Tags

, , , , ,

With route-based VPNs, a policy does not specifically reference a VPN tunnel. Instead, the policy references a destination address. When the security device does a route lookup to find the interface through which it must send traffic to reach that address, it finds a route via a secure tunnel (ST) interface, which is bound to a specific VPN tunnel.

The following are reasons why you implement route-based VPN:

  • Source or destination NAT (NAT-src or NAT-dst) needs to occur as traffic travels through the VPN.
  • There are overlapping subnets or IP addresses between the two LANs.
  • Hub-and-spoke VPN topology is used in the network.
  • Primary and backup VPN are required.
  • A dynamic routing protocol (for example, OSPF, RIP, or BGP) is running across the VPN.
  • Multiple subnets or networks at the remote site across the VPN need to be accessed.

R-VPN-Secureleaves

Procedure

  1. Configure Ethernet interface information.
    [edit]
    user@host# set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.1/24
    user@host# set interfaces ge-0/0/3 unit 0 family inet address 1.1.1.2/30
    user@host# set interfaces st0 unit 0 family inet address 10.11.11.10/24
  2. Configure static route information.
    [edit]
    user@host# set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1
    user@host# set routing-options static route 192.168.168.0/24 next-hop st0.0
  3. Configure the untrust security zone.
    [edit ]user@host# edit security zones security-zone untrust
  4. Assign an interface to the security zone.
    [edit security zones security-zone untrust]
    user@host# set interfaces ge-0/0/3.0
  5. Specify allowed system services for the security zone.
    [edit security zones security-zone untrust]
    user@host# set host-inbound-traffic system-services ike
  6. Configure the trust security zone.
    [edit]
    user@host# edit security zones security-zone trust
  7. Assign an interface to the trust security zone.
    [edit security zones security-zone trust]
    user@host# set interfaces ge-0/0/0.0
  8. Specify allowed system services for the trust security zone.
    [edit security zones security-zone trust]
    user@host# set host-inbound-traffic system-services all
  9. Configure an address book and attach a zone to it.
    [edit security address-book book1]
    user@host# set address sunnyvale 10.10.10.0/24
    user@host# set attach zone trust
  10. Configure the vpn-chicago security zone.
    [edit]user@host# edit security zones security-zone vpn-chicago
  11. Assign an interface to the security zone.
    [edit security zones security-zone vpn-chicago]
    user@host# set interfaces st0.0
  12. Configure another address book and attach a zone to it.
    [edit security address-book book2]
    user@host# set address chicago 192.168.168.0/24
    user@host# set attach zone vpn-chicago

    To configure IKE:

    1. Create the IKE Phase 1 proposal.
      [edit security ike]
      user@host# set proposal ike-phase1-proposal
    2. Define the IKE proposal authentication method.
      [edit security ike proposal ike-phase1-proposal]
      user@host# set authentication-method pre-shared-keys
    3. Define the IKE proposal Diffie-Hellman group.
      [edit security ike proposal ike-phase1-proposal]
      user@host# set dh-group group2
    4. Define the IKE proposal authentication algorithm.
      [edit security ike proposal ike-phase1-proposal]
      user@host# set authentication-algorithm sha1
    5. Define the IKE proposal encryption algorithm.
      [edit security ike proposal ike-phase1-proposal]
      user@host# set encryption-algorithm aes-128-cbc
    6. Create an IKE Phase 1 policy.
      [edit security ike]user@host# set policy ike-phase1-policy
    7. Set the IKE Phase 1 policy mode.
      [edit security ike policy ike-phase1-policy]
      user@host# set mode main
    8. Specify a reference to the IKE proposal.
      [edit security ike policy ike-phase1-policy]
      user@host# set proposals ike-phase1-proposal
    9. Define the IKE Phase 1 policy authentication method.
      [edit security ike policy ike-phase1-policy]
      user@host# set pre-shared-key ascii-text 395psksecr3t
    10. Create an IKE Phase 1 gateway and define its external interface.
      [edit security ike]
      user@host# set gateway gw-chicago external-interface ge-0/0/3.0
    11. Define the IKE Phase 1 policy reference.
      [edit security ike gateway gw-chicago]
      user@host# set ike-policy ike-phase1-policy
    12. Define the IKE Phase 1 gateway address.
      [edit security ike gateway gw-chicago]
      user@host# set address 2.2.2.2

    If you are done configuring the device, enter commit from configuration mode.

