「Netscreen」 VPN UP/DOWN due to loopback address source monitoring

Question

I am dealing with a problem with Netscreen VPN.

Topology is basically

Server Side ーー＞ (Agg2)Trust/Untrust(Agg1)ーー＞ ーー＞ Remote Office (Yamaha)

100.66.xx.0/24 ーー＞ Netscreen VPN ーー＞ Internet ーー＞ 100.71.YY.0/24

Proxy id is the same with source and destination range.

Tunnel is in Untrust zone and unnumbered to aggregate1.

VPN is connected successfully and I can ping from our server side L3 switches to other side servers (I cannot try data transmission, because servers are not built yet.). But because of the monitoring VPN is giving UP/DOWN alert in every 100 seconds. so I tried to create a loopback with 100.66.xx.253/32 and tried to use it as source for monitoring.

set vpn monitor source-interface loopback.1 destination-ip 100.71.YY.253 optimized rekey

But it is failing. I tried to ping from loopback.1 to other side of the VPN, but I couldn't. There is no routing missmatch. Tunnel and loopback are in both Untrust zone. loopback address is in the same range with proxy-id. Policy is already allowing Proxy-id source range to proxy-id destination range. I couldn't understand the problem at all.

What do we need to do to ping from loopback to VPN destination through tunnel?

Answer 1

# Step 1: Verify Loopback Interface Configuration
set interface loopback unit 1 family inet address 100.66.xx.253/32

# Step 2: Check VPN Proxy-ID Configuration
# Make sure that you have the correct VPN proxy-ID configured on both devices.

# Step 3: Review Security Policies
# Assuming you are using ICMP (ping) to test, ensure that you have a security policy allowing traffic between Untrust and VPN zones.
set policy from-zone Untrust to-zone VPN policy allow-ping match source-address any destination-address any application junos-ping then permit

# Step 4: Validate Routing
# Confirm that you have the correct route pointing towards the VPN tunnel interface.
# Example: Assuming you have a VPN tunnel interface named "st0", and the remote gateway is 100.71.YY.1:
set routing-options static route 100.71.YY.0/24 next-hop st0

# Step 5: Check for NAT and Security Settings
# Verify that there are no conflicting NAT or security settings that might prevent traffic from the loopback interface to the VPN destination.
# If you have NAT policies configured, make sure they are not interfering with the VPN traffic.

# Step 6: Monitor VPN Traffic
# You can use the following command to check if there are any dropped packets related to the VPN tunnel:
get counter flow interface st0
get counter interface st0

After implementing these changes, monitor the VPN tunnel and loopback interface to see if the alerts have stopped and the loopback interface is now successfully pinging the VPN destination through the tunnel.