07-24-2012 07:48 PM
We have an SRX240 cluster happily routing traffic and terminating a route-based VPN between itself and an SSG 140 cluster without issue. Inter-zone traffic is passed without an issue, as is traffic that enters and exits the SRX<->SSG tunnel.
At our office, we have a Cyberoam ia50 that we have various policy-based VPNs terminated on. We've had no issues for VPNs between the SSG 140 cluster and this Cyberoam device in the past but the same cannot be said for the Cyberoam<->SRX tunnel that has been set up.
The tunnel itself comes up without issue and small packet traffic flows without an issue as does ICMP traffic between 64 and 1500 bytes in size. When attempting to push larger packets of TCP traffic though, traffic flow for the particular TCP session ceases to flow.
This behaviour manifests in both directions, and setting flow trace options for dropped packets reveals no drops whatsoever. MTUs on both sides of the link have been checked and confirmed to be properly configured and this issue only occurs for this combination of devices.
Any assistance in terms of debug or experience greatly appreciated.
07-24-2012 07:57 PM
Have you configured tcp-mss for IPsec traffic to eliminate the possibility of fragmented TCP traffic ?
set security flow tcp-mss ipsec-vpn mss 1350
(you can use this value as starting point and try further reducing if it does not help)
07-24-2012 08:12 PM
This is in place and there is zero change in behaviour. No change is observed between this directive being in place and not being in place.
Further, the fact that this does not occur for the SSG<->Cyberoam tunnel or the SRX<->SSG tunnel indicates that there is a quirk on the SRX causing this issue.
07-25-2012 05:26 PM
Further strangeness has been observed here:
When attempting to download a file or web page from the SRX network using a host in the Cyberoam network, the following is observed:
None of this behaviour is observed in either our SSG<->SRX tunnel or our SSG<->Cyberoam tunnel and none of those tunnels were configured with anything other than default phase 1 and phase 2 settings.