    Configuring IPsec

    To configure IPsec:

    1. Create an IPsec Phase 2 proposal.
      [edit]
      user@host# set security ipsec proposal ipsec-phase2-proposal
    2. Specify the IPsec Phase 2 proposal protocol.
      [edit security ipsec proposal ipsec-phase2-proposal]
      user@host# set protocol esp
    3. Specify the IPsec Phase 2 proposal authentication algorithm.
      [edit security ipsec proposal ipsec-phase2-proposal]
      user@host# set authentication-algorithm hmac-sha1-96
    4. Specify the IPsec Phase 2 proposal encryption algorithm.
      [edit security ipsec proposal ipsec-phase2-proposal]
      user@host# set encryption-algorithm aes-128-cbc
    5. Create the IPsec Phase 2 policy.
      [edit security ipsec]
      user@host# set policy ipsec-phase2-policy
    6. Specify the IPsec Phase 2 proposal reference.
      [edit security ipsec policy ipsec-phase2-policy]
      user@host# set proposals ipsec-phase2-proposal
    7. Specify IPsec Phase 2 PFS to use Diffie-Hellman group 2.
      [edit security ipsec policy ipsec-phase2-policy]
      user@host# set perfect-forward-secrecy keys group2
    8. Specify the IKE gateway.
      [edit security ipsec]
      user@host# set vpn ike-vpn-chicago ike gateway gw-chicago
    9. Specify the IPsec Phase 2 policy.
      [edit security ipsec]
      user@host# set vpn ike-vpn-chicago ike ipsec-policy ipsec-phase2-policy
    10. Specify the interface to bind.
      [edit security ipsec]
      user@host# set vpn ike-vpn-chicago bind-interface st0.0

    Configuring Security Policies

    To configure security policies:

    1. Create the security policy to permit traffic from the trust zone to the vpn-chicago zone.
      [edit security policies from-zone trust to-zone vpn-chicago]
      user@host# set policy vpn-tr-chi match source-address sunnyvale
      user@host# set policy vpn-tr-chi match destination-address chicago
      user@host# set policy vpn-tr-chi match application any
      user@host# set policy vpn-tr-chi then permit
    2. Create the security policy to permit traffic from the vpn-chicago zone to the trust zone.
      [edit security policies from-zone vpn-chicago to-zone trust]
      user@host# set policy vpn-chi-tr match source-address sunnyvale
      user@host# set policy vpn-chi-tr match destination-address chicago
      user@host# set policy vpn-chi-tr match application any
      user@host# set policy vpn-chi-tr then permit

    Configuring TCP-MSS

    1. Configure TCP-MSS information.
      [edit]
      user@host# set security flow tcp-mss ipsec-vpn mss 1350

    Verify all the parameters which configured now.

    Before starting the verification process, you need to send traffic from a host in the 10.10.10/24 network to a host in the 192.168.168/24 network. For route-based VPNs, traffic can be initiated by the SRX Series device through the tunnel. I recommend that when testing IPsec tunnels, test traffic be sent from a separate device on one side of the VPN to a second device on the other side of the VPN. For example, initiate a ping from 10.10.10.10 to 192.168.168.10.

     Troubleshooting is best performed on the peer using the responder role.

