IPSec tunnel to Amazon cloud doesn't work.
My local subnet is 192.168.42.0/24. I'm trying to access Amazon cloud private subnet 172.0.3.0/24.
My firewall model is Juniper SRX550. Tunnel is up (I can see IPSEC and IKE security associations. And I can ping remote IP address of the tunnel interface on the Amazon end of the tunnel. But packet from my internal subnet is not entering tunnel correctly. When I ping from host 192.168.42.131 address 172.0.3.12 I can see this session:
Session ID: 278828, Policy name: trust-to-trust/17, State: Active, Timeout: 6, Valid
In: 192.168.42.131/2135 --> 172.0.3.12/1;icmp, If: reth1.480, Pkts: 63, Bytes: 3780
Out: 172.0.3.12/1 --> 192.168.42.131/2135;icmp, If: st0.9, Pkts: 0, Bytes: 0
I.e. size of the packet on internal interface is not zero, but when it enters tunnel it's zero.
When I enabled debug this is what I see:
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:<192.168.42.131/1580->172.0.3.12/1;1> matched filter filter1:
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:packet [60] ipid = 21642, @0x43cda0d2
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:---- flow_process_pkt: (thd 5): flow_ctxt type 1, common flag 0x0, mbuf 0x43cd9e80, rtbl_idx = 0
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: in_ifp <trust:st0.9>
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:flow_process_pkt_exception: setting rtt in lpak to 0x5391d5b0
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:pkt out of tunnel.Proceed normally
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: st0.9:192.168.42.131->172.0.3.12, icmp, (8/0)
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: find flow: table 0x51acfe50, hash 8971(0xffff), sa 192.168.42.131, da 172.0.3.12, sp 1580, dp 1, proto 1, tok 8
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: flow got session.
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: flow session id 247797
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: vector bits 0x10224 vector 0x4ad53040
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: vsd 1 is active
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:ttl vector, out_tunnel = 0x59c7cc90
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:pre-frag not needed: ipsize: 60, mtu: 1436, nsp2->pmtu: 1436
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: encap vector
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: going into tunnel 131082 (nsp_tunnel=0x59c7cc90).
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: flow_encrypt: tun 0x59c7cc90, type 1
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:mbuf 0x43cd9e80, exit nh 0x1d0010
Oct 27 01:03:40 01:03:40.108989:CID-1:RT:flow_process_pkt_exception: Freeing lpak 0x5128ee38 associated with mbuf 0x43cd9e80
Oct 27 01:03:40 01:03:40.108989:CID-1:RT: ----- flow_process_pkt rc 0x0 (fp rc 0)
Seems normal to me.
Does anybody know how to solve it?
Thanks.
