
Site To Site IPSec VPN in Juniper SSG with one side dynamic IP Part 1
The VPN with one side static and another side dynamic IP is a type of site to site IPSEC VPN. In this Example, I have designed and configured Site to site IPSEC VPN in Juniper SSG series on both sides of locations. It can be implemented in the scenario where one side has static IP address and another side has dynamic IP address by replacing the desired values of VPN parameters and others. The IPSEC VPN having one side static and another side dynamic IP address, VPN always initiates by the side having dynamic IP address. Here I have configured local-id and peer-id to establish the IPSEC VPN between these two sides having one side static and another side Dynamic IP address.
Site to Site IPSec VPN in Juniper SSG with one side dynamic IP
The IPSEC VPN Phase-I and Phase-II proposal parameters used here are manually defined so that any parameters can be defined easily by studying the given scenario here. The table shows Phase-I and Phase-II VPN parameters that must be same on both side of VPN configured devices and some other parameters are locally significant and these must be unique to the existing values on local SSG Device configuration.
The configuration has been prepared on assumption of there is already basic configuration on both side of devices. Here I have configured very simple and basic configuration with minimum requirements to configure site to site IPSEC VPN with one side having static IP address and another side having dynamic IP address or IP assigned by DHCP in Juniper SSG Series devices.
I am going to show both way of configuring the SSG with CLI and WEB step by step below. Configuring SSG device by WEB is far easy than CLI Procedure for the users who are less familiar to the NetscreenOS CLI. Though I most like to prefer the CLI every time.
Firstly, I am going to configure using CLI procedure for both location in part 1 than I will show the WEB procedure as well in part 2.
IPSEC (Phase-I and Phase-II) VPN parameters
VPN Parameters |
SIDE A SSG | SIDE B SSG | ||
Phase-I(IKE) | Authentication Method | Preshared key | Preshared key | |
Authentication- Algorithm | Sha1 | Sha1 | ||
Encryption- Algorithm | Des-cbc | Des-cbc | ||
dh-group | 2 | 2 | ||
Lifetime (sec) | 28800 | 28800 | ||
Mode | Aggressive | Aggressive | ||
Remote gateway Address | 0.0.0.0 | 10.10.10.1 | ||
Peer – id | dynamic@vpn | |||
Local-id | dynamic@vpn | |||
Phase-II(IPSEC) | Protocol | Esp | Esp | |
Authentication- Algorithm | sha1-96 | sha1-96 | ||
Encryption- Algorithm | Des-cbc | Des-cbc | ||
PFS keys Groups | 2 | 2 | ||
Lifetime (sec) | 86400 | 86400 | ||
Proxy-identity | local | 192.168.100.0/24 | 192.168.200.0/24 | |
remote | 192.168.200.0/24 | 192.168.100.0/24 | ||
Service | Any | Any | ||
Locally Significant | Outgoing interface | Eth0/0 | Eth0/0 | |
Tunnel interface | Tunnel.1 | Tunnel.1 | ||
VPN ID | 0x1 | 0x1 | ||
Policy id | xx | xx |
Side A SSG configuration
Side A SSG has static IP to the interface facing internet/WAN. All the configuration steps here are based on the VPN parameters listed in above table. I have configured the VPN tunnel 1 interface in SSG device. The tunnel interface is bonded to Trust zone. you can bind it in different zone than trust zone as your desire so that I could not add more policies for the user if there is already a policy in basic configurations. The destination network is routed with the tunnel 1 interface to reach another side SSG through the internet cloud which is bounded to the Phase-II VPN. The traffic passing through in internet cloud becomes encrypted to protect the unauthorized access of data.
CLI Procedure: I most like to prefer the way to configure the Juniper device. I am going to configure as blow.
