Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Policy-Based VPN

Requirements

This example uses the following hardware:

• SRX240 device
• SSG140 device

Before you begin, read VPN Overview.

Overview

In this example, you configure a policy-based VPN for a branch office in Chicago, Illinois, because you do not need to conserve tunnel resources or configure many security policies to filter traffic through the tunnel. Users in the Chicago office will use the VPN to connect to their corporate headquarters in Sunnyvale, California.

Figure 1 shows an example of a policy-based VPN topology. In this topology, the SRX Series device is located in Sunnyvale, and an SSG Series device (or it can be another third-party device) is located in Chicago.

Figure 1: Policy-Based VPN Topology

IKE IPsec tunnel negotiation occurs in two phases. In Phase 1, participants establish a secure channel in which to negotiate the IPsec security association (SA). In Phase 2, participants negotiate the IPsec SA for authenticating traffic that will flow through the tunnel. Just as there are two phases to tunnel negotiation, there are two phases to tunnel configuration.

In this example, you configure interfaces, an IPv4 default route, security zones, and address books. Then you configure IKE Phase 1, IPsec Phase 2, security policy, and TCP-MSS parameters. See Table 1 through Table 5.

Configuration

Configuring Basic Network, Security Zone, and Address Book Information

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure Ethernet interface information.
   [edit]user@host# set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.1/24user@host# set interfaces ge-0/0/3 unit 0 family inet address 1.1.1.2/30
2. Configure static route information.
   [edit]user@host# set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1
3. Configure the untrust security zone.
   [edit ]user@host# edit security zones security-zone untrust
4. Assign an interface to the security zone.
   [edit security zones security-zone untrust]user@host# set interfaces ge-0/0/3.0
5. Specify allowed system services for the security zone.
   [edit security zones security-zone untrust]user@host# set host-inbound-traffic system-services ike
6. Configure the trust security zone.
   [edit]user@host# edit security zones security-zone trust
7. Assign an interface to the security zone.
   [edit security zones security-zone trust]user@host# set interfaces ge-0/0/0.0
8. Specify allowed system services for the security zone.
   [edit security zones security-zone trust]user@host# set host-inbound-traffic system-services all
9. Create an address book and attach it to a zone.
   [edit security address-book book1]user@host# set address sunnyvale 10.10.10.0/24 user@host# set attach zone trust
10. Create another address book and attach it to a zone.
    [edit security address-book book2]user@host# set address chicago 192.168.168.0/24 user@host# set attach zone untrust

Results

From configuration mode, confirm your configuration by entering the show interfaces, show routing-options, show security zones, and show security address-book commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring IKE

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the IKE Phase 1 proposal.
   [edit security ike]user@host# set proposal ike-phase1-proposal
2. Define the IKE proposal authentication method.
   [edit security ike proposal ike-phase1-proposal]user@host# set authentication-method pre-shared-keys
3. Define the IKE proposal Diffie-Hellman group.
   [edit security ike proposal ike-phase1-proposal]user@host# set dh-group group2
4. Define the IKE proposal authentication algorithm.
   [edit security ike proposal ike-phase1-proposal]user@host# set authentication-algorithm sha1
5. Define the IKE proposal encryption algorithm.
   [edit security ike proposal ike-phase1-proposal]user@host# set encryption-algorithm aes-128-cbc
6. Create an IKE Phase 1 policy.
   [edit security ike]user@host# set policy ike-phase1-policy
7. Set the IKE Phase 1 policy mode.
   [edit security ike policy ike-phase1-policy]user@host# set mode main
8. Specify a reference to the IKE proposal.
   [edit security ike policy ike-phase1-policy]user@host# set proposals ike-phase1-proposal
9. Define the IKE Phase 1 policy authentication method.
   [edit security ike policy ike-phase1-policy]user@host# set pre-shared-key ascii-text $ABC123
10. Create an IKE Phase 1 gateway and define its external interface.
    [edit security ike]user@host# set gateway gw-chicago external-interface ge-0/0/3.0
11. Define the IKE Phase 1 policy reference.
    [edit security ike gateway gw-chicago]user@host# set ike-policy ike-phase1-policy
12. Create an IKE Phase 1 gateway and define its external interface.
    [edit security ike gateway gw-chicago]user@host# set gateway gw-chicago external-interface ge-0/0/3.0
13. Define the IKE Phase 1 policy reference.
    [edit security ike gateway gw-chicago]user@host# set ike-policy ike-phase1-policy

