- play_arrow CSDS Architecture Overview
- play_arrow CSDS Deployment Overview
- play_arrow CSDS Deployment Scenarios and Topologies
- Deployment Scenarios and Topologies
- CSDS Dual MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Multinode HA)
- CSDS Single MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Standalone)
- CSDS Single MX Series (CSDS Traffic Orchestrator) and Scaled-Out SRX Series Firewalls (MNHA)
- CSDS Dual MX Series (CSDS Traffic Orchestrator) and Scaled-Out SRX Series Firewalls (MNHA)
- play_arrow ECMP-Based Consistent Hashing in CSDS
- How CSDS Works with ECMP Based Consistent Hashing
- IPsec VPN Traffic Flow in Single MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Standalone)
- NAT Traffic Flow in Single MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Standalone)
- Stateful Firewall Traffic Flow in Single MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Standalone)
- Stateful Firewall and NAT Traffic Flow in Dual MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Multinode HA)
- play_arrow Unified Management with JNU in CSDS
- play_arrow vSRX Orchestration with JDM in CSDS
- play_arrow Configure CSDS
- Example: Single MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Standalone) for IPsec VPN
- Example: Single MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Standalone) for NAT and Stateful Firewall
- Example: Dual MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Multinode HA) for NAT and Stateful Firewall
- Example: Single MX Series (CSDS Traffic Orchestrator) and Scaled-Out SRX Series Firewall (MNHA) for Stateful Firewall
- Configure Junos Node Unifier for CSDS
- Install and Configure Junos Device Manager for CSDS
IPsec VPN Traffic Flow in Single MX Series (CSDS Traffic Orchestrator) and Scaled-Out SRX Series Firewalls
In this topic, you’ll see how IPsec traffic flows in a single MX Series with CSDS Traffic Orchestrator and SRX Series Firewalls.
In this topology:
- Configure a single MX Series with two interfaces for the IPSEC VR and INTERNET routing instances. MX Series CSDS Traffic Orchestrator (CSDS-TO) does health check on all the scaled-out SRX Series Firewalls and builds the next-hop for load balancing the traffic.
- Connect all the scaled-out SRX Series Firewalls to the MX Series with BGP connections.
Configure the MX Series with CSDS-TO on the IPSEC VR routing instance to perform the load balancing of data traffic coming from client-side gateway router towards the scaled-out SRX Series Firewalls.
Configure unique IKE proposal, IKE policy, IPsec proposal, and IPsec policy per MNHA pair.
Configure unique IP addresses for all the scaled-out SRX Series Firewalls connected to MX Series that is used by CSDS-TO to perform the health check and build up the selector table in the PFE. PFE uses this selector table to load balance the packet across the available next-hops. This health check is reachable through the BGP connection. The anycast IP address used for the IKE endpoint is reachable through this unique IP address on each SRX Series Firewalls.
- Configure all the scaled-out SRX Series Firewalls for AutoVPN with same anycast IP address as the IKE endpoint. All SRX Series Firewalls are in IPsec VPN responder-only mode..
- IPsec VPN clients initiated behind the MX Series use the same SRX Series Firewall’s IKE endpoint with unique traffic-selectors. The SRX Series Firewalls use the traffic-selector to install unique Auto Route Insertion (ARI) routes to invite the data return traffic to the right IPsec VPN tunnel from the server.
Configure the MX Series with CSDS-TO on the IPsec VPN VR routing instance to perform the load balancing of IKE traffic coming from MX Series router towards the scaled-out SRX Series Firewalls.
Figure 1 illustrates the step-by-step traffic flow.
The MX Series is a single router configured with multiple logical interfaces towards scaled-out SRX Series Firewalls on the IPSEC VR and INTERNET VR direction.
Filter-based forwarding based on IKE destination IP address match is used in MX Series router to push IPsec VPN traffic to the CSDS-TO IPsec forwarding instance. CSDS-TO forwarding instance includes a default route with next-hop as list of SRX Series Firewalls. CSDS-TO installs this default route when the health check passes for at least one SRX Series Firewalls.
CSDS-TO performs source-based hash load balancing across all the available SRX Series Firewall next-hop devices.
Load balanced IPsec VPN tunnel sessions are anchored on any available SRX Series Firewalls and installs the ARI route.
The packets get decrypted, and the clear text packets are routed to reach the server through the MX Series over the INTERNET routing instance. MX Series routes the packet to the server.
For the return traffic coming from server to client on the MX Series INTERNET routing instance, unique ARI routes are used to route the traffic back to same SRX Series Firewalls where the IPsec VPN tunnel is anchored.
SRX Series Firewalls use the same IPsec VPN tunnel session to encrypt the packet and route the IPsec VPN traffic towards MX Series on the IPsec VPN VR direction.
MX Series routes the IPsec VPN traffic back to IPsec VPN Initiators.
For more information, see Scale-Out IPsec Solution for Enterprises — Juniper Validated Design (JVD), and Scale-Out IPsec Solution for Mobile Service Providers — Juniper Validated Design (JVD).
