm_handle_change: ifl->ifl_flags 0xc010 iflm->iflm_flags 0xc010
12:11:01 pp0.0: Session LCP max configuration request count 254 is set(254 default count)
12:11:01 pp0.0: IPCP - ADDRESS using local address: 0.0.0.0
12:11:01 pp0.0: IPCP - Config-Request, Built 6 bytes of PRIMARY DNS at 0x3ffed87e
12:11:01 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)
12:11:01 pp0.0: Sent 26 byte (18 data bytes) PPP packet: 0x21 0x80 0x15 0x01
12:11:01 pp0.0: IPCP - State changed to: Creq-sent
12:11:01 pp0.0: IPV6CP - Using interface ID: 56e0:320f:fcea:9480
12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local]
12:11:01 pp0.0: IPV6CP - Starting protocol timer (3 sec, 0 nsec) [local]
12:11:01 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x57 0x80 0x16 0x01
12:11:01 pp0.0: IPV6CP - State changed to: Creq-sent
12:11:01 pp0.0: Session phase changed Authenticate -> Network
12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x04
12:11:01 pp0.0: pppd_ncp_process_nak_rej
12:11:01 pp0.0: IPCP - Stopping protocol timer
12:11:01 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)
12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x57 0x02
12:11:01 pp0.0: pppd_ncp_process_conf_ack
12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local]
12:11:01 pp0.0: IPV6CP - Current state Creq-sent
12:11:01 pp0.0: IPV6CP - State changed to: Ack-rcvd
12:11:01 pp0.0: IPV6CP - Starting protocol timer (3 sec, 0 nsec) [local]
12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x01
12:11:01 pp0.0: pppd_ncp_process_conf_req
12:11:01 pp0.0: IPCP - Remote peer requesting address 213.207.113.2
12:11:01 pp0.0: IPCP - Need to negotiate address
12:11:01 pp0.0: IPCP - Current state Creq-sent
12:11:01 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x40 0x02
12:11:01 pp0.0: IPCP - State changed to: Ack-sent
12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x57 0x01
12:11:01 pp0.0: pppd_ncp_process_conf_req
12:11:01 pp0.0: IPV6CP - Current state Ack-rcvd
12:11:01 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x57 0x80 0xe0 0x02
12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local]
12:11:01 pp0.0: IPV6CP - State changed to: Opened
12:11:01 pp0.0: IFF af inet6 - Building TLV (changed 0x3)
12:11:01 pp0.0: IFF af inet6 - Building flags (0x0), cflags (0x800)
12:11:01 pp0.0: IFF af inet6 - Building NCP, proto 0x8057, len 16
12:11:01 Upd iff pp0.0 af inet6 iflidx 71 devidx 128: done
12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:01 op change iff pp0.0 af inet6 iflidx 71 devindex 128
12:11:01 IFF State TLV:          
12:11:01  State - Opened         
12:11:01  Options:               
12:11:01   Local interface ID: 56e0:320f:fcea:9480, remote interface ID: 0200:000f:fc00:0000
12:11:03 pp0.0: IPCP - Timer expired
12:11:03 pp0.0: IPCP - Proto timeout
12:11:03 pp0.0: IPCP - ADDRESS using local address: 0.0.0.0
12:11:03 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)
12:11:03 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x17 0x01
12:11:03 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x03
12:11:03 pp0.0: pppd_ncp_process_nak_rej
12:11:03 pp0.0: IPCP - Handling Conf-Nak
12:11:03 pp0.0: IPCP - Negotiated address
12:11:03 pp0.0: IPCP - Stopping protocol timer
12:11:03 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)
12:11:03 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:04 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x01
12:11:04 pp0.0: pppd_ncp_process_conf_req
12:11:04 pp0.0: IPCP - Remote peer requesting address 213.207.113.2
12:11:04 pp0.0: IPCP - Need to negotiate address
12:11:04 pp0.0: IPCP - Current state Ack-sent
12:11:04 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x41 0x02
12:11:04 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:06 pp0.0: IPCP - Timer expired
12:11:06 pp0.0: IPCP - Proto timeout
12:11:06 pp0.0: IPCP - ADDRESS using local address: 213.206.222.121
12:11:06 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)
12:11:06 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x18 0x01
12:11:06 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x02
12:11:06 pp0.0: pppd_ncp_process_conf_ack