    Verifying the IKE Phase 1 Status

    From operational mode, enter the show security ike security-associations command. After obtaining an index number from the command, use the show security ike security-associations index index_number detail command.

    user@host> show security ike security-associations
    Index   Remote Address  State  Initiator cookie  Responder cookie  Mode
    1       2.2.2.2         UP     744a594d957dd513  1e1307db82f58387  Main
    user@host> show security ike security-associations index 1 detail
    IKE peer 2.2.2.2, Index 1,
      Role: Responder, State: UP
      Initiator cookie: 744a594d957dd513, Responder cookie: 1e1307db82f58387
      Exchange type: Main, Authentication method: Pre-shared-keys
      Local: 1.1.1.2:500, Remote: 2.2.2.2:500
      Lifetime: Expires in 28570 seconds
      Algorithms:
       Authentication        : sha1
       Encryption            : aes-cbc (128 bits)
       Pseudo random function: hmac-sha1
      Traffic statistics:
       Input bytes    :                 852
       Output bytes   :                 940
       Input packets  :                   5
       Output packets :                   5
      Flags: Caller notification sent
      IPSec security associations: 1 created, 0 deleted
      Phase 2 negotiations in progress: 0

    The show security ike security-associations command lists all active IKE Phase 1 SAs. If no SAs are listed, there was a problem with Phase 1 establishment. Check the IKE policy parameters and external interface settings in your configuration.

    If SAs are listed, review the following information:

    • Index—This value is unique for each IKE SA, which you can use in the show security ike security-associations index detail command to get more information about the SA.
    • Remote Address—Verify that the remote IP address is correct.
    • State
      • UP—The Phase 1 SA has been established.
      • DOWN—There was a problem establishing the Phase 1 SA.
    • Mode—Verify that the correct mode is being used.

    Verify that the following are correct in your configuration:

    • External interfaces (the interface must be the one that receives IKE packets)
    • IKE policy parameters
    • Preshared key information
    • Phase 1 proposal parameters (must match on both peers)

    The show security ike security-associations index 1 detail command lists additional information about the security association with an index number of 1:

    • Authentication and encryption algorithms used
    • Phase 1 lifetime
    • Traffic statistics (can be used to verify that traffic is flowing properly in both directions)
    • Role information
    • Initiator and responder information
    • Number of IPsec SAs created
    • Number of Phase 2 negotiations in progress

    Verifying the IPsec Phase 2 Status

    From operational mode, enter the show security ipsec security-associations command. After obtaining an index number from the command, use the show security ipsec security-associations index index_number detail command.

    user@host> show security ipsec security-associations
      total configured sa: 2
      ID    Gateway          Port  Algorithm          SPI      Life:sec/kb  Mon vsys
      <16384 2.2.2.2         500   ESP:aes-128/sha1   76d64d1d 3363/ unlim   -   0
      >16384 2.2.2.2         500   ESP:aes-128/sha1   a1024ee2 3363/ unlim   -   0
    user@host> show security ipsec security-associations index 16384 detail
      Virtual-system: Root
      Local Gateway: 1.1.1.2, Remote Gateway: 2.2.2.2
      Local Identity: ipv4_subnet(any:0,[0..7]=10.10.10.0/24)
      Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.168.0/24)
        DF-bit: clear
    
        Direction: inbound, SPI: 1993755933, AUX-SPI: 0
        Hard lifetime: Expires in 3352 seconds
        Lifesize Remaining: Unlimited
        Soft lifetime: Expires in 2775 seconds
        Mode: tunnel, Type: dynamic, State: installed, VPN Monitoring: -
        Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)    
        Anti-replay service: enabled, Replay window size: 32
    
        Direction: outbound, SPI: 2701283042, AUX-SPI: 0
        Hard lifetime: Expires in 3352 seconds
        Lifesize Remaining: Unlimited
        Soft lifetime: Expires in 2775 seconds
        Mode: tunnel, Type: dynamic, State: installed, VPN Monitoring: -
        Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc
     (128 bits)    
        Anti-replay service: enabled, Replay window size: 32

