Juniper SRX to SSG – Dynamic Site To Site IPSec VPN
Juniper SRX to SSG – Dynamic Site To Site IPSec VPN
I have explained How to configure Site to Site IPSec VPN in Juniper SSG with one side dynamic IP in my previous articles. Now I here am going to explain how to configure and implement Juniper SRX to SSG – Dynamic site to site IPSec VPN. Dynamic site to site VPN is type of IPSec VPN having one side Dynamic IP address or DHCP to the interface facing internet and static IP address in another side. It is most important for the scenario where one side IP address is assigned dynamically.
Some facts behind the Dynamic site to site IPSec VPN
- Route based VPN can only be implemented
- Polic based VPN ca’t be implemented
- it can’t support main mode.
Dynamic site to site Ipsec VPN Network Scenario
In above scenario, there is static IP address in SRX side and Dynamic IP address in SSG side. For this scenario, I have used Junos 11.4 for SRX device and screenOS 6.3.0r8.0 in SSG device.
IPSEC (Phase-I and Phase-II) VPN parameters
VPN Parameters |
SIDE A SSG | SIDE B SRX | ||
Phase-I (IKE) | Authentication Method | Preshared key | Preshared key | |
Authentication- Algorithm | Sha1 | Sha1 | ||
Encryption- Algorithm | 3Des-cbc | 3Des-cbc | ||
dh-group | 2 | 2 | ||
Lifetime (sec) | 28800 | 28800 | ||
Mode | Aggressive | Aggressive | ||
Remote gateway Address | 10.10.20.2 | |||
Dynamic – id | vpn@gsraut.com | |||
Local-id | vpn@gsraut.com | |||
NAT-traversal | enable | enable | ||
nat-keepalive | 10 sec | 10 sec | ||
DPD interval | 10 sec | 10 sec | ||
DPD threshold | 3 | 3 | ||
Phase-II (IPSec) | Protocol | Esp | Esp | |
Authentication- Algorithm | sha1-96 | sha1-96 | ||
Encryption- Algorithm | 3Des-cbc | 3Des-cbc | ||
PFS keys Groups | 2 | 2 | ||
Lifetime (sec) | 86400 | 86400 | ||
Proxy-identity | local | 192.168.100.0/24 | 192.168.200.0/24 | |
remote | 192.168.200.0/24 | 192.168.100.0/24 | ||
Service | Any | Any | ||
Locally Significant | Outgoing interface | Eth0/0 | ge-0/0/0 | |
Tunnel interface | Tunnel.1 | st0.0 | ||
VPN ID | 0×1 | |||
Policy id | xx | xx |
Configuring VPN in Juniper SSG [side A]
SSG has dynamic IP to the interface facing internet/WAN. All the configuration steps here are based on the VPN parameters listed in above table. I have configured the VPN tunnel 1 interface in SSG device. The tunnel interface is attached to Trust zone. you can bind it in different zone than trust zone as your desire. The destination network is routed with the tunnel 1 interface to reach another side SSG through the internet cloud which is attached to the Phase-II VPN. The traffic passing through the internet cloud becomes encrypted to protect the unauthorized access of data.
CLI Procedure: I most like to prefer this way to configure Juniper device. I am going to configure as blow.
