ISR 4331 IPSec VPN issue

[Rps-Cheers]

Hi  everyone;

very urgent
I have a problem. ISR4331 and Juniper SRX establish IPSec VPN.
This IPSEC VPN can be established, but ISR4331 sees a lot of QM_IDLE, as follows:

 rz1#show cryp isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
221.239.208.237 101.95.106.10   QM_IDLE           1516 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1515 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1514 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1513 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1512 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1511 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1510 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1509 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1508 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1507 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1506 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1505 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1504 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1503 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1502 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1501 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1500 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1499 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1498 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1497 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1496 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1495 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1494 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1493 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1492 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1491 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1490 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1489 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1488 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1487 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1486 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1485 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1484 ACTIVE
221.239.208.237 101.95.106.10   QM_IDLE           1483 ACTIVE

I don't know what this means，please help me to explain it,thanks very much.

Attached is config files and some log.

[Rob Ingram]

Hi, The logs indicate IKE Phase 1 completed ok.

I notice that the IPSec Transform set is different on the Cisco Router and the Juniper Firewall, you should ensure the hashing algorithm is the same, change the value on one of the devices then try again.  

Cisco Router

crypto ipsec transform-set yfnsshjq esp-3des esp-sha256-hmac
 mode transport

Juniper

 proposal Jiqiang_proposal {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 3600;

HTH

[Rps-Cheers]

thanks for your response，

Sorry，the config file have changed，i have issue the same policy on ISR and juniper.now the ipsec vpn can establish，but there are so many QM_IDLE，what's reason about it？

[Rob Ingram]

Ok. How long has the tunnel been up? I assume a couple of weeks? It could be the router has negotiated a new SA every 28800 seconds as configured, but the old SA is not cleared down. This could be a bug, as I've not seen it before (though I've not established a VPN to a Juniper firewall before).

What IOS are you running on the Cisco router?

Can you provide the output of "show crypto isakmp sa detail" please? Ensure you append the "detail" command at the end.

[Rps-Cheers]

ISR run IOS 16.6.2，

I also guess it's a bug，but
i did not find it.
i will try to issue the show cry isakmp sa detail，Is it will display the SA established time？

[Rob Ingram]

It should show the lifetime (counting down to 0) for the active tunnel. Can you also provide the output of "show crypto session detail", this should display the connid and lifetime etc.

It might be worthwhile investigating DPD which should clear down stale IKE SAs.

[Rps-Cheers]

I will do it tomorrow.Is there any other possible reason?