    The output from the show security ipsec security-associations command lists the following information:

    • The ID number is 16384. Use this value with the show security ipsec security-associations index command to get more information about this particular SA.
    • There is one IPsec SA pair using port 500, which indicates that no NAT-traversal is implemented. (NAT-traversal uses port 4500 or another random high-number port.)
    • The SPIs, lifetime (in seconds), and usage limits (or lifesize in KB) are shown for both directions. The 3363/ unlim value indicates that the Phase 2 lifetime expires in 3363 seconds, and that no lifesize has been specified, which indicates that it is unlimited. Phase 2 lifetime can differ from Phase 1 lifetime, as Phase 2 is not dependent on Phase 1 after the VPN is up.
    • VPN monitoring is not enabled for this SA, as indicated by a hyphen in the Mon column. If VPN monitoring is enabled, U indicates that monitoring is up, and D indicates that monitoring is down.
    • The virtual system (vsys) is the root system, and it always lists 0.

    The output from the show security ipsec security-associations index 16384 detail command lists the following information:

    • The local identity and remote identity make up the proxy ID for the SA.A proxy ID mismatch is one of the most common causes for a Phase 2 failure. If no IPsec SA is listed, confirm that Phase 2 proposals, including the proxy ID settings, are correct for both peers. For route-based VPNs, the default proxy ID is local=0.0.0.0/0, remote=0.0.0.0/0, and service=any. Issues can occur with multiple route-based VPNs from the same peer IP. In this case, a unique proxy ID for each IPsec SA must be specified. For some third-party vendors, the proxy ID must be manually entered to match.
    • Another common reason for Phase 2 failure is not specifying the ST interface binding. If IPsec cannot complete, check the kmd log or set traceoptions.

    Reviewing Statistics and Errors for an IPsec Security Association

    From operational mode, enter the show security ipsec statistics index index_number command, using the index number of the VPN for which you want to see statistics.

    user@host> show security ipsec statistics index 16384
    ESP Statistics:
      Encrypted bytes:              920
      Decrypted bytes:             6208
      Encrypted packets:              5
      Decrypted packets:             87
    AH Statistics:
      Input bytes:                    0
      Output bytes:                   0
      Input packets:                  0
      Output packets:                 0
    Errors:
      AH authentication failures: 0, Replay errors: 0
      ESP authentication failures: 0, ESP decryption failures: 0
      Bad headers: 0, Bad trailers: 0

    You can also use the show security ipsec statistics command to review statistics and errors for all SAs.

    To clear all IPsec statistics, use the clear security ipsec statistics command.

    If you see packet loss issues across a VPN, you can run the show security ipsec statistics or show security ipsec statistics detail command several times to confirm that the encrypted and decrypted packet counters are incrementing. You should also check whether the other error counters are incrementing.

    Testing Traffic Flow Across the VPN

    You can use the ping command from the SRX Series device to test traffic flow to a remote host PC. Make sure that you specify the source interface so that the route lookup is correct and the appropriate security zones are referenced during policy lookup.

    From operational mode, enter the ping command.

    user@host> ping 10.10.10.10 from ethernet0/6
    Type escape sequence to abort
    Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 1 seconds from ethernet0/6
    !!!!!
    Success Rate is 100 percent (5/5), round-trip time min/avg/max=4/4/5 ms

    If the ping command fails from the SRX Series, there might be a problem with the routing, security policies, end host, or encryption and decryption of ESP packets.

    So check all the parameters configured above once again and reconfigure if problem continues.  You can use below tool for generating the configuration for SRX series l2l VPN Configurations.

    http://www.juniper.net/customers/support/configtools/vpnconfig.html

    So Thats it..happy configuration.. 🙂

     

    —————————————————————————————————————————-

    If you feel this article helped you to get some learning, please support by clicking below.

    paypal-button

Advertisements