Overview of VPNEP
This Extended Package (EP) describes security requirements for a VPN Gateway. This is defined to be a device at the edge of a private network that terminates an IPsec tunnel, which provides device authentication, confidentiality, and integrity of information traversing a public or untrusted network. The EP is intended to provide a minimal, baseline set of requirements that are targeted at mitigating well defined and described threats to VPN Gateway technology. However, this EP is not complete in itself, but rather extends the collaborative Protection Profile for Network Devices (NDcPPv2) and the collaborative Protection Profile for Stateful Traffic Filter Firewalls (FWcPP). This introduction will describe the features of a compliant Target of Evaluation (TOE), and will also discuss how this EP is to be used in conjunction with the NDcPPv2 and/or FWcPP
Configuring IPsec VPN Extended Package (EP)
In this section, you configure devices running Junos OS for IPsec VPN using a preshared key as the IKE authentication method.
To configure the IPsec VPN with preshared key IKE authentication on the initiator:
- Configure the IPsec rule on R0.[edit]security-administrator@host:fips# set services service-set ipsec_ss_ms_4_0_0_1 next-hop-service inside-service-interface ms-4/0/0.1security-administrator@host:fips# set services service-set ipsec_ss_ms_4_0_0_1 next-hop-service outside-service-interface ms-4/0/0.2security-administrator@host:fips# set services service-set ipsec_ss_ms_4_0_0_1 ipsec-vpn-options local-gateway 20.1.1.1security-administrator@host:fips# set services service-set ipsec_ss_ms_4_0_0_1 ipsec-vpn-rules vpn_rule_ms_4_0_0_1security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_4_0_0_1 term term1 from source-address 10.1.1.0/24security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_4_0_0_1 term term1 from destination-address 40.1.1.0/24security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_4_0_0_1 term term1 then remote-gateway 30.1.1.2security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_4_0_0_1 term term1 then dynamic ike-policy ike_policy_ms_4_0_0_1security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_4_0_0_1 term term1 then dynamic ipsec-policy ipsec_policy_ms_4_0_0_1security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_4_0_0_1 term term1 then anti-replay-window-size 4096security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_4_0_0_1 match-direction inputsecurity-administrator@host:fips# set services ipsec-vpn ipsec proposal ipsec_proposal_ms_4_0_0_1 protocol espsecurity-administrator@host:fips# set services ipsec-vpn ipsec proposal ipsec_proposal_ms_4_0_0_1 encryption-algorithm aes-192-cbcsecurity-administrator@host:fips# set services ipsec-vpn ipsec proposal ipsec_proposal_ms_4_0_0_1 lifetime-seconds 7200security-administrator@host:fips# set services ipsec-vpn ipsec policy ipsec_policy_ms_4_0_0_1 perfect-forward-secrecy keys group20security-administrator@host:fips# set services ipsec-vpn ipsec policy ipsec_policy_ms_4_0_0_1 proposals ipsec_proposal_ms_4_0_0_1security-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_4_0_0_1 authentication-method pre-shared-keyssecurity-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_4_0_0_1 lifetime-seconds 7200security-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_4_0_0_1 dh-group group20security-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_4_0_0_1 encryption-algorithm aes-192-cbcsecurity-administrator@host:fips# set services ipsec-vpn ike policy ike_policy_ms_4_0_0_1 version 2security-administrator@host:fips# set services ipsec-vpn ike policy ike_policy_ms_4_0_0_1 proposals ike_proposal_ms_4_0_0_1security-administrator@host:fips# prompt services ipsec-vpn ike policy ike_policy_ms_4_0_0_1 pre-shared-key ascii-textNew ascii-text (secret):Retype new ascii-text (secret):In FIPS mode, use prompt command for setting pre-shared-key. Type-in pre-shared-key in ASCII format when prompted for secret as below:security-administrator@host:fips# prompt services ipsec-vpn ike policy ike_policy_ms_4_0_0_1 pre-shared-key ascii-textNew ascii-text (secret): xxxxxxxxRetype new ascii-text (secret):xxxxxxxxsecurity-administrator@host:fips# set services ipsec-vpn traceoptions file ipsec_log1security-administrator@host:fips# set services ipsec-vpn traceoptions level allsecurity-administrator@host:fips# set services ipsec-vpn traceoptions flag allsecurity-administrator@host:fips# set services ipsec-vpn establish-tunnels immediately
- Configure Routing options on R0.[edit]security-administrator@host:fips# set routing-options static route 40.1.1.0/24 next-hop ms-4/0/0.security-administrator@host:fips# set routing-options static route 10.1.1.0/24 next-hop 10.1.1.2security-administrator@host:fips# set routing-options static route 30.1.1.0/24 next-hop 20.1.1.2
- Configure Interfaces on R0.[edit]security-administrator@host:fips# set interfaces ms-4/0/0 unit 0 family inetsecurity-administrator@host:fips# set interfaces ms-4/0/0 unit 1 family inetsecurity-administrator@host:fips# set interfaces ms-4/0/0 unit 1 family inet6security-administrator@host:fips# set interfaces ms-4/0/0 unit 1 service-domain insidesecurity-administrator@host:fips# set interfaces ms-4/0/0 unit 2 family inetsecurity-administrator@host:fips# set interfaces ms-4/0/0 unit 2 family inet6security-administrator@host:fips# set interfaces ms-4/0/0 unit 2 service-domain outsidesecurity-administrator@host:fips# set interfaces ge-7/0/1 unit 0 family inet address 10.1.1.2/24security-administrator@host:fips# set interfaces ge-7/0/3 unit 0 family inet address 20.1.1.1/24
- Configure Interfaces on R1.[edit]security-administrator@host:fips# set interfaces ge-2/1/2 unit 0 family inet address 20.1.1.2/24security-administrator@host:fips# set interfaces ge-2/1/3 unit 0 family inet address 30.1.1.1/24
- Configure the IPsec rule on R2.[edit]security-administrator@host:fips# set services service-set ipsec_ss_ms_3_0_0_1 next-hop-service inside-service-interface ms-3/0/0.1security-administrator@host:fips# set services service-set ipsec_ss_ms_3_0_0_1 next-hop-service outside-service-interface m s-3/0/0.2security-administrator@host:fips# set services service-set ipsec_ss_ms_3_0_0_1 ipsec-vpn-options local-gateway 30.1.1.2security-administrator@host:fips# set services service-set ipsec_ss_ms_3_0_0_1 ipsec-vpn-rules vpn_rule_ms_3_0_0_1security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_3_0_0_1 term term1 from source-address 40.1.1.0/24security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_3_0_0_1 term term1 from destination-address 10.1.1.0/24security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_3_0_0_1 term term1 then remote-gateway 20.1.1.1security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_3_0_0_1 term term1 then dynamic ike-policy ike_policy_ms_3_0_0_1security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_3_0_0_1 term term1 then dynamic ipsec-policy ipsec_policy_ms_3_0_0_1security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_3_0_0_1 term term1 then anti-replay-window-size 4096security-administrator@host:fips# set services ipsec-vpn rule vpn_rule_ms_3_0_0_1 match-direction input[edit]security-administrator@host:fips# set services ipsec-vpn ipsec proposal ipsec_proposal_ms_3_0_0_1 protocol espsecurity-administrator@host:fips# set services ipsec-vpn ipsec proposal ipsec_proposal_ms_3_0_0_1 encryption-algorithm aes-192-cbcsecurity-administrator@host:fips# set services ipsec-vpn ipsec proposal ipsec_proposal_ms_3_0_0_1 lifetime-seconds 7200security-administrator@host:fips# set services ipsec-vpn ipsec policy ipsec_policy_ms_3_0_0_1 perfect-forward-secrecy keys group20security-administrator@host:fips# set services ipsec-vpn ipsec policy ipsec_policy_ms_3_0_0_1 proposals ipsec_proposal_ms_3_0_0_1security-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_3_0_0_1 authentication-method pre-shared-keyssecurity-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_3_0_0_1 lifetime-seconds 7200security-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_3_0_0_1 dh-group group20security-administrator@host:fips# set services ipsec-vpn ike proposal ike_proposal_ms_3_0_0_1 encryption-algorithm aes-192-cbcsecurity-administrator@host:fips# set services ipsec-vpn ike policy ike_policy_ms_3_0_0_1 version 2security-administrator@host:fips# set services ipsec-vpn ike policy ike_policy_ms_3_0_0_1 proposals ike_proposal_ms_3_0_0_1security-administrator@host:fips# prompt services ipsec-vpn ike policy ike_policy_ms_4_0_0_1 pre-shared-key ascii-textNew ascii-text (secret):Retype new ascii-text (secret):In FIPS mode, use prompt command for setting pre-shared-key. Type-in pre-shared-key in ASCII format when prompted for secret as below:security-administrator@host:fips# prompt services ipsec-vpn ike policy ike_policy_ms_4_0_0_1 pre-shared-key ascii-textNew ascii-text (secret): xxxxxxxxRetype new ascii-text (secret):xxxxxxxxsecurity-administrator@host:fips# set services ipsec-vpn traceoptions file ipsec_log1security-administrator@host:fips# set services ipsec-vpn traceoptions level allsecurity-administrator@host:fips# set services ipsec-vpn traceoptions flag allsecurity-administrator@host:fips# set services ipsec-vpn establish-tunnels immediately
- Configure Routing options on R2.[edit]security-administrator@host:fips# set routing-options static route 10.1.1.0/24 next-hop ms-3/0/0.1.security-administrator@host:fips# set routing-options static route 40.1.1.0/24 next-hop 40.1.1.1security-administrator@host:fips# set routing-options static route 20.1.1.0/24 next-hop 30.1.1.1
- Configure interfaces on R2.[edit]security-administrator@host:fips# set interfaces ge-0/0/1 unit 0 family inet address 30.1.1.2/24.security-administrator@host:fips# set interfaces ge-0/0/4 unit 0 family inet address 40.1.1.1/24security-administrator@host:fips# set interfaces ms-3/0/0 unit 0 family inetsecurity-administrator@host:fips# set interfaces ms-3/0/0 unit 1 family inetsecurity-administrator@host:fips# set interfaces ms-3/0/0 unit 1 family inet6security-administrator@host:fips# set interfaces ms-3/0/0 unit 1 service-domain insidesecurity-administrator@host:fips# set interfaces ms-3/0/0 unit 2 family inetsecurity-administrator@host:fips# set interfaces ms-3/0/0 unit 2 family inet6security-administrator@host:fips# set interfaces ms-3/0/0 unit 2 service-domain outside
Sample output for IPsec VPN:
security-administrator@host:fips>show services
ipsec-vpn ike security-associationsRemote Address State Initiator cookie Responder cookie Exchange type 30.1.1.2 Matured be51a9075821ab2a 26887fa8c98a9f45 IKEv2
security-administrator@host:fips>show services
ipsec-vpn ipsec security-associations Service set: ipsec_ss_ms_4_0_0_1, IKE Routing-instance: default
Rule: vpn_rule_ms_4_0_0_1, Term: term1, Tunnel index: 1
Local gateway: 20.1.1.1, Remote gateway: 30.1.1.2
IPSec inside interface: ms-4/0/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
NATT Detection: Not Detected, NATT keepalive interval: 0
Direction SPI AUX-SPI Mode Type Protocol
inbound 3602080831 0 tunnel dynamic ESP
outbound 2594649153 0 tunnel dynamic ESPSupported encryption algorithms for IPsec:
aes-128-cbc AES-CBC 128-bit encryption algorithm aes-128-gcm AES-GCM 128-bit encryption algorithm with 16 octet ICV aes-192-cbc AES-CBC 192-bit encryption algorithm aes-192-gcm AES-GCM 192-bit encryption algorithm with 16 octet ICV aes-256-cbc AES-CBC 256-bit encryption algorithm aes-256-gcm AES-GCM 256-bit encryption algorithm with 16 octet ICV
Supported encryption algorithms for IKE:
aes-128-cbc AES-CBC 128-bit encryption algorithm aes-192-cbc AES-CBC 192-bit encryption algorithm aes-256-cbc AES-CBC 256-bit encryption algorithm
IKE DH groups supported:
group14 Diffie-Hellman Group14 group19 Diffie-Hellman Group19 group20 Diffie-Hellman Group20
IPsec authentication algorithm:
hmac-sha256-128 HMAC-SHA256-128 authentication algorithm
IKE authentication algorithms:
sha256 SHA 256-bit authentication algorithm sha-384 SHA 384-bit authentication algorithm sha1 SHA1 authentication algorithm
Supported authentication methods:
ecdsa-signatures-256 ECDSA signatures (254 bit modulus) ecdsa-signatures-384 ECDSA signatures (384 bit modulus) pre-shared-keys Preshared keys rsa-signatures RSA signatures
For more information on IKE/IPsec lifetime, see https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/lifetime-seconds-edit-services.html.
IPsec VPN Configuration with Reference Identifier
MX devices support the following reference identifiers for IPsec VPN configuration:
IP address
FQDN
Distinguished Name
Sample IPsec VPN Configuration with IPv4 Address as Reference Identifier
DUT:
[edit]
security-administrator@host:fips# set services
ipsec-vpn ike policy ike_policy1 local-id ipv4_addr 11.0.1.2
security-administrator@host:fips# set services
ipsec-vpn ike policy ike_policy1 remote-id ipv4_addr 11.0.1.1
[edit]
security-administrator@host:fips# commit
commit complete
[edit]
security-administrator@host:fips# show services
| display set
set services service-set ss1 next-hop-service inside-service-interface ms-2/0/0.1
set services service-set ss1 next-hop-service outside-service-interface ms-2/0/0.2
set services service-set ss1 ipsec-vpn-options local-gateway 11.0.1.2
set services service-set ss1 ipsec-vpn-rules rule1
set services ipsec-vpn rule rule1 term term1 from source-address 80.0.0.0/16
set services ipsec-vpn rule rule1 term term1 from destination-address 30.0.0.0/16
set services ipsec-vpn rule rule1 term term1 then remote-gateway 11.0.1.1
set services ipsec-vpn rule rule1 term term1 then dynamic ike-policy ike_policy1
set services ipsec-vpn rule rule1 term term1 then dynamic ipsec-policy ipsec_policy1
set services ipsec-vpn rule rule1 term term1 then anti-replay-window-size 4096
set services ipsec-vpn rule rule1 match-direction input
set services ipsec-vpn ipsec proposal ipsec_proposal1 protocol esp
set services ipsec-vpn ipsec proposal ipsec_proposal1 authentication-algorithm hmac-sha-256-128
set services ipsec-vpn ipsec proposal ipsec_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ipsec policy ipsec_policy1 perfect-forward-secrecy keys group20
set services ipsec-vpn ipsec policy ipsec_policy1 proposals ipsec_proposal1
set services ipsec-vpn ike proposal ike_proposal1 authentication-method rsa-signatures
set services ipsec-vpn ike proposal ike_proposal1 dh-group group20
set services ipsec-vpn ike proposal ike_proposal1 authentication-algorithm sha-256
set services ipsec-vpn ike proposal ike_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ike policy ike_policy1 version 2
set services ipsec-vpn ike policy ike_policy1 proposals ike_proposal1
set services ipsec-vpn ike policy ike_policy1 local-id ipv4_addr 11.0.1.2
set services ipsec-vpn ike policy ike_policy1 local-certificate r1_cert_id
set services ipsec-vpn ike policy ike_policy1 remote-id ipv4_addr 11.0.1.1
set services ipsec-vpn traceoptions file ipsec_toby
set services ipsec-vpn traceoptions level all
set services ipsec-vpn traceoptions flag all
set services ipsec-vpn establish-tunnels immediately
[edit]
security-administrator@host:fips# show interfaces
| display set
set interfaces ge-0/1/8 unit 0 family inet address 11.0.1.2/30
set interfaces ms-2/0/0 unit 0 family inet
set interfaces ms-2/0/0 unit 1 family inet
set interfaces ms-2/0/0 unit 1 service-domain inside
set interfaces ms-2/0/0 unit 2 family inet
set interfaces ms-2/0/0 unit 2 service-domain outside
set interfaces lo0 unit 0 family inet address 80.0.0.1/24
[edit]
security-administrator@host:fips# show interfaces
| display set
set routing-options static route 30.0.0.0/16 next-hop ms-2/0/0.1[edit]
security-administrator@host:fips# exit
Exiting configuration mode
[edit]
security-administrator@host:fips> show services
ipsec-vpn ike security-associations detail
IKE peer 11.0.1.1
Role: Responder, State: Matured
Initiator cookie: 80682e1b22e12f32, Responder cookie: 40c6c30301cfb1a3
Exchange type: IKEv2, Authentication method: RSA-signatures
Local gateway interface: ge-0/1/8.0
Local: 11.0.1.2, Remote: 11.0.1.1
Lifetime: Expires in 3289 seconds
Peer ike-id: ipv4(any:0,[0..3]=11.0.1.1)
Algorithms:
Authentication : hmac-sha256-128
Encryption : aes256-cbc
Pseudo random function: hmac-sha256
Diffie-Hellman group : 20
Traffic statistics:
Input bytes : 1664
Output bytes : 1641
Input packets: 2
Output packets: 2
Flags: IKE SA created
IPSec security associations: 2 created, 0 deleted
[edit]
security-administrator@host:fips> show services
ipsec-vpn ipsec security-associations
Service set: ss1, IKE Routing-instance: default
Rule: rule1, Term: term1, Tunnel index: 1
Local gateway: 11.0.1.2, Remote gateway: 11.0.1.1
IPSec inside interface: ms-2/0/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Local identity: ipv4_subnet(any:0,[0..7]=80.0.0.0/16)
Remote identity: ipv4_subnet(any:0,[0..7]=30.0.0.0/16)
NATT Detection: Not Detected, NATT keepalive interval: 0
Total uptime: 0 days 0 hrs 5 mins 24 secs
Direction: inbound, SPI: 2267705568, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27625 seconds
Hard lifetime: Expires in 28476 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Direction: outbound, SPI: 1359811752, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27625 seconds
Hard lifetime: Expires in 28476 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
R2:
[edit]
security-administrator@host:fips# set services
ipsec-vpn ike policy ike_policy1 local-id ipv4_addr 11.0.1.1
security-administrator@host:fips# set services
ipsec-vpn ike policy ike_policy1 remote-id ipv4_addr 11.0.1.2
security-administrator@host:fips# commit
commit complete
[edit]
security-administrator@host:fips# show services
| display set
set services service-set ss1 next-hop-service inside-service-interface ms-2/0/0.1
set services service-set ss1 next-hop-service outside-service-interface ms-2/0/0.2
set services service-set ss1 ipsec-vpn-options local-gateway 11.0.1.1
set services service-set ss1 ipsec-vpn-rules rule1
set services ipsec-vpn rule rule1 term term1 from source-address 30.0.0.0/16
set services ipsec-vpn rule rule1 term term1 from destination-address 80.0.0.0/16
set services ipsec-vpn rule rule1 term term1 then remote-gateway 11.0.1.2
set services ipsec-vpn rule rule1 term term1 then dynamic ike-policy ike_policy1
set services ipsec-vpn rule rule1 term term1 then dynamic ipsec-policy ipsec_policy1
set services ipsec-vpn rule rule1 term term1 then anti-replay-window-size 4096
set services ipsec-vpn rule rule1 match-direction input
set services ipsec-vpn ipsec proposal ipsec_proposal1 protocol esp
set services ipsec-vpn ipsec proposal ipsec_proposal1 authentication-algorithm hmac-sha-256-128
set services ipsec-vpn ipsec proposal ipsec_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ipsec policy ipsec_policy1 perfect-forward-secrecy keys group20
set services ipsec-vpn ipsec policy ipsec_policy1 proposals ipsec_proposal1
set services ipsec-vpn ike proposal ike_proposal1 authentication-method rsa-signatures
set services ipsec-vpn ike proposal ike_proposal1 dh-group group20
set services ipsec-vpn ike proposal ike_proposal1 authentication-algorithm sha-256
set services ipsec-vpn ike proposal ike_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ike policy ike_policy1 version 2
set services ipsec-vpn ike policy ike_policy1 proposals ike_proposal1
set services ipsec-vpn ike policy ike_policy1 local-id ipv4_addr 11.0.1.1
set services ipsec-vpn ike policy ike_policy1 local-certificate r0_cert_id
set services ipsec-vpn ike policy ike_policy1 remote-id ipv4_addr 11.0.1.2
set services ipsec-vpn traceoptions file ipsec_toby
set services ipsec-vpn traceoptions level all
set services ipsec-vpn traceoptions flag all
set services ipsec-vpn establish-tunnels immediately
[edit]
security-administrator@host:fips# show interfaces
| display set
set interfaces ge-0/1/3 unit 0 family inet address 11.0.1.1/30
set interfaces ms-2/0/0 unit 0 family inet
set interfaces ms-2/0/0 unit 1 family inet
set interfaces ms-2/0/0 unit 1 service-domain inside
set interfaces ms-2/0/0 unit 2 family inet
set interfaces ms-2/0/0 unit 2 service-domain outside
set interfaces lo0 unit 0 family inet address 30.0.0.1/24
[edit]
security-administrator@host:fips# show routing-options
| display set
set routing-options static route 80.0.0.0/16 next-hop ms-2/0/0.1[edit]
security-administrator@host:fips# exit
Exiting configuration mode
[edit]
security-administrator@host:fips> show services
ipsec-vpn ike security-associations detail
IKE peer 11.0.1.2
Role: Initiator, State: Matured
Initiator cookie: 80682e1b22e12f32, Responder cookie: 40c6c30301cfb1a3
Exchange type: IKEv2, Authentication method: RSA-signatures
Local gateway interface: ge-0/1/3.0
Local: 11.0.1.1, Remote: 11.0.1.2
Lifetime: Expires in 3267 seconds
Peer ike-id: ipv4(any:0,[0..3]=11.0.1.2)
Algorithms:
Authentication : hmac-sha256-128
Encryption : aes256-cbc
Pseudo random function: hmac-sha256
Diffie-Hellman group : 20
Traffic statistics:
Input bytes : 1641
Output bytes : 1664
Input packets: 2
Output packets: 2
Flags: IKE SA created
IPSec security associations: 2 created, 0 deleted
[edit]
security-administrator@host:fips> show services
ipsec-vpn ipsec security-associations detail
Service set: ss1, IKE Routing-instance: default
Rule: rule1, Term: term1, Tunnel index: 1
Local gateway: 11.0.1.1, Remote gateway: 11.0.1.2
IPSec inside interface: ms-2/0/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Local identity: ipv4_subnet(any:0,[0..7]=30.0.0.0/16)
Remote identity: ipv4_subnet(any:0,[0..7]=80.0.0.0/16)
NATT Detection: Not Detected, NATT keepalive interval: 0
Total uptime: 0 days 0 hrs 5 mins 44 secs
Direction: inbound, SPI: 1359811752, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27650 seconds
Hard lifetime: Expires in 28456 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Direction: outbound, SPI: 2267705568, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27650 seconds
Hard lifetime: Expires in 28456 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Sample IPsec VPN Configuration with FQDN as Reference Identifier
R2:
[edit]
security-administrator@host:fips# show services
| display set
set services service-set ss1 next-hop-service inside-service-interface ms-2/0/0.1
set services service-set ss1 next-hop-service outside-service-interface ms-2/0/0.2
set services service-set ss1 ipsec-vpn-options local-gateway 11.0.1.2
set services service-set ss1 ipsec-vpn-rules rule1
set services ipsec-vpn rule rule1 term term1 from source-address 80.0.0.0/16
set services ipsec-vpn rule rule1 term term1 from destination-address 30.0.0.0/16
set services ipsec-vpn rule rule1 term term1 then remote-gateway 11.0.1.1
set services ipsec-vpn rule rule1 term term1 then dynamic ike-policy ike_policy1
set services ipsec-vpn rule rule1 term term1 then dynamic ipsec-policy ipsec_policy1
set services ipsec-vpn rule rule1 term term1 then anti-replay-window-size 4096
set services ipsec-vpn rule rule1 match-direction input
set services ipsec-vpn ipsec proposal ipsec_proposal1 protocol esp
set services ipsec-vpn ipsec proposal ipsec_proposal1 authentication-algorithm hmac-sha-256-128
set services ipsec-vpn ipsec proposal ipsec_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ipsec policy ipsec_policy1 perfect-forward-secrecy keys group20
set services ipsec-vpn ipsec policy ipsec_policy1 proposals ipsec_proposal1
set services ipsec-vpn ike proposal ike_proposal1 authentication-method ecdsa-signatures-256
set services ipsec-vpn ike proposal ike_proposal1 dh-group group20
set services ipsec-vpn ike proposal ike_proposal1 authentication-algorithm sha-256
set services ipsec-vpn ike proposal ike_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ike policy ike_policy1 version 2
set services ipsec-vpn ike policy ike_policy1 proposals ike_proposal1
set services ipsec-vpn ike policy ike_policy1 local-id fqdn R2.englab.juniper.net
set services ipsec-vpn ike policy ike_policy1 local-certificate r1_cert_id
set services ipsec-vpn ike policy ike_policy1 remote-id fqdn R0.englab.juniper.net
set services ipsec-vpn traceoptions file ipsec_toby
set services ipsec-vpn traceoptions level all
set services ipsec-vpn traceoptions flag all
set services ipsec-vpn establish-tunnels immediately
[edit]
security-administrator@host:fips# show interfaces
| display set
set interfaces ge-0/1/8 unit 0 family inet address 11.0.1.2/30
set interfaces ms-2/0/0 unit 0 family inet
set interfaces ms-2/0/0 unit 1 family inet
set interfaces ms-2/0/0 unit 1 service-domain inside
set interfaces ms-2/0/0 unit 2 family inet
set interfaces ms-2/0/0 unit 2 service-domain outside
set interfaces lo0 unit 0 family inet address 80.0.0.1/24
[edit]
security-administrator@host:fips# show routing-options
| display set
set routing-options static route 30.0.0.0/16 next-hop ms-2/0/0.1[edit]
security-administrator@host:fips# show security
| display set
set security pki ca-profile ca_profile1 ca-identity ca_profile1_id [edit]
security-administrator@host:fips# run show
services ipsec-vpn ike security-associations detail
IKE peer 11.0.1.1
Role: Responder, State: Matured
Initiator cookie: 0f81b5e9e1c9b88a, Responder cookie: fad59006894eb4d7
Exchange type: IKEv2, Authentication method: ECDSA-signatures (256 bit key)
Local gateway interface: ge-0/1/8.0
Local: 11.0.1.2, Remote: 11.0.1.1
Lifetime: Expires in 3599 seconds
Peer ike-id: fqdn(any:0,[0..23]=R0.englab.juniper.net)
Algorithms:
Authentication : hmac-sha256-128
Encryption : aes256-cbc
Pseudo random function: hmac-sha256
Diffie-Hellman group : 20
Traffic statistics:
Input bytes : 1152
Output bytes : 1097
Input packets: 2
Output packets: 2
Flags: IKE SA created
IPSec security associations: 2 created, 0 deleted
[edit]
security-administrator@host:fips# run show
services ipsec-vpn ipsec security-associations detail
Service set: ss1, IKE Routing-instance: default
Rule: rule1, Term: term1, Tunnel index: 1
Local gateway: 11.0.1.2, Remote gateway: 11.0.1.1
IPSec inside interface: ms-2/0/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Local identity: ipv4_subnet(any:0,[0..7]=80.0.0.0/16)
Remote identity: ipv4_subnet(any:0,[0..7]=30.0.0.0/16)
NATT Detection: Not Detected, NATT keepalive interval: 0
Total uptime: 0 days 0 hrs 0 mins 14 secs
Direction: inbound, SPI: 1648581