SRX IPSec Tunnel Sample

SRX IPSec Tunnel Sample

root@SRX_Test# show | display set | no-more

set version 15.1X49-D90.7

set system host-name SRX_Test

set system root-authentication encrypted-password "$5$ZZrR8Xx5$ZPpG6X5ugNL7s0dHqj.URP4v6YhfzLqkDk3TrtfWHh8"

set system name-server 8.8.8.8

set system login user isd uid 2001

set system login user isd class super-user

set system login user isd authentication encrypted-password "$5$7i/tv6W2$eU0ilDNMbZQhZHff4gUFbtqTFIwigO3SiY8yqpD/.n0"

set security ike proposal IKE-PROPOSAL authentication-method pre-shared-keys

set security ike proposal IKE-PROPOSAL dh-group group5

set security ike proposal IKE-PROPOSAL authentication-algorithm sha1

set security ike proposal IKE-PROPOSAL encryption-algorithm 3des-cbc

set security ike proposal IKE-PROPOSAL lifetime-seconds 28800

set security ike policy IKE-POLICY mode main

set security ike policy IKE-POLICY proposals IKE-PROPOSAL

set security ike policy IKE-POLICY pre-shared-key ascii-text "$9$-nd4aJGiqPQdbmTQ3tp0BIhlM7Nbg4Z8L2aZU.mcylvNd"

set security ike gateway VPN-GATEWAY ike-policy IKE-POLICY

set security ike gateway VPN-GATEWAY address 10.1.2.201

set security ike gateway VPN-GATEWAY dead-peer-detection interval 10

set security ike gateway VPN-GATEWAY dead-peer-detection threshold 1

set security ike gateway VPN-GATEWAY nat-keepalive 10

set security ike gateway VPN-GATEWAY external-interface ge-0/0/0.0

set security ipsec proposal IPSEC-PROPOSAL protocol esp

set security ipsec proposal IPSEC-PROPOSAL authentication-algorithm hmac-sha1-96

set security ipsec proposal IPSEC-PROPOSAL encryption-algorithm 3des-cbc

set security ipsec proposal IPSEC-PROPOSAL lifetime-seconds 86400

set security ipsec policy IPSEC-POLICY perfect-forward-secrecy keys group5

set security ipsec policy IPSEC-POLICY proposals IPSEC-PROPOSAL

set security ipsec vpn IPSEC-VPN bind-interface st0.1

set security ipsec vpn IPSEC-VPN ike gateway VPN-GATEWAY

set security ipsec vpn IPSEC-VPN ike proxy-identity local 172.15.0.0/24

set security ipsec vpn IPSEC-VPN ike proxy-identity remote 172.15.1.0/24

set security ipsec vpn IPSEC-VPN ike proxy-identity service any

set security ipsec vpn IPSEC-VPN ike ipsec-policy IPSEC-POLICY

set security ipsec vpn IPSEC-VPN establish-tunnels immediately

set security flow tcp-mss ipsec-vpn mss 1350

set security nat source rule-set src-nat from zone trust

set security nat source rule-set src-nat to zone untrust

set security nat source rule-set src-nat rule r1 match source-address 0.0.0.0/0

set security nat source rule-set src-nat rule r1 then source-nat interface

set security forwarding-process enhanced-services-mode

set security policies from-zone trust to-zone untrust policy permit-all match source-address any

set security policies from-zone trust to-zone untrust policy permit-all match destination-address any

set security policies from-zone trust to-zone untrust policy permit-all match application any

set security policies from-zone trust to-zone untrust policy permit-all then permit

set security policies from-zone trust to-zone vpn policy permit-all match source-address any

set security policies from-zone trust to-zone vpn policy permit-all match destination-address any

set security policies from-zone trust to-zone vpn policy permit-all match application any

set security policies from-zone trust to-zone vpn policy permit-all then permit

set security policies from-zone vpn to-zone trust policy permit-all match source-address any

set security policies from-zone vpn to-zone trust policy permit-all match destination-address any

set security policies from-zone vpn to-zone trust policy permit-all match application any

set security policies from-zone vpn to-zone trust policy permit-all then permit

set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services all

set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services all

set security zones security-zone vpn interfaces st0.1

set interfaces ge-0/0/0 unit 0 family inet address 10.1.2.115/24

set interfaces ge-0/0/1 unit 0 family inet address 172.15.0.1/24

set interfaces st0 unit 1 family inet

set routing-options static route 0.0.0.0/0 next-hop 10.1.2.1

set routing-options static route 172.15.1.0/24 next-hop st0.1

[edit]

root@SRX_Test# run show security ike sa

Index State Initiator cookie Responder cookie Mode Remote Address

6299423 UP f51982a09b260851 3fcd24f6bec6f419 Main 10.1.2.201

6299424 UP 25885c239e958271 92d1dde980db90c8 Main 10.1.2.201

[edit]

root@SRX_Test# run show security ipsec sa

Total active tunnels: 1

ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway

<131073 ESP:3des/sha1 44d00f02 84435/unlim - root 500 10.1.2.201

>131073 ESP:3des/sha1 46f0dfb7 84435/unlim - root 500 10.1.2.201

[edit]

root@SRX_Test#

======================================================================================================================================================

FWF90D3Z13006231 # get vpn ipsec tunnel details

gateway

name: 'VPN-GW'

type: route-based

local-gateway: 10.1.2.201:0 (static)

remote-gateway: 10.1.2.115:0 (static)

mode: ike-v1

interface: 'wan1' (6)

rx packets: 0 bytes: 0 errors: 0

tx packets: 0 bytes: 0 errors: 7870

dpd: on-demand/negotiated idle: 20000ms retry: 3 count: 0

selectors

name: 'VPN-TUNNEL'

auto-negotiate: disable

mode: tunnel

src: 0:172.15.1.0/255.255.255.0:0

dst: 0:172.15.0.0/255.255.255.0:0

SA

lifetime/rekey: 86400/79426

mtu: 1446

tx-esp-seq: 1

replay: enabled

inbound

spi: 46f0dfb7

enc: 3des 6b1ddb0ba8c46a879e22dd055ae0c5b643983f4d68d72ff1

auth: sha1 ce45021dbfac556674600ff9cb08faf7d942d48f

outbound

spi: 44d00f02

enc: 3des aa81515e22c7e8eefce24d6ff740b1b3c4cec463d6dd15b5

auth: sha1 69dff90febd00f5d4e64637c73dec32527ddbba7

NPU acceleration: none

FWF90D3Z13006231 #

FWF90D3Z13006231 # get vpn ip tunnel summary

'VPN-GW' 10.1.2.115:0 selectors(total,up): 1/1 rx(pkt,err): 0/0 tx(pkt,err): 0/7902

FWF90D3Z13006231 # get ipsec tunnel list

NAME REMOTE-GW PROXY-ID-SOURCE PROXY-ID-DESTINATION STATUS TIMEOUT

VPN-GW 10.1.2.115:0 172.15.1.0/255.255.255.0 172.15.0.0/255.255.255.0 up 79367