12:11:06 pp0.0: IPCP - Stopping protocol timer
12:11:06 pp0.0: IPCP - Current state Ack-sent
12:11:06 pp0.0: IPCP - State changed to: Opened
12:11:06 pp0.0: IFF af inet - Building TLV (changed 0x7)
12:11:06 pp0.0: IFF af inet - Building flags (0x80000000), cflags (0x1000800)
12:11:06 pp0.0: IFF af inet - Building NCP, proto 0x8021, len 16
12:11:06 pp0.0: IFF af inet - Building IFA add
12:11:06 Upd iff pp0.0 af inet iflidx 71 devidx 128: done
12:11:06 pppd_msg_input: recvmsg: Resource temporarily unavailable
12:11:06 op change iff pp0.0 af inet iflidx 71 devindex 128
12:11:06 IFF State TLV:          
12:11:06  State - Opened         
12:11:06  Options:               
12:11:06   Address: local 213.206.222.121, remote 213.207.113.2
12:11:06 op add ifa pp0.0 af inet iflidx 71 devindex 128
12:11:06 pp0: Local IP address set to 213.206.222.121/32
12:11:06 pp0: Remote IP address set to 213.207.113.2/32
12:11:06 Added ifa pp0.0 iflidx 71 af inet (primary address)
  • Do you notice this at a certain number of users being connected at the same time/how many users do you support on the SRX? Does this happen during non-business hours? Are you running the same version of JunOS now, that you were on the SRX100? Is there anything even semi-interesting in the logs? And just as a shot in the dark to start, can you post the output of "show system license", please? – Jordan Head Apr 21 '15 at 13:47
  • I've updated my question. Is there any specific log I should look at? – Luc van Donkersgoed Apr 21 '15 at 14:02
  • Thanks for the information. Just to clarify, your users sit behind the SRX, connect through it toward the VPN server? When you can, could you check the following while its working, and while its NOT working? "show ethernet-switching table interface ge-x/x/x" where ge-x/x/x is the interface facing the VPN server. Make sure you're seeing what MAC address(es) you expect. Also, please try the same with a client/user interface. – Jordan Head Apr 21 '15 at 14:22
  • When all of the traffic stops working does this mean the SRX also can't connect to anything? was your ping to 8.8.8.8 done from the SRX? Does your PPPoE connection drop at all? Does it have any errors on the interface show int pp0.0 detail and look under the heading Flow error statistics (Packets dropped due to) You should check the messages log for any obvious errors if you haven't show log messages. I would also look at the output of show security screen statistics zone untrust. – Gareth Hastings Apr 21 '15 at 19:53
  • Failing that you could run a debug by setting up some security flow filters kb.juniper.net/InfoCenter/… or run a packet capture of traffic on the pp0.0 interface – Gareth Hastings Apr 21 '15 at 19:54
3

With help from our service provider we've been able to localise the problem. The idea I had in my last comment proved correct: the difference between fast ethernet and gigabit ethernet was the source of the problem.

The reason for dropping connections, undeliverable packets and segmented packets was a mismatch in link mode between the fiber switch and the SRX - they hardcoded their port to 100m full duplex, but the SRX had automatic negotiation, which resolved to 100m half duplex.

The problem was further complicated by Juniper's odd configuration of speed and link mode. Just setting these configuration options wasn't enough:

speed 100m;
link-mode full-duplex;

This configuration was accepted, but when running show interfaces ge-0/0/0, it still showed:

Link-level type: Ethernet, MTU: 1514, Link-mode: Half-duplex, Speed: 100mbps,

Apparently, you have to explicitly disable auto-negotiation:

speed 100m;
link-mode full-duplex;
gigether-options {
    no-auto-negotiation;
}

In the end, I found that this guy had the exact same problem (and the solution!)

Thanks for all your help.

  • Thank you for posting your answer. Personally, instead of disabling autoconfiguration and manually configuring the speed/duplex settings on my side, I would push the service provider to enable autoconfiguration on their side. – YLearn May 27 '15 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.