Configuring L2 HA Link Encryption tunnel

date_range 13-Dec-23

arrow_backward

arrow_forward

Physically connect the two devices and ensure that they are the same models. Connect the dedicated control ports on node 0 and node 1. Connect the user defined fabricated ports on node 0 and node 1. To configure two chassis in cluster mode, follow the below steps:

Zeroize both the SRX Series Firewalls before you use for cluster. If the devices are already in cluster mode please make sure you disable them before the zeroize process. For information on how to disable chassis cluster, see Disabling a Chassis Cluster. Zeroize is achieved by removing the vSRX Virtual Firewall virtual machine from the datastore as mentioned in Understanding Zeroization.
Delete the web management services.
user@host# delete system services web-management

Configure FIPS mode and bring up the devices in FIPS mode.

content_copy zoom_out_map
[edit]
     user@host# set groups global system fips level 2
    [edit]
     user@host# set groups global system root-authentication plain-textpassword
     New password: type password here
     Retype new password: retype password here
    [edit]
     user@host# commit
     user@host> request system reboot
   

Configure device 1 with standard cluster commands for operating in cluster mode as node0 with control port configuration. See Chassis Cluster Control Plane Interfaces.

content_copy zoom_out_map
[edit]
user@host# set groups node0 system host-name node0-host-name
user@host# set groups node0 system backup-router gateway-address
user@host# set groups node0 system backup-router destination value
user@host# set groups node0 interfaces fxp0 unit 0 family inet address node0-ip-address
user@host# set groups node1 system host-name node1-host-name 
user@host# set groups node1 system backup-router gateway-address
user@host# set groups node1 system backup-router destination value
user@host# set groups node1 interfaces fxp0 unit 0 family inet address node1-ip-address
user@host# set apply-groups global
user@host# set apply-groups "$(node)"
user@host# delete apply-groups re0
user@host# set system ports console log-out-on-disconnect
user@host# set chassis cluster reth-count 5
user@host# set chassis cluster redundancy-group 0 node 0 priority 254
user@host# set chassis cluster redundancy-group 0 node 1 priority 1
user@host# commit
user@host> set chassis cluster cluster-id 1 node 0 reboot

After the device 1 is up, configure HA link encryption as shown in sample configuration below, commit and reboot. Device 1 needs to be configured with both node0 and node1 HA link encryption configuration before commit and reboot.

content_copy zoom_out_map
[edit]
user@host# set groups node0 security ike traceoptions file ikelog
user@host# set groups node0 security ike traceoptions file size 100m
user@host# set groups node0 security ike traceoptions flag all
user@host# set groups node0 security ike traceoptions level 15
user@host# set groups node0 security ike proposal IKE_PROP_PSK authentication-method pre-shared-keys
user@host# set groups node0 security ike proposal IKE_PROP_PSK dh-group group20
user@host# set groups node0 security ike proposal IKE_PROP_PSK authentication-algorithm sha-256
user@host# set groups node0 security ike proposal IKE_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node0 security ike policy IKE_POL_PSK proposals IKE_PROP_PSK
user@host# prompt groups node0 security ike policy IKE_POL_PSK pre-shared-key ascii-text New ascii-text (secret): juniper
Retype new ascii-text (secret): juniper
user@host# set groups node0 security ike gateway S2S_GW ike-policy IKE_POL_PSK
user@host# set groups node0 security ike gateway S2S_GW version v2-only
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK protocol esp
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK authentication-algorithm hmac-sha1-96
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK lifetime-seconds 200 
user@host# set groups node0 security ipsec policy IPSEC_POL_PSK perfect-forward-secrecy keys group20
user@host# set groups node0 security ipsec policy IPSEC_POL_PSK proposal IPSEC_PROP_PSK 
user@host# set groups node0 security ipsec vpn S2S_VPN ha-link-encryption
user@host# set groups node0 security ipsec vpn S2S_VPN ike gateway S2S_GW
user@host# set groups node0 security ipsec vpn S2S_VPN ike ipsec-policy IPSEC_POL_PSK 
user@host# set groups node1 security ike traceoptions file ikelog
user@host# set groups node1 security ike traceoptions file size 100m
user@host# set groups node1 security ike traceoptions flag all
user@host# set groups node1 security ike traceoptions level 15
user@host# set groups node1 security ike proposal IKE_PROP_PSK authentication-method pre-shared-keys
user@host# set groups node1 security ike proposal IKE_PROP_PSK dh-group group20
user@host# set groups node1 security ike proposal IKE_PROP_PSK authentication-algorithm sha-256
user@host# set groups node1 security ike proposal IKE_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node1 security ike policy IKE_POL_PSK proposals IKE_PROP_PSK
user@host# prompt groups node1 security ike policy IKE_POL_PSK pre-shared-key ascii-text New ascii-text(secret): juniper
Retype new ascii-text (secret): juniper
user@host# set groups node1 security ike gateway S2S_GW ike-policy IKE_POL_PSK
user@host# set groups node1 security ike gateway S2S_GW version v2-only
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK protocol esp
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK authentication-algorithm hmac-sha1-96
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK lifetime-seconds 200 user@host# set groups node1 security ipsec policy IPSEC_POL_PSK perfect-forward-secrecy keys group20
user@host# set groups node1 security ipsec policy IPSEC_POL_PSK proposals IPSEC_PROP_PSK user@host# set groups node1 security ipsec vpn S2S_VPN ha-link-encryption
user@host# set groups node1 security ipsec vpn S2S_VPN ike gateway S2S_GW
user@host# set groups node1 security ipsec vpn S2S_VPN ike ipsec-policy IPSEC_POL_PSK 
user@host# set groups global interfaces fab0 fabric-options member-interfaces ge-0/0/3 
user@host# set groups global interfaces fab1 fabric-options member-interfaces ge-7/0/3
user@host# commit
user@host> request system reboot

To proceed further with device 2 configuration and commit, you need to ensure device 1 and device 2 are not reachable to each other. One way to achieve this is to power off device 1 at this point.

