How to Troubleshoot IPSEC VPN (Phase 1) on a Juniper Networks SRX Firewall.

In this video I ll explain how to troubleshoot phase 1 IPSEC VPN problems on Juniper Networks SRX Firewall. The example will focus on a scenario where a proposal mismatch cause a VPN to be down. The following commands have been used in the video: -------------------------------------- show security ike set security ike traceoptions file debug-ike.log set security ike traceoptions flag ike show security ike security-associations monitor start debug-ike.log monitor traffic interface ge-x/x/x match "port 500" extensive #set security ike proposal PROP_CUSTOM authentication-method pre-shared-keys #set security ike proposal PROP_CUSTOM dh-group group24 #set security ike proposal PROP_CUSTOM authentication-algorithm sha-384 #set security ike proposal PROP_CUSTOM encryption-algorithm aes-256-cbc #set security ike proposal PROP_CUSTOM lifetime-seconds 50000 --------------------------------------