Knowledge Search


[J/SRX] Route-based VPN is up, but not passing traffic. Is a route missing?

  [KB10107] Show Article Properties


A route-based, site-to-site VPN is up on an SRX or J-Series device, but it is not passing traffic.  A route is needed to reach a remote network through the VPN via a secure tunnel (st0) interface. 

Note:  To confirm whether your VPN is up, consult: KB10090 - How do I tell if a VPN tunnel SA (Security Association) is active on an SRX or J-Series device?.


The routing table does not have a route to the remote network via the st0 interface.

The show route <remote network> output contains a route for the remote network via the correct st0 interface:

root@CorporateOffice > show route
inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both *[Static/5] 00:00:53
> via
st0.0   <-------------------------------------------

Note: If running dynamic routing protocols, like BGP or OSPF, then investigate why those routing protocols are not the learning the route.



The example below shows how to add a route to the destination network via the secure tunnel (st0) interface.  

Network topology:

Remote office internal network address:
Corporate office internal network address:

At the corporate office, a route to the remote network needs to be added via the st0 interface.

Step one Locate the correct st0 interface for the VPN:

root@CorporateOffice# show security ipsec vpn ike-vpn-remote-office
      vpn ike-vpn-remote-office {
          bind-interface st0.0;  <----------------
          ike {
              gateway gw-remote-office;
              ipsec-policy ipsec-phase2-policy;
On the corporate office SRX, navigate to Configure > IPsec VPN > Auto Tunnel > Phase II.  Then locate the associated st0 tunnel in the Bind Interface column.

Step two Add the static route with the next-hop as the st0 interface (st0.0 for this example) to route the packets destined for network via the VPN:

root@CorporateOffice# set routing-options static route next-hop st0.0


  1. On Corporate office SRX, navigate to Configure > Routing > Static Routing
  2. If no route is shown with next-hop as the st0 interface, then click Add...
  3. Enter the information below:
      Static Route Address:
      Below Next-Hop Addresses and next to the Add button, enter: st0.0
      Then click the Add button to populate the Next-Hop Addresses field.
  4. Click OK.

Related Links: