Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Example: Configuring Group VPNs in Group VPNv2 on Routing Devices

Note:

Group VPNv2 is the name of the Group VPN technology on MX5, MX10, MX40, MX80, MX104, MX240, MX480, and MX960 routers. Group VPNv2 is different from the Group VPN technology implemented on SRX Security Gateways. The term Group VPN is sometimes used in this document to refer to the technology in general, not to the SRX technology.

This example shows how to configure Group VPNs in Group VPNv2 to extend the IP Security (IPsec) architecture to support group security associations (GSAs) that are shared by a group of routers.

Requirements

This example uses the following hardware and software components:

  • Two MX Series 5G Universal Routing Platforms with MS-MIC-16G or MS-MPC-PIC line cards

  • Reachability to one or more Cisco Group Controllers or Key Servers (GC/KS)

  • Junos OS Release 14.1 or later running on the MX Series routers

Before you begin:

  1. Configure the routers for network communication.

  2. Configure the Cisco GC/KS.

  3. Configure the group member device interfaces.

Overview

Starting with Junos OS Release 14.1, MX Series routers with MS-MIC-16G and MS-MPC-PIC line cards provide the Group VPNv2 member functionality support with one or more Cisco Group Controllers or Key Servers (GC/KS). The group members can connect to a maximum of four Cisco GC/KSs with minimum interoperability with the cooperative servers.

This feature also provides system logging support for Group VPNv2 functionality, and routing instance support for both control and data traffic.

Topology

In Figure 1, a Group VPN is configured between a Cisco group server, GC/KS – and two group members, GM1 and GM2. The group members are connected to host devices.

In Figure 2, a Group VPN is configured between GM1 and GM2, and GC/KS1 and GC/KS2 are the primary and secondary group servers, respectively.

Figure 1: Group VPN with Single GC/KSGroup VPN with Single GC/KS
Figure 2: Group VPN with Multiple GC/KSGroup VPN with Multiple GC/KS

Configuration

Configuring Group VPNv2 with a Single GC/KS

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then commit the configuration.

GM1

GM2

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure GM1:

  1. Configure the Router GM1 interfaces.

  2. Configure static routes to reach the group server and member 2.

  3. Define the IKE proposal.

  4. Configure the Phase 1 SA for ike-proposal.

  5. Define the IKE policy.

  6. Set the remote gateways for gw-group1.

  7. Configure the group identifier and IKE gateway for gw-group1.

  8. Configure the service set for gw-group1.

Results

From configuration mode, confirm your configuration by entering the show interfaces, show routing-options, show security, and show services commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

GM1

Configuring Group VPNv2 with Multiple GC/KS

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then commit the configuration.

GM1

GM2

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure GM1:

  1. Configure the Router GM1 interfaces.

  2. Configure static routes to reach the group server and member 2.

  3. Define the IKE proposal.

  4. Configure the Phase 1 SA for ike-proposal.

  5. Define the IKE policy.

  6. Set the remote gateways for gw-group1.

  7. Configure the group identifier and IKE gateway for gw-group1.

  8. Configure the service set for gw-group1.

Results

From configuration mode, confirm your configuration by entering the show interfaces, show routing-options, show security, and show services commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

GM1

Verification

Confirm that the configuration is working properly.

Verifying the Group Member IKE SA

Purpose

Verify the IKE SAs on Router GM1.

Action

From operational mode, run the show security group-vpn member ike security-associations detail command.

Meaning

Router GM1 has established the IKE SA with the GC/KS for the group.

Verifying the Group Member IPsec SA

Purpose

Verify the IPsec SAs on Router GM1.

Action

From operational mode, run the show security group-vpn member ipsec security-associations detail command.

Meaning

Router GM1 has established the IPsec SA with the GC/KS.

Verifying the Group Member IPsec Statistics

Purpose

Verify the IPsec statistics on Router GM1.

Action

From operational mode, run the show security group-vpn member ipsec statistics command.

Meaning

ESP Statistics shows that packet flows have been encrypted and decrypted between the group members. Router GM1 has encrypted 3 packets and has received 3 decrypted packets from Router GM2.

Troubleshooting

To troubleshoot the Group VPNv2 configuration, see:

Negotiating the IKE SA

Problem

The IKE SA negotiation is not triggered on the group member.

The output of the show ike and show security group-vpn member ike security-associations commands does not display the IKE negotiations.

Solution

To troubleshoot the IKE negotiation issue:

  1. Check if the service interface status is up.

    Use show interfaces terse | match ms to check if the MS interface is down. An MS interface goes down when the PIC is rebooting.

  2. Look for Ignore gvpn vpn_name since it is inactive in the log file /var/log/gkmd.

    Check if the Group VPN is referenced by any service set in the configuration.

    1. Enable security group-vpn member ike traceoptions.

    2. Look for the following system log messages in the trace log file:

      • Dec 2 16:09:54 GVPN:iked_pm_gvpn_trigger called for gvpn200

      • Dec 2 16:09:54 GVPN:PM NULL for gvpn gvpn200

      • Dec 2 16:09:54 GVPN:Ignore gvpn gvpn200 since it is inactive

This means either the service set is inactive or the service interface is down.