Configuring LAN interface trust zone and assigning IP address SSG->set interface “ethernet0/1” zone “Trust” SSG->set interface ethernet0/1 ip 192.168.100.1/24 SSG->set interface ethernet0/1 nat Configuring the tunnel 1 interface with trust zone SSG->set interface “tunnel.1″ zone “Trust” Binding the tunnel interface to the Inside (LAN) interface SSG->set interface tunnel.1 ip unnumbered interface ethernet0/1 Configuring Address list for Local and Remote IP networks in Trust Zone SSG->set address “Trust” “192.168.100.0/24″ 192.168.100.0 255.255.255.0 SSG->set address “Trust” “192.168.200.0/24″ 192.168.200.0 255.255.255.0 Configuring Phase-I and Phase-II Parameters SSG->set ike p1-proposal “P1proposal” preshare group2 esp 3des sha-1 second 28800 SSG->set ike p2-proposal “P2proposal” group2 esp 3des sha-1 second 86400 Configuring the Phase-I SSG->set ike gateway “DYNAMIC-gw” address 10.10.20.2 Aggr local-id “vpn@gsraut.com” outgoing-interface “ethernet0/0″ preshare <preshared-key> proposal “P1proposal” SSG->set ike gateway “DYNAMIC-gw” dpd-liveness interval 10
SSG->set ike gateway “DYNAMIC-gw” dpd-liveness retry 3
SSG->set ike gateway “DYNAMIC-gw” nat-traversal
SSG->unset ike gateway “DYNAMIC-gw” nat-traversal udp-checksum
SSG->set ike gateway “DYNAMIC-gw” nat-traversal keepalive-frequency 10 Configuring the Phase-II SSG->set vpn “DYNAMIC-ike” gateway “DYNAMIC-gw” replay tunnel idletime 0 proposal “P2proposal” SSG->set vpn “DYNAMIC-ike” monitor source-interface ethernet0/0 destination-ip 10.10.20.2 optimized rekey SSG->set vpn “DYNAMIC-ike” id 0x1d bind interface tunnel.1 SSG->set vpn “DYNAMIC-ike” proxy-id local-ip 192.168.100.0/24 remote-ip 192.168.200.0/24 “ANY” Configuring Policies from and to local Network to Remote Network with session logging SSG->set policy id 1 from “Trust” to “Trust” “192.168.100.0/24″ “192.168.200.0/24″ “ANY” permit log SSG->set policy id 1 SSG->set log session-init SSG->exit SSG->set policy id 2 from “Trust” to “Trust” “192.168.200.0/24″ “192.168.100.0/24″ “ANY” permit log SSG->set policy id 2 SSG->set log session-init SSG->exit Configuring the Route to Remote Network SSG->set route 192.168.200.0/24 interface tunnel.1 SSG->save
Configuring VPN in Juniper SRX [side B]
Configure the WAN side interface and assigning the IP addressuser@SRX#set interfaces ge-0/0/0 unit 0 description ” WAN INTERFACE “ user@SRX#set interfaces ge-0/0/0 unit 0 family inet address 10.10.20.2/30 |
user@SRX#set interfaces ge-0/0/1 unit 0 description ” LAN INTERFACE “ user@SRX#set interfaces ge-0/0/1 unit 0 family inet address 192.168.200.1/24 |
user@SRX#set interfaces st0 unit 0 description ” VPN SECURE TUNNEL “ user@SRX#set interfaces st0 unit 0 family inet 172.16.1.1/32 |
user@SRX#set routing-options static route 0.0.0.0/0 next-hop 10.10.20.1 user@SRX#set routing-options static route 192.168.100.0/24 next-hop st0.0 |
user@SRX#set security zones security-zone WAN host-inbound-traffic system-services ike user@SRX#set security zones security-zone WAN interfaces ge-0/0/0.0 user@SRX#set security zones security-zone LAN host-inbound-traffic system-services all user@SRX#set security zones security-zone LAN interfaces ge-0/0/1.0 user@SRX#set security zones security-zone LAN interfaces st0.0 |
Configure the Local IP address in LAN Zone and Remote IP address in WAN zone
user@SRX#set security zones security-zone LAN address-book address LOCAL_IP 192.168.100.0/24 user@SRX#set security zones security-zone LAN address-book address REMOTE_IP 192.168.200.0/24 |
Configure Phase-I IKE proposal and Policy for main mode as listed above in Table