Configuring the tunnel 1 interface with trust zone
SITE-A->set interface “tunnel.1” zone “Trust” Binding the tunnel interface to the Inside (LAN) interface SITE-A->set interface tunnel.1 ip unnumbered interface ethernet0/1 Configuring Address list for Local and Remote IP networks in Trust Zone SITE-A->set address “Trust” “192.168.100.0/24” 192.168.100.0 255.255.255.0 SITE-A->set address “Trust” “192.168.200.0/24” 192.168.200.0 255.255.255.0 Configuring Phase-I and Phase-II Parameters SITE-A->set ike p1-proposal “P1proposal” preshare group2 esp des sha-1 second 28800 SITE-A->set ike p2-proposal “P2proposal” group2 esp des sha-1 second 86400 Configuring the Phase-I SITE-A->set ike gateway “DYNAMIC-gw” address 0.0.0.0 id “dynmic@vpn” Aggr outgoing-interface “ethernet0/0” preshare <preshared-key> proposal “P1proposal” SITE-A->unset ike gateway “DYNAMIC-gw” nat-traversal Configuring the Phase-II SITE-A->set vpn “DYNAMIC-ike” gateway “DYNAMIC-gw” no-replay tunnel idletime 0 proposal “P2proposal” SITE-A->set vpn “DYNAMIC-ike” monitor optimized rekey SITE-A->set vpn “DYNAMIC-ike” id 0x1d bind interface tunnel.1 SITE-A->set vpn “DYNAMIC-ike” proxy-id local-ip 192.168.100.0/24 remote-ip 192.168.200.0/24 “ANY” Configuring Policies from and to local Network to Remote Network with session logging SITE-A->set policy id 1 from “Trust” to “Trust” “192.168.100.0/24” “192.168.200.0/24” “ANY” permit log SITE-A->set policy id 1 SITE-A->set log session-init SITE-A->exit SITE-A->set policy id 2 from “Trust” to “Trust” “192.168.200.0/24” “192.168.100.0/24” “ANY” permit log SITE-A->set policy id 2 SITE-A->set log session-init SITE-A->exit Configuring the Route to Remote Network SITE-A->set route 192.168.200.0/24 interface tunnel.1 SITE-A->saveSide B SSG Configuration
Side B SSG has dynamic IP to the interface facing internet/WAN. It is configured as following using the VPN parameters listed in above table. All of the configuration is similar to the side A SSG device except the Phase-I gateway configuration.
Configuring the tunnel interface with trust zone SITE-B-> set interface “tunnel.1” zone “Trust” Binding the tunnel interface to the Inside (LAN) interface SITE-B-> set interface tunnel.1 ip unnumbered interface ethernet0/1 Configuring Address list for Local and Remote Networks in Trust Zone SITE-B-> set address “Trust” “192.168.200.0/24” 192.168.200.0 255.255.255.0 SITE-B-> set address “Trust” “192.168.100.0/24” 192.168.100.0 255.255.255.0 Configuring Phase-I and Phase-II Parameters SITE-B-> set ike p1-proposal “P1proposal” preshare group2 esp des sha-1 second 28800 SITE-B-> set ike p2-proposal “P2proposal” group2 esp des sha-1 second 86400 Configuring the Phase-I SITE-B-> set ike gateway “DYNAMIC-GW” address 10.10.10.1 Aggr local-id “dynmic@vpn” outgoing-interface “ethernet0/0” preshare <preshared-key> proposal “P1proposal” SITE-B-> unset ike gateway ” DYNAMIC-GW” nat-traversal Configuring the Phase-II SITE-B-> set vpn “DYNAMIC-IKE” gateway “DYNAMIC-GW” no-replay tunnel idletime 0 proposal “g2-esp-3des-sha” SITE-B-> set vpn “DYNAMIC-IKE” monitor optimized rekey SITE-B-> set vpn “DYNAMIC-IKE” id 0x1 bind interface tunnel.1 SITE-B-> set vpn “DYNAMIC-IKE” proxy-id local-ip 192.168.200.0/24 remote-ip 192.168.100.0/24 “ANY” Configuring Policies from and to local Network to Remote Network with session logging SITE-B-> set policy id 1 from “Trust” to “Trust” “192.168.200.0/24” “192.168.100.0/24” “ANY” permit log SITE-B-> set policy id 1 SITE-B-> set log session-init SITE-B-> exit SITE-B-> set policy id 2 from “Trust” to “Trust” “192.168.100.0/24” “192.168.200.0/24” “ANY” permit log SITE-B-> set policy id 2 SITE-B-> set log session-init SITE-B-> exit Configuring the Route to Remote Network SITE-B-> set route 192.168.100.0/24 interface tunnel.1 SITE-B-> save Verifying the commands get sa active : it shows the active VPN get sa stat : it shows the VPN status ping <IP address> from ethernet0/1 : The interface should be LAN side of local device and IP address should be remote site LAN interface IP. Verifying the rechability from SITE-A LAN interface eth0/1 to SITE-B LAN interface IP 192.168.200.1 SITE-A-> ping 192.168.200.1 from eth0/1 Type escape sequence to abort Sending 5, 100-byte ICMP Echos to 192.168.200.1, timeout is 1 seconds from ethernet0/1 !!!!! Success Rate is 100 percent (5/5), round-trip time min/avg/max=490/505/516 ms Verifying the rechability from SITE-B LAN interface eth0/1 to SITE-A LAN interface IP 192.168.100.1 SITE-B-> ping 192.168.100.1 from eth0/1 Type escape sequence to abort Sending 5, 100-byte ICMP Echos to 192.168.100.1, timeout is 1 seconds from ethernet0/1 !!!!! Success Rate is 100 percent (5/5), round-trip time min/avg/max=491/506/518 ms