Establishing the IKE SA

Problem

The IKE SA is not getting established with the GC/KS.

In this scenario, the IKE SA state is down in the show security group-vpn member ike security-associations command output:

Solution

To troubleshoot the IKE SA issue:

  1. Check if the server address configured under [edit security group-vpn member ike gateway] is the correct one and is reachable.

  2. Use the ping command between the remote devices to check network connectivity.

  3. Check if the local address in the group-vpn configuration is also a configured address on any of the physical interfaces in the configuration.

  4. Check if the IKE proposals match between the group member and the GC/KS.

    If there is a misconfiguration on the IKE SA negotiation, then do the following:

    1. Enable security group-vpn member ike traceoption.

    2. Look for the following message in the trace log file: Dec 2 15:39:54 ikev2_fb_negotiation_done_isakmp: Entered IKE error code No proposal chosen (14), IKE SA 8dd7000 (neg 8dda800).

  5. Look for a No proposal chosen error in the log file /var/log/gkmd.

Downloading the GDOI IPsec SA

Problem

The GDOI IPsec SAs are not downloaded from the GC/KS.

In this scenario, the GDOI groupkey-pull with the configured GC/KS fails, and the show security group-vpn member ipsec sa command output does not display anything.

Solution

To troubleshoot the GDOI IPsec SA issue:

  1. Check if the IKE SA has been established with the GC/KS.

  2. Check if the group ID configured on the GC/KS and the group member match.

  3. Look for any group SA installation failures or other failures in the log file /var/log/gkmd.

    Look for the following syslog messages to confirm use of an unsupported GDOI SA algorithm:

    • Dec 2 15:32:49 simpleman gkmd[1701]: Failed to install SA because of unsupported algo(encr: 3des-cbc, auth : (null)) for SPI 0x6645cdb5 from server 192.0.2.1

    • Dec 2 15:32:49 simpleman gkmd[1701]: Member registration failed with key server 192.0.2.1 for group vpn gvpn200, reason SA unusable

    Look for the following syslog messages to confirm use of unsupported GDOI policies:

    • Dec 2 15:34:34 simpleman gkmd[1701]: Failed to install SA because of too many(2) policies for SPI 0x6951550c from server 192.0.2.1

    • Dec 2 15:34:34 simpleman gkmd[1701]: Member registration failed with key server 192.0.2.1 for group vpn gvpn200, reason SA unusable

Traffic Encryption and Decryption

Problem

The CLI shows IPsec SAs as installed, but traffic does not go through the SAs.

In this scenario, traffic matching the rules received from the server fails to get encrypted or decrypted. The show security group-vpn member ipsec statistics command output displays a zero value for encrypt and decrypt packet count.

Solution

Look for Rule lookup failures counter in the error section of the CLI output.

Troubleshooting System Log Messages

Problem

System log messages are generated to record the different Group VPNv2 events.

Solution

To interpret the system log messages, refer to the following:

  • Dec 2 15:29:10 simpleman gkmd[1701]: Member registration succeeded with key server 192.0.2.1 for group vpn gvpn200—GDOI pull was successful.

  • Dec 2 15:21:18 simpleman gkmd[1701]: Member registration failed with key server 192.0.2.1 for group vpn gvpn200, reason Timed out—GDOI pull failed.

  • Dec 2 15:34:34 simpleman gkmd[1701]: Failed to install SA because of too many(2) policies for SPI 0x6951550c from server 192.0.2.1—GDOI SA installation failed because of too many policies.

  • Dec 2 15:21:18 simpleman gkmd[1701]: Server 192.0.2.1 is unreachable for group vpn gvpn200—Single GC/KS failed (Non-COOP).

  • Dec 2 15:51:49 simpleman gkmd[1701]: Current key server 192.0.2.1 is unreachable and will try registering with next Key Server 192.1.1.2 for group vpn gvpn200—Particular GC/KS is not responding (COOP).

  • Dec 2 15:56:24 simpleman gkmd[1701]: All servers are unreachable for group vpn gvpn200—None of the GC/KS are responding (COOP).

  • Dec 2 16:01:43 simpleman gkmd[1701]: Member re-registering with Key Server 192.0.2.1 for group-vpn gvpn200—Member re-registration with the GC/KS.

  • Dec 2 16:01:43 simpleman gkmd[1701]: Creating TEK with SPI 0xb35200ac tunnel_id 10001 for group vpn gvpn200—GDOI SA TEK creation was successful.

  • Dec 2 16:29:01 simpleman gkmd[1701]: Deleting TEK with SPI 0x6dba2a76 tunnel_id 10001 for group vpn gvpn200 and reason cleared from CLI—GDOI SA TEK destroy was successful with reason.

    Different reasons for the GDOI SA TEK destroy are as follows:

    • Cleared from CLI

    • Hard lifetime expired

    • Too many TEKs

    • Configuration change

    • SA install error

    • Stale SA

    • Interface down

Related Documentation