Results

From configuration mode, confirm your configuration by entering the show security ike command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring IPsec

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create an IPsec Phase 2 proposal.
   [edit]user@host# set security ipsec proposal ipsec-phase2-proposal
2. Specify the IPsec Phase 2 proposal protocol.
   [edit security ipsec proposal ipsec-phase2-proposal]user@host# set protocol esp
3. Specify the IPsec Phase 2 proposal authentication algorithm.
   [edit security ipsec proposal ipsec-phase2-proposal]user@host# set authentication-algorithm hmac-sha1-96
4. Specify the IPsec Phase 2 proposal encryption algorithm.
   [edit security ipsec proposal ipsec-phase2-proposal]user@host# set encryption-algorithm aes-128-cbc
5. Create the IPsec Phase 2 policy.
   [edit security ipsec]user@host# set policy ipsec-phase2-policy
6. Specify the IPsec Phase 2 proposal reference.
   [edit security ipsec policy ipsec-phase2-policy]user@host# set proposals ipsec-phase2-proposal
7. Specify IPsec Phase 2 PFS to use Diffie-Hellman group 2.
   [edit security ipsec policy ipsec-phase2-policy]user@host# set perfect-forward-secrecy keys group2
8. Specify the IKE gateway.
   [edit security ipsec]user@host# set vpn ike-vpn-chicago ike gateway gw-chicago
9. Specify the IPsec Phase 2 policy.
   [edit security ipsec]user@host# set vpn ike-vpn-chicago ike ipsec-policy ipsec-phase2-policy

Results

From configuration mode, confirm your configuration by entering the show security ipsec command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring Security Policies

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the security policy to permit traffic from the trust zone to the untrust zone.
   [edit security policies from-zone trust to-zone untrust]user@host# set policy vpn-tr-untr match source-address sunnyvaleuser@host# set policy vpn-tr-untr match destination-address chicagouser@host# set policy vpn-tr-untr match application anyuser@host# set policy vpn-tr-untr then permit tunnel ipsec-vpn ike-vpn-chicagouser@host# set policy vpn-tr-untr then permit tunnel pair-policy vpn-untr-tr
2. Create the security policy to permit traffic from the untrust zone to the trust zone.
   [edit security policies from-zone untrust to-zone trust]user@host# set policy vpn-untr-tr match source-address sunnyvaleuser@host# set policy vpn-untr-tr match destination-address chicagouser@host# set policy vpn-untr-tr match application anyuser@host# set policy vpn-untr-tr then permit tunnel ipsec-vpn ike-vpn-chicagouser@host# set policy vpn-untr-tr then permit tunnel pair-policy vpn-tr-untr
3. Create the security policy to permit traffic from the trust zone to the untrust zone.
   [edit security policies from-zone trust to-zone untrust]user@host# set policy permit-any match source-address anyuser@host# set policy vpn-untr-tr match destination-address anyuser@host# set policy vpn-untr-tr match application anyuser@host# set policy vpn-untr-tr then permit
4. Reorder the security policies so that the vpn-tr-untr security policy is placed above the permit-any security policy.
   [edit security policies from-zone trust to-zone untrust]user@host# insert policy vpn-tr-untr before policy permit-any

Results

From configuration mode, confirm your configuration by entering the show security policies command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring TCP-MSS

CLI Quick Configuration

To quickly configure this section of the example, copy the following command, paste it into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the command into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure TCP-MSS information.
   [edit]user@host# set security flow tcp-mss ipsec-vpn mss 1350

Results

From configuration mode, confirm your configuration by entering the show security flow command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring the SSG Series Device

CLI Quick Configuration

For reference, the configuration for the SSG Series device is provided. For information about configuring SSG Series devices, see the Concepts and Examples ScreenOS Reference Guide, which is located at https://www.juniper.net/techpubs .

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI.

Step-by-Step Procedure

Verification

To confirm that the configuration is working properly, perform these tasks:

• Verifying the IKE Phase 1 Status
• Verifying the IPsec Phase 2 Status
• Reviewing Statistics and Errors for an IPsec Security Association

Verifying the IKE Phase 1 Status

Purpose

Verify the IKE Phase 1 status.

Action

Note: Before starting the verification process, you need to send traffic from a host in the 10.10.10/24 network to a host in the 192.168.168/24 network. For policy-based VPNs, a separate host must generate the traffic; traffic initiated from the SRX Series device will not match the VPN policy. We recommend that the test traffic be from a separate device on one side of the VPN to a second device on the other side of the VPN. For example, initiate ping from 10.10.10.10 to 192.168.168.10.

From operational mode, enter the show security ike security-associations command. After obtaining an index number from the command, use the show security ike security-associations index index_number detail command.

Index   Remote Address  State  Initiator cookie  Responder cookie  Mode
4       2.2.2.2         UP     5e1db3f9d50b0de6  e50865d9ebf134f8  Main

IKE peer 2.2.2.2, Index 4,
  Role: Responder, State: UP
  Initiator cookie: 5e1db3f9d50b0de6, Responder cookie: e50865d9ebf134f8
  Exchange type: Main, Authentication method: Pre-shared-keys
  Local: 1.1.1.2:500, Remote: 2.2.2.2:500
  Lifetime: Expires in 28770 seconds
  Algorithms:
   Authentication        : sha1
   Encryption            : aes-128-cbc
   Pseudo random function: hmac-sha1
  Traffic statistics:
   Input bytes    :                 852
   Output bytes   :                 856
   Input packets  :                   5
   Output packets :                   4
  Flags: Caller notification sent
  IPSec security associations: 1 created, 0 deleted
  Phase 2 negotiations in progress: 0

Meaning

The show security ike security-associations command lists all active IKE Phase 1 security associations (SAs). If no SAs are listed, there was a problem with Phase 1 establishment. Check the IKE policy parameters and external interface settings in your configuration.

If SAs are listed, review the following information:

• Index—This value is unique for each IKE SA, which you can use in the show security ike security-associations index detail command to get more information about the SA.
• Remote Address—Verify that the remote IP address is correct.
• State
  • UP—The Phase 1 SA has been established.
  • DOWN—There was a problem establishing the Phase 1 SA.
• Mode—Verify that the correct mode is being used.

Verify that the following are correct in your configuration:

• External interfaces (the interface must be the one that receives IKE packets)
• IKE policy parameters
• Preshared key information
• Phase 1 proposal parameters (must match on both peers)

The show security ike security-associations index 1 detail command lists additional information about the security association with an index number of 1:

• Authentication and encryption algorithms used
• Phase 1 lifetime
• Traffic statistics (can be used to verify that traffic is flowing properly in both directions)
• Initiator and responder role information

  Note: Troubleshooting is best performed on the peer using the responder role.

• Number of IPsec SAs created
• Number of Phase 2 negotiations in progress

Verifying the IPsec Phase 2 Status

Purpose

Verify the IPsec Phase 2 status.