Configure device 2 with standard cluster commands for operating in cluster mode as node1 with control port configuration. See Chassis Cluster Control Plane Interfaces.

content_copy zoom_out_map
 
[edit]
user@host# set groups node0 system host-name node0-host-name
user@host# set groups node0 system backup-router gateway-address
user@host# set groups node0 system backup-router destination value
user@host# set groups node0 interfaces fxp0 unit 0 family inet address node0-ip-address
user@host# set groups node1 system host-name node1-host-name
user@host# set groups node1 system backup-router gateway-address
user@host# set groups node1 system backup-router destination value
user@host# set groups node1 interfaces fxp0 unit 0 family inet address node1-ip-address
user@host# set apply-groups global
user@host# set apply-groups "$(node)"
user@host# delete apply-groups re0
user@host# set system ports console log-out-on-disconnect
user@host# set chassis cluster reth-count 5
user@host# set chassis cluster redundancy-group 0 node 0 priority 254
user@host# set chassis cluster redundancy-group 0 node 1 priority 1
user@host# commit
user@host> set chassis cluster cluster-id 1 node 1 reboot

After the device 2 is up, configure HA link encryption as shown in sample configuration below on device 2. Device 2 needs to be configured with both node0 and node1 HA link encryption configuration. Commit on node1 (device 2), and finally reboot node1 (device 2).

content_copy zoom_out_map
[edit]
user@host# set groups node0 security ike traceoptions file ikelog
user@host# set groups node0 security ike traceoptions file size 100m
user@host# set groups node0 security ike traceoptions flag all
user@host# set groups node0 security ike traceoptions level 15
user@host# set groups node0 security ike proposal IKE_PROP_PSK authentication-method pre-shared-keys
user@host# set groups node0 security ike proposal IKE_PROP_PSK dh-group group20
user@host# set groups node0 security ike proposal IKE_PROP_PSK authentication-algorithm sha-256
user@host# set groups node0 security ike proposal IKE_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node0 security ike policy IKE_POL_PSK proposals IKE_PROP_PSK
user@host# prompt groups node0 security ike policy IKE_POL_PSK pre-shared-key ascii-text
New ascii-text (secret): juniper
Retype new ascii-text (secret): juniper
user@host# set groups node0 security ike gateway S2S_GW ike-policy IKE_POL_PSK
user@host# set groups node0 security ike gateway S2S_GW version v2-only
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK protocol esp
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK authentication-algorithm hmac-sha1-96
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node0 security ipsec proposal IPSEC_PROP_PSK lifetime-seconds 200
user@host# set groups node0 security ipsec policy IPSEC_POL_PSK perfect-forward-secrecy keys group20
user@host# set groups node0 security ipsec policy IPSEC_POL_PSK proposal IPSEC_PROP_PSK
user@host# set groups node0 security ipsec vpn S2S_VPN ha-link-encryption
user@host# set groups node0 security ipsec vpn S2S_VPN ike gateway S2S_GW
user@host# set groups node0 security ipsec vpn S2S_VPN ike ipsec-policy IPSEC_POL_PSK
user@host# set groups node1 security ike traceoptions file ikelog
user@host# set groups node1 security ike traceoptions file size 100m
user@host# set groups node1 security ike traceoptions flag all
user@host# set groups node1 security ike traceoptions level 15
user@host# set groups node1 security ike proposal IKE_PROP_PSK authentication-method pre-shared-keys
user@host# set groups node1 security ike proposal IKE_PROP_PSK dh-group group20
user@host# set groups node1 security ike proposal IKE_PROP_PSK authentication-algorithm sha-256
user@host# set groups node1 security ike proposal IKE_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node1 security ike policy IKE_POL_PSK proposals IKE_PROP_PSK
user@host# prompt groups node1 security ike policy IKE_POL_PSK pre-shared-key ascii-text
New ascii-text(secret): juniper
Retype new ascii-text (secret): juniper
user@host# set groups node1 security ike gateway S2S_GW ike-policy IKE_POL_PSK
user@host# set groups node1 security ike gateway S2S_GW version v2-only
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK protocol esp
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK authentication-algorithm hmac-sha1-96
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK encryption-algorithm aes-256-cbc
user@host# set groups node1 security ipsec proposal IPSEC_PROP_PSK lifetime-seconds 200
user@host# set groups node1 security ipsec policy IPSEC_POL_PSK perfect-forward-secrecy keys group20
user@host# set groups node1 security ipsec policy IPSEC_POL_PSK proposals IPSEC_PROP_PSK
user@host# set groups node1 security ipsec vpn S2S_VPN ha-link-encryption
user@host# set groups node1 security ipsec vpn S2S_VPN ike gateway S2S_GW
user@host# set groups node1 security ipsec vpn S2S_VPN ike ipsec-policy IPSEC_POL_PSK
user@host# set groups global interfaces fab0 fabric-options member-interfaces ge-0/0/3
user@host# set groups global interfaces fab1 fabric-options member-interfaces ge-7/0/3
user@host# commit
user@host> request system reboot

arrow_backward PREVIOUS Understanding Cluster Mode

NEXT arrow_forward Configuring PKI Based L2HA Link Encryption

Common Criteria Guide for vSRX3.0

Configuring L2 HA Link Encryption tunnel

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry