close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Common Configuration for All VPNs
- play_arrow VPNs Overview
- play_arrow Assigning Routing Instances to VPNs
- play_arrow Distributing Routes in VPNs
- play_arrow Distributing VPN Routes with Target Filtering
- play_arrow Configuring Forwarding Options for VPNs
  - Chained Composite Next Hops for VPNs and Layer 2 Circuits
  - Example: Configuring Chained Composite Next Hops for Direct PE-PE Connections in VPNs
- play_arrow Configuring Graceful Restart for VPNs
- play_arrow Configuring Class of Service for VPNs
  - VPNs and Class of Service
  - Rewriting Class of Service Markers and VPNs
- play_arrow Pinging VPNs
play_arrow Common Configuration for Layer 2 VPNs and VPLS
- play_arrow Overview
- play_arrow Layer 2 VPNs Configuration Overview
- play_arrow Configuring Layer 2 Interfaces
- play_arrow Configuring Path Selection for Layer 2 VPNs and VPLS
  - Understanding BGP Path Selection
  - Enabling BGP Path Selection for Layer 2 VPNs and VPLS
- play_arrow Creating Backup Connections with Redundant Pseudowires
  - Redundant Pseudowires for Layer 2 Circuits and VPLS
  - Configuring Redundant Pseudowires for Layer 2 Circuits and VPLS
- play_arrow Configuring Class of Service for Layer 2 VPNs
  - Configuring Traffic Policing in Layer 2 VPNs
- play_arrow Monitoring Layer 2 VPNs
play_arrow Configuring Group VPNs
- play_arrow Configuring Group VPNv2
play_arrow Configuring Public Key Infrastructure
- play_arrow Configuring Digital Certificate Validation
  - Understanding Digital Certificate Validation
  - Example: Improving Digital Certificate Validation by Configuring Policy OIDs on an MX Series Device
- play_arrow Configuring a Device for Certificate Chains
  - IKE Authentication (Certificate-Based Authentication)
  - Example: Configuring a Device for Peer Certificate Chain Validation
- play_arrow Managing Certificate Revocation
  - Online Certificate Status Protocol and Certificate Revocation Lists
  - Example: Improving Security by Configuring OCSP for Certificate Revocation Status
play_arrow Configuring Layer 2 Circuits
- play_arrow Overview
  - Layer 2 Circuit Overview
- play_arrow Layer 2 Circuits Configuration Overview
- play_arrow Configuring Class of Service with Layer 2 Circuits
- play_arrow Configuring Pseudowire Redundancy for Layer 2 Circuits
- play_arrow Configuring Load Balancing for Layer 2 Circuits
  - Reducing APS Switchover Time in Layer 2 Circuits
- play_arrow Configuring Protection Features for Layer 2 Circuits
- play_arrow Monitoring Layer 2 Circuits with BFD
  - Configuring BFD for VCCV for Layer 2 Circuits
  - Example: Configuring BFD for VCCV for Layer 2 Circuits
- play_arrow Troubleshooting Layer 2 Circuits
  - Tracing Layer 2 Circuit Operations
play_arrow Configuring VPWS VPNs
- play_arrow Overview
- play_arrow Configuring VPWS VPNs
play_arrow Configuring VPLS
play_arrow Connecting Layer 2 VPNs and Circuits to Other VPNs
- play_arrow Connecting Layer 2 VPNs to Other VPNs
- play_arrow Connecting Layer 2 Circuits to Other VPNs
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

keyboard_arrow_right

Configuring Group VPNs in Group VPNv2 on Routing Devices

date_range 23-Nov-23

arrow_backward

arrow_forward

You can configure an MX Series router with MS-MIC-16G and MS-MPC-PIC line cards to provide the Group VPNv2 member functionality support with one or more Cisco group controllers or key servers (GC/KSs). The group members can connect to a maximum of four Cisco GC/KSs with minimum interoperability with the cooperative servers.

The Group VPNv2 feature also provides system logging support for the Group VPNv2 functionality, and routing instance support for both control and data traffic.

Before you begin:

Configure the routers for network communication.
Configure the Cisco GC/KS.
Configure the group member device interfaces.
Configure a static route to reach the group server.

To configure a Group VPNv2 member, complete the following tasks:

In configuration mode, go to the following hierarchy level:
```
[edit]
user@GM1# edit security
```

Define the IKE proposal.

content_copy zoom_out_map
[edit security]
user@GM1# set group-vpn member ike proposal proposal-name

Configure the Phase 1 SA for the IKE proposal.

content_copy zoom_out_map
[edit security]
user@GM1# set group-vpn member ike proposal proposal-name  authentication-method pre-shared-keys
user@GM1# set group-vpn member ike proposal proposal-name dh-group group
user@GM1# set group-vpn member ike proposal proposal-name authentication-algorithm sha1
user@GM1# set group-vpn member ike proposal proposal-name encryption-algorithm 3des-cbc

Define the IKE policy.

content_copy zoom_out_map
[edit security]
user@GM1# set group-vpn member ike policy policy-name mode main
user@GM1# set group-vpn member ike policy policy-name proposals proposal-name
user@GM1# set group-vpn member ike policy policy-name pre-shared-key ascii-text text

Set the remote gateways for the IKE gateway group.

content_copy zoom_out_map
[edit security]
user@GM1# set group-vpn member ike gateway gateway-group-name ike-policy policy-name
user@GM1# set group-vpn member ike gateway gateway-group-name server-address server-IP-address
user@GM1# set group-vpn member ike gateway gateway-group-name local-address server-facing-interface-IP-address

Note:

To configure a group member to connect to multiple group servers, add the IP address of all the servers to the remote IKE gateway group configuration.

For example,

content_copy zoom_out_map
[edit security]
user@GM1# set group-vpn member ike gateway gw-group1 server-address 203.0.113.0
user@GM1# set group-vpn member ike gateway gw-group1 server-address 203.0.113.1

Configure the group identifier and IKE gateway for the remote gateway group.

content_copy zoom_out_map
[edit security]
user@GM1# set group-vpn member ipsec vpn vpn-name ike-gateway gateway-group-name
user@GM1# set group-vpn member ipsec vpn vpn-name group group-ID
user@GM1# set group-vpn member ipsec vpn vpn-name match-direction output

In configuration mode, go to the following hierarchy level:
```
[edit]
user@GM1# edit services
```

Configure the service set for the remote gateway group.

content_copy zoom_out_map
[edit services]
user@GM1# set service-set service-set-name interface-service service-interface service-interface
user@GM1# set service-set service-set-name ipsec-group-vpn vpn-name

Note:

The service set has to be applied on the interface connecting to the other group member.

For example:

content_copy zoom_out_map
[edit interfaces]
user@GM1# set xe-0/3/1 unit 1 family inet service input service-set gvpn-service-set
user@GM1# set xe-0/3/1 unit 1 family inet service output service-set gvpn-service-set

Verify and commit the configuration.

For example:

content_copy zoom_out_map
[edit security]
user@GM1# set group-vpn member ike proposal ike-proposal  authentication-method pre-shared-keys
user@GM1# set group-vpn member ike proposal ike-proposal  dh-group group2
user@GM1# set group-vpn member ike proposal ike-proposal  authentication-algorithm sha1
user@GM1# set group-vpn member ike proposal ike-proposal  encryption-algorithm 3des-cbc
user@GM1# set group-vpn member ike policy ike-policy  mode main
user@GM1# set group-vpn member ike policy ike-policy proposals ike-proposal
user@GM1# set group-vpn member ike policy ike-policy pre-shared-key ascii-text ""$9$QEni3/t1RSM87uO87-V4oz36"
user@GM1# set group-vpn member ike gateway gw-group1 ike-policy ike-policy
user@GM1# set group-vpn member ike gateway gw-group1 server-address 203.0.113.0
user@GM1# set group-vpn member ike gateway gw-group1 local-address 192.0.2.0
user@GM1# set group-vpn member ipsec vpn vpn-group1 ike-gateway gw-group1
user@GM1# set group-vpn member ipsec vpn vpn-group1 group 1
user@GM1# set group-vpn member ipsec vpn vpn-group1 match-direction output

content_copy zoom_out_map
[edit services]
user@GM1# set service-set gvpn-service-set interface-service service-interface ms-4/0/0.1
user@GM1# set service-set gvpn-service-set ipsec-group-vpn vpn-group1

content_copy zoom_out_map
[edit]
user@GM1# commit
commit complete

arrow_backward PREVIOUS Group VPNv2 Overview

NEXT arrow_forward Group VPN on AMS interfaces

Layer 2 VPNs and VPLS User Guide for Routing Devices

Configuring Group VPNs in Group VPNv2 on Routing Devices

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Layer 2 VPNs and VPLS User Guide for Routing Devices

Configuring Group VPNs in Group VPNv2 on Routing Devices

Related Documentation

Stay in touch