Action

From operational mode, enter the show security ipsec security-associations command. After obtaining an index number from the command, use the show security ipsec security-associations index index_number detail command.

  total configured sa: 2
  ID    Gateway         Port  Algorithm          SPI      Life:sec/kb  Mon vsys
  <2    2.2.2.2         500   ESP:aes-128/sha1   a63eb26f 3565/ unlim   -   0
  >2    2.2.2.2         500   ESP:aes-128/sha1   a1024ed9 3565/ unlim   -   0

  Virtual-system: Root
  Local Gateway: 1.1.1.2, Remote Gateway: 2.2.2.2
  Local Identity: ipv4_subnet(any:0,[0..7]=10.10.10.0/24)
  Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.168.0/24)
    DF-bit: clear
    Policy-name: vpnpolicy-unt-tr

    Direction: inbound, SPI: 2789126767, AUX-SPI: 0
    Hard lifetime: Expires in 3558 seconds
    Lifesize Remaining: Unlimited
    Soft lifetime: Expires in 2986 seconds
    Mode: tunnel, Type: dynamic, State: installed, VPN Monitoring: -
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)    
    Anti-replay service: enabled, Replay window size: 32

    Direction: outbound, SPI: 2701283033,, AUX-SPI: 0
    Hard lifetime: Expires in 3558 seconds
    Lifesize Remaining: Unlimited
    Soft lifetime: Expires in 2986 seconds
    Mode: tunnel, Type: dynamic, State: installed, VPN Monitoring: -
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc
    Anti-replay service: enabled, Replay window size: 32

Meaning

The output from the show security ipsec security-associations command lists the following information:

• The ID number is 2. Use this value with the show security ipsec security-associations index command to get more information about this particular SA.
• There is one IPsec SA pair using port 500, which indicates that no NAT-traversal is implemented. (NAT-traversal uses port 4500 or another random high-number port.)
• The SPIs, lifetime (in seconds), and usage limits (or lifesize in KB) are shown for both directions. The 3565/ unlim value indicates that the Phase 2 lifetime expires in 3565 seconds, and that no lifesize has been specified, which indicates that it is unlimited. Phase 2 lifetime can differ from Phase 1 lifetime, as Phase 2 is not dependent on Phase 1 after the VPN is up.
• VPN monitoring is not enabled for this SA, as indicated by a hyphen in the Mon column. If VPN monitoring is enabled, U (up) or D (down) is listed.
• The virtual system (vsys) is the root system, and it always lists 0.

The output from the show security ipsec security-associations index 16384 detail command lists the following information:

• The local identity and remote identity make up the proxy ID for the SA.

  A proxy ID mismatch is one of the most common reasons for a Phase 2 failure. For policy-based VPNs, the proxy ID is derived from the security policy. The local address and remote address are derived from the address book entries, and the service is derived from the application configured for the policy. If Phase 2 fails because of a proxy ID mismatch, you can use the policy to confirm which address book entries are configured. Verify that the addresses match the information being sent. Check the service to ensure that the ports match the information being sent.

Reviewing Statistics and Errors for an IPsec Security Association

Purpose

Review ESP and authentication header counters and errors for an IPsec security association.

Action

From operational mode, enter the show security ipsec statistics index index_number command, using the index number of the VPN for which you want to see statistics.

ESP Statistics:
  Encrypted bytes:              920
  Decrypted bytes:             6208
  Encrypted packets:              5
  Decrypted packets:             87
AH Statistics:
  Input bytes:                    0
  Output bytes:                   0
  Input packets:                  0
  Output packets:                 0
Errors:
  AH authentication failures: 0, Replay errors: 0
  ESP authentication failures: 0, ESP decryption failures: 0
  Bad headers: 0, Bad trailers: 0

You can also use the show security ipsec statistics command to review statistics and errors for all SAs.

To clear all IPsec statistics, use the clear security ipsec statistics command.

Meaning

If you see packet loss issues across a VPN, you can run the show security ipsec statistics or show security ipsec statistics detail command several times to confirm that the encrypted and decrypted packet counters are incrementing. You should also check if the other error counters are incrementing.