close

keyboard_arrow_left

Table of Contents Expand all

play_arrow vSRX Virtual Firewall Deployment for KVM
- play_arrow Overview
  - Understand vSRX Virtual Firewall with KVM
  - Requirements for vSRX Virtual Firewall on KVM
- play_arrow Install vSRX Virtual Firewall in KVM
- play_arrow vSRX Virtual Firewall VM Management with KVM
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters on KVM
play_arrow vSRX Virtual Firewall Deployment for VMware
- play_arrow Overview
  - Understand vSRX Virtual Firewall with VMware
  - Requirements for vSRX Virtual Firewall on VMware
- play_arrow Install vSRX Virtual Firewall in VMware
- play_arrow vSRX Virtual Firewall VM Management with VMware
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters in VMware
play_arrow vSRX Virtual Firewall Deployment for Microsoft Hyper-V
- play_arrow Overview
  - Understand vSRX Virtual Firewall with Microsoft Hyper-V
  - Requirements for vSRX Virtual Firewall on Microsoft Hyper-V
- play_arrow Install vSRX Virtual Firewall in Microsoft Hyper-V
- play_arrow vSRX Virtual Firewall VM Management with Microsoft Hyper-V
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters
  - vSRX Virtual Firewall Cluster Staging and Provisioning in Hyper-V
  - Configure a vSRX Virtual Firewall Chassis Cluster in Junos OS
play_arrow vSRX Virtual Firewall Deployment for Contrail
- play_arrow Overview of vSRX Virtual Firewall Service Chains in Contrail
- play_arrow Install vSRX Virtual Firewall in Contrail
- play_arrow vSRX Virtual Firewall VM Management with Contrail
play_arrow vSRX Virtual Firewall Deployment for Nutanix
- play_arrow Overview
  - Understand vSRX Virtual Firewall Deployment with Nutanix
  - Requirements for vSRX Virtual Firewall on Nutanix
- play_arrow Install vSRX Virtual Firewall in Nutanix
  - Launch and Deploy vSRX Virtual Firewall in Nutanix AHV Cluster
  - Upgrade the Junos OS for vSRX Virtual Firewall Software Release
play_arrow vSRX Virtual Firewall Deployment for AWS
play_arrow vSRX Virtual Firewall Deployment for Microsoft Azure
- play_arrow Overview
  - Understand vSRX Virtual Firewall with Microsoft Azure Cloud
  - Requirements for vSRX Virtual Firewall on Microsoft Azure
- play_arrow Deploy vSRX Virtual Firewall from the Azure Portal
- play_arrow Deploy vSRX Virtual Firewall from the Azure CLI
  - Before You Deploy vSRX Virtual Firewall Using the Azure CLI
  - Deploy vSRX Virtual Firewall from the Azure CLI
- play_arrow Configure and Manage vSRX Virtual Firewall for Microsoft Azure
- play_arrow Configure Azure Features on vSRX Virtual Firewall and Use Cases
play_arrow vSRX Virtual Firewall Deployment for Google Cloud Platform
- play_arrow Overview
  - Understand vSRX Virtual Firewall Deployment with Google Cloud
  - Requirements for vSRX Virtual Firewall on Google Cloud Platform
- play_arrow Install vSRX Virtual Firewall in Google Cloud
play_arrow vSRX Virtual Firewall Deployment for IBM Cloud
- play_arrow Overview
- play_arrow Installing and Configuring vSRX Virtual Firewall in IBM
- play_arrow Managing vSRX Virtual Firewall in IBM Cloud
  - vSRX Virtual Firewall Configuration and Management Tools
  - Managing Security Policies for Virtual Machines Using Junos Space Security Director
- play_arrow Monitoring and Troubleshooting
  - Technical Support
play_arrow vSRX Virtual Firewall Deployment for OCI
- play_arrow Overview
  - Understanding vSRX Virtual Firewall Deployment in Oracle Cloud Infrastructure
  - Requirements for vSRX Virtual Firewall on Oracle Cloud Infrastructure
- play_arrow Installing vSRX Virtual Firewall in OCI
  - vSRX Virtual Firewall Deployment in Oracle Cloud Infrastructure
  - Upgrade the Junos OS for vSRX Virtual Firewall Software Release
- play_arrow vSRX Virtual Firewall Licensing
  - Licenses for vSRX Virtual Firewall

list Table of Contents

English

Example: Configure VPN on vSRX Virtual Firewall Between Amazon VPCs

date_range 27-May-23

arrow_backward

arrow_forward

This example shows how to configure IPsec VPN between two instances of vSRX Virtual Firewall on different Amazon VPCs.

Before You Begin

Ensure that you have installed and launched a vSRX Virtual Firewall instance in an Amazon VPCs.

See SRX Site-to-Site VPN Configuration Generator and How to troubleshoot a VPN tunnel that is down or not active for additional information.

Overview

You can use IPsec VPN to secure traffic between two Amazon VPCs using two vSRX Virtual Firewall instances.

Procedure

Step-by-Step Procedure

To configure IPsec VPN on vSRX1:

Set the IP addresses for vSRX1 revenue interfaces.

content_copy zoom_out_map
set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.10/24 
set interfaces ge-0/0/1 unit 0 family inet address 10.10.10.10/24 
set interfaces st0 unit 1 family inet address 10.0.250.10/24 

Set up the untrust security zone.

content_copy zoom_out_map
set security zones security-zone untrust screen untrust-screen
set security zones security-zone untrust host-inbound-traffic system-services https 
set security zones security-zone untrust host-inbound-traffic system-services ssh 
set security security-zone untrust interfaces ge-0/0/0.0 
set security security-zone untrust interfaces st0.1 

Set up the trust security zone.

content_copy zoom_out_map
set security zone trust host-inbound-traffic system-services https 
set security zone trust host-inbound-traffic system-services ssh 
set security zone trust host-inbound-traffic system-services ping 
set security security-zone trust interfaces ge-0/0/1.0 

Configure IKE.

content_copy zoom_out_map
set security ike proposal AWS_IKE_Proposal authentication-method pre-shared-keys  
set security ike proposal AWS_IKE_Proposal dh-group group2 
set security ike proposal AWS_IKE_Proposal authentication-algorithm sha-256 
set security ike proposal AWS_IKE_Proposal encryption-algorithm aes-256-cbc  
set security ike proposal AWS_IKE_Proposal lifetime-seconds 1800
set security ike policy AWS-R mode aggressive
set security ike policy AWS-R proposals AWS_IKE_Proposal
set security ike policy AWS-R pre-shared-key ascii-text preshared-key
set security ike gateway AWS-R ike-policy AWS-R
set security ike gateway AWS-R address 198.51.100.10
set security ike gateway AWS-R local-identity user-at-hostname "source@example.net"
set security ike gateway AWS-R remote-identity user-at-hostname "dest@example.net"
set security ike gateway AWS-R external-interface ge-0/0/0

Configure IPsec.

content_copy zoom_out_map
set security ipsec proposal AWS_IPSEC protocol esp 
set security ipsec proposal AWS_IPSEC authentication-algorithm hmac-sha1-96
set security ipsec proposal AWS_IPSEC encryption-algorithm aes-256-cbc
set security ipsec policy AWS_IPSEC_POL proposals AWS_IPSEC
set security ipsec vpn aws-aws bind-interface st0.1 
set security ipsec vpn aws-aws ike gateway AWS-R 
set security ipsec vpn aws-aws ike ipsec-policy AWS_IPSEC_POL 
set security ipsec vpn aws-aws establish-tunnels immediately

Configure routing.

content_copy zoom_out_map
set routing-instances aws instance-type virtual-router 
set routing-instances aws interface ge-0/0/0.0 
set routing-instances aws interface ge-0/0/1.0 
set routing-instances aws interface st0.1 
set routing-instances aws routing-options static route 0.0.0.0/0 next-hop 10.0.0.1 
set routing-instances aws routing-options static route 10.20.20.0/24 next-hop st0.1
commit

vSRX2 VPN Configuration

Step-by-Step Procedure

To configure IPsec VPN on vSRX2:

Set the IP addresses for the vSRX2 revenue interfaces.

content_copy zoom_out_map
set interfaces ge-0/0/0 unit 0 family inet address 10.1.0.10/24 
set interfaces ge-0/0/1 unit 0 family inet address 10.20.20.10/24 
set interfaces st0 unit 1 family inet address 10.0.250.20/24 

Set up the untrust security zone.

content_copy zoom_out_map
set security zones security-zone untrust screen untrust-screen
set security zones security-zone untrust host-inbound-traffic system-services https 
set security zones security-zone untrust host-inbound-traffic system-services ssh 
set security zones security-zone untrust interfaces ge-0/0/0.0 
set security zones security-zone untrust interfaces st0.1 

Set up the trust security zone.

content_copy zoom_out_map
set security zones security-zone trust host-inbound-traffic system-services https 
set security zones security-zone trust host-inbound-traffic system-services ssh 
set security zones security-zone trust host-inbound-traffic system-services ping 
set security zones security-zone trust interfaces ge-0/0/1.0 

Configure IKE.

content_copy zoom_out_map
set security ike proposal AWS_IKE_Proposal authentication-method pre-shared-keys  
set security ike proposal AWS_IKE_Proposal dh-group group2 
set security ike proposal AWS_IKE_Proposal authentication-algorithm sha-256 
set security ike proposal AWS_IKE_Proposal encryption-algorithm aes-256-cbc  
set security ike proposal AWS_IKE_Proposal lifetime-seconds 1800
set security ike policy AWS-R mode aggressive
set security ike policy AWS-R proposals AWS_IKE_Proposal
set security ike policy AWS-R pre-shared-key ascii-text preshared-key
set security ike gateway AWS-R ike-policy AWS-R
set security ike gateway AWS-R address 203.0.113.10
set security ike gateway AWS-R local-identity user-at-hostname "dest@example.net"
set security ike gateway AWS-R remote-identity user-at-hostname "source@example.net"
set security ike gateway AWS-R external-interface ge-0/0/0

Configure IPsec.

content_copy zoom_out_map
set security ipsec proposal AWS_IPSEC protocol esp 
set security ipsec proposal AWS_IPSEC authentication-algorithm hmac-sha1-96
set security ipsec proposal AWS_IPSEC encryption-algorithm aes-256-cbc
set security ipsec policy AWS_IPSEC_POL proposals AWS_IPSEC
set security ipsec vpn aws-aws bind-interface st0.1 
set security ipsec vpn aws-aws ike gateway AWS-R 
set security ipsec vpn aws-aws ike ipsec-policy AWS_IPSEC_POL 
set security ipsec vpn aws-aws establish-tunnels immediately

Configure routing.

content_copy zoom_out_map
set routing-instances aws instance-type virtual-router 
set routing-instances aws interface ge-0/0/0.0 
set routing-instances aws interface ge-0/0/1.0 
set routing-instances aws interface st0.1 
set routing-instances aws routing-options static route 0.0.0.0/0 next-hop 10.0.0.1 
set routing-instances aws routing-options static route 10.10.10.0/24 next-hop st0.1
commit

Verification

Verify Active VPN Tunnels

Purpose
Action

Purpose

Verify that the tunnel is up on both vSRX Virtual Firewall instances on AWS.

Action

content_copy zoom_out_map
ec2-user@> show security ipsec security-associations

content_copy zoom_out_map
Total active tunnels: 1
ID      Algorithm                 SPI      Life:sec/kb    Mon lsys Port  Gateway
<131074 ESP:aes-­‐cbc-­‐256/sha1 de836105 1504/ unlim -­‐ root 4500 52.200.89.XXX
>131074 ESP:aes-­‐cbc-­‐256/sha1 b349bc84 1504/ unlim -­‐ root 4500 52.200.89.XXX

Note:

Starting in Junos OS Release 17.4R1, the default user name has changed from root@ to ec2-user@.

arrow_backward PREVIOUS Example: Configuring NAT for vSRX Virtual Firewall

NEXT arrow_forward Example: Configure Juniper ATP Cloud for vSRX Virtual Firewall

vSRX Virtual Firewall Deployment Guide for Private and Public Cloud Platforms

ON THIS PAGE

Example: Configure VPN on vSRX Virtual Firewall Between Amazon VPCs

Before You Begin

Overview

vSRX1 VPN Configuration

Procedure

Step-by-Step Procedure

vSRX2 VPN Configuration

Step-by-Step Procedure

Verification

Verify Active VPN Tunnels

Purpose

Action

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

vSRX Virtual Firewall Deployment Guide for Private and Public Cloud Platforms

ON THIS PAGE

Example: Configure VPN on vSRX Virtual Firewall Between Amazon VPCs

Before You Begin

Overview

vSRX1 VPN Configuration

Procedure

Step-by-Step Procedure

vSRX2 VPN Configuration

Step-by-Step Procedure

Verification

Verify Active VPN Tunnels

Purpose

Action

Related Documentation

Stay in touch