All,
We have an IPSec hub and spoke design. I have a 750GL (spoke) that is connected via IPsec back to a Juniper (Hub). I initiate the connection from the 750 and it creates a tunnel (2 SA’s) and then I can ping to a device sitting behind the Juniper. If I try and ping back from the device behind the Juniper to a loopback address applied to the 750, it creates another set of SA’s (now I have 4 SA’s). This should not happen. The spokes should be the initiator and ONLY the initiator because all spoke locations (750’s) are either static, dhcp or pppoe. My question is since the SA is already created by the spoke as the initiator (I have 2 SA’s per connection to be exact) should the traffic from behind the Juniper already utilize the tunnel that was created by the spoke? Why does another tunnel (2 SA’s) get created? If I clear the connection on the Juniper and start a ping from the device sitting behind it to the spoke, it creates a tunnel and then I start a ping from the spoke top the device behind the Juniper, it utilized the existing tunnel and passes traffic. A second set of SA’s does not get created.