Posted by Probably not an overly common setup but you’ll inevitably become frustrated if you try it. As per this Juniper PR, it’s necessary to put your loopback interface and your external interface(s) in the same security zone. You still need that if you are sourcing from a loopback interface in a routing-instance however it doesn’t quite resolve the issue.
If you enable enough logging, you’ll see that the phase 1 (UDP) works fine but the phase 2 (ESP) gets blocked. If you look at flow logs, the following is the important bit:
CID-1:THREAD_ID-05:RT: packet dropped, denied by policy
This says that it’s looking for a policy that permits ESP within the “edge” zone. In my case, “edge” is the name of the security zone that contains the external interfaces and the loopback interface.
The solution is to add a security policy from-zone edge to-zone edge which allows ESP. It looks like this:
policy a_esp {
match {
source-address any;
destination-address any;
application esp;
}
then {
permit;
}
}
{primary:node0}[edit]
phil@be-fw-03# show applications application esp
term t1 protocol esp;
I couldn’t see a JunOS inbuilt policy for esp so I created the applicationesp as shown above.
If you’re using NAT Traversal with your VPN, it’s possible you’ll need to allow more stuff in your application. That might look like this:
term t2 protocol udp source-port 4500 destination-port 4500;
term t3 protocol esp;