Here I have defined the VPN parameters manually instead of using the default for Phase-I.user@SRX#set security ike proposal IKE-PROPOSAL authentication-method pre-shared-keys user@SRX#set security ike proposal IKE-PROPOSAL dh-group group2 user@SRX#set security ike proposal IKE-PROPOSAL authentication-algorithm sha1 user@SRX#set security ike proposal IKE-PROPOSAL encryption-algorithm 3des-cbc user@SRX#set security ike proposal IKE-PROPOSAL lifetime-seconds 28800 user@SRX#set security ike policy IKE-POLICY mode aggressive user@SRX#set security ike policy IKE-POLICY proposals IKE-PROPOSAL user@SRX#set security ike policy IKE-POLICY pre-shared-key ascii-text <preshared-key> |
user@SRX#set security ike gateway VPN-GATEWAY ike-policy IKE-POLICY user@SRX#set security ike gateway VPN-GATEWAY dynamic user-at-hostname “vpn@gsraut.com” user@SRX#set security ike gateway VPN-GATEWAY dead-peer-detection interval 10 user@SRX#set security ike gateway VPN-GATEWAY dead-peer-detection threshold 3 user@SRX#set security ike gateway VPN-GATEWAY nat-keepalive 10 user@SRX#set security ike gateway VPN-GATEWAY external-interface ge-0/0/0.0 |
user@SRX#set security ipsec proposal IPSEC-PROPOSAL protocol esp user@SRX#set security ipsec proposal IPSEC-PROPOSAL authentication-algorithm hmac-sha1-96 user@SRX#set security ipsec proposal IPSEC-PROPOSAL encryption-algorithm 3des-cbc user@SRX#set security ipsec proposal IPSEC-PROPOSAL lifetime-seconds 86400 user@SRX#set security ipsec policy IPSEC-POLICY perfect-forward-secrecy keys group2 user@SRX#set security ipsec policy IPSEC-POLICY proposals IPSEC-PROPOSAL |
user@SRX#set security ipsec vpn IPSEC-VPN bind-interface st0.0 user@SRX#set security ipsec vpn IPSEC-VPN vpn-monitor source-interface ge-0/0/0 user@SRX#set security ipsec vpn IPSEC-VPN ike gateway VPN-GATEWAY user@SRX#set security ipsec vpn IPSEC-VPN ike proxy-identity local 192.168.200.0/24 user@SRX#set security ipsec vpn IPSEC-VPN ike proxy-identity remote 192.168.100.0/24 user@SRX#set security ipsec vpn IPSEC-VPN ike proxy-identity service any user@SRX#set security ipsec vpn IPSEC-VPN ike ipsec-policy IPSEC-POLICY user@SRX#set security ipsec vpn IPSEC-VPN establish-tunnels immediately |
user@SRX#set security policies from-zone LAN to-zone WAN policy LAN_WAN match source-address any user@SRX#set security policies from-zone LAN to-zone WAN policy LAN_WAN match destination-address any user@SRX#set security policies from-zone LAN to-zone WAN policy LAN_WAN match application any user@SRX#set security policies from-zone LAN to-zone WAN policy LAN_WAN then permit |
user@SRX#set security policies from-zone LAN to-zone LAN policy VPN_LAN match source-address REMOTE_IP user@SRX#set security policies from-zone LAN to-zone LAN policy VPN_LAN match destination-address LOCAL_IP user@SRX#set security policies from-zone LAN to-zone LAN policy VPN_LAN match application any user@SRX#set security policies from-zone LAN to-zone LAN policy VPN_LAN then permit user@SRX#set security policies from-zone LAN to-zone LAN policy LAN_VPN match source-address LOCAL_IP user@SRX#set security policies from-zone LAN to-zone LAN policy LAN_VPN match destination-address REMOTE_IP user@SRX#set security policies from-zone LAN to-zone LAN policy LAN_VPN match application any user@SRX#set security policies from-zone LAN to-zone LAN policy LAN_VPN then permit |
user@SRX#set security nat source rule-set LAN-TO_WAN from zone LAN user@SRX#set security nat source rule-set LAN-TO_WAN to zone WAN user@SRX#set security nat source rule-set LAN-TO_WAN rule SOURCE-NAT match source-address 0.0.0.0/0 user@SRX#set security nat source rule-set LAN-TO_WAN rule SOURCE-NAT match destination-address 0.0.0.0/0 user@SRX#set security nat source rule-set LAN-TO_WAN rule SOURCE-NAT then source-nat interface |
Verifying the status of VPN tunnel and rechability to remote site in SRX [side B]
user@SRX# run show security ike sa
Index State Initiator cookie Responder cookie Mode Remote Address
4296995 UP a1605a0b1ec53b10 ab7ba5c1bacc427e Aggressive x.x.x.x
[edit]
user@SRX# run show security ike sa detail
IKEpeer x.x.x.x, Index 4296995, Gateway Name: VPN-GATEWAY
Role: Responder, State: UP
Initiator cookie: a1605a0b1ec53b10, Responder cookie: ab7ba5c1bacc427e
Exchange type: Aggressive, Authentication method: Pre-shared-keys
Local: 10.10.20.2:500, Remote: x.x.x.x:500
Lifetime: Expires in 85476 seconds
Peer ike-id: vpn@gsraut.com
Xauth assigned IP: 0.0.0.0
Algorithms:
Authentication : hmac-sha1-96
Encryption : 3des-cbc
Pseudo random function: hmac-sha1
Diffie-Hellman group : DH-group-2
Traffic statistics:
Input bytes : 1166
Output bytes : 1080
Input packets: 7
Output packets: 5
Flags: IKE SA is created
IPSec security associations: 1 created, 0 deleted
Phase 2 negotiations in progress: 0
Negotiation type: Quick mode, Role: Responder, Message ID: 0
Local: 10.10.20.2:500, Remote: x.x.x.x:500
Local identity: 10.10.20.2
Remote identity: vpn@gsraut.com
Flags: IKE SA is created
[edit]
user@SRX# run show security ipsec sa
Total active tunnels: 1
ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway
<133955585 ESP:3des/sha1 35eaac44 35069/unlim U root 500 x.x.x.x
>133955585 ESP:3des/sha1 ab9078e2 35069/unlim U root 500 x.x.x.x
[edit]
user@SRX# run show security ipsec sa detail
ID: 133955585 Virtual-system: root, VPN Name: IPSEC-VPN
Local Gateway: 10.10.20.2, Remote Gateway: x.x.x.x
Local Identity: ipv4_subnet(any:0,[0..7]=192.168.200.0/24)
Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.100.0/24)
Version: IKEv1
DF-bit: clear
Bind-interface: st0.0
Direction: inbound, SPI: 35eaac44, AUX-SPI: 0
, VPN Monitoring: UP
Hard lifetime: Expires in 35066 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 34473 seconds
Mode: Tunnel(10 10), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: ab9078e2, AUX-SPI: 0
, VPN Monitoring: UP
Hard lifetime: Expires in 35066 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 34473 seconds
Mode: Tunnel(10 10), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
user@SRX# run ping 192.168.100.1 interface ge-0/0/1 rapid count 1000 PING 192.168.100.1 (192.168.100.1): 56 data bytes !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!^C — 192.168.100.1 ping statistics — 71 packets transmitted, 70 packets received, 1% packet loss round-trip min/avg/max/stddev = 418.777/441.726/483.390/13.637 ms [edit] user@SRX# run show route 192.168.100.1 inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden) + =Active Route, – = Last Active, * = Both 192.168.100.0/24 *[Static/5] 00:15:41 > via st0.0 |
Verifying the status of VPN tunnel in SSG side
SSG-> get sa active Total active sa: 1 total configured sa: 1 HEX ID Gateway Port Algorithm SPI Life:sec kb Sta PID vsys 00000004< 10.10.20.2 500 esp:3des/sha1 ab9078da 32836 unlim A/U -1 0 00000004> 10.10.20.2 500 esp:3des/sha1 b39e5e4f 32836 unlim A/U -1 0 SSG->ping 192.168.200.1 from eth0/1 Type escape sequence to abort Sending 5, 100-byte ICMP Echos to 192.168.4.1, timeout is 1 seconds !!!!! Success Rate is 100 percent (5/5), round-trip time min/avg/max=412/474/607 ms SSG-> get ike cookies IKEv1 SA — Active: 1, Dead: 0, Total 1 1097122f/0006, x.x.x.x:500->10.10.20.2:500, PRESHR/grp2/3DES/SHA, xchg(5) (DYNAMIC-gw/grp-1/usr-1) resent-tmr 322 lifetime 86400 lt-recv 28800 nxt_rekey 83340 cert-expire 0 initiator, err cnt 0, send dir 1, cond 0x0 nat-traversal map not available ikeheartbeat : disabled ikeheartbeat last rcv time: 0 ikeheartbeat last snd time: 0 XAUTH status: 0 DPD seq local 1687177420, peer 0 IKEv2 SA — Active: 0, Dead: 0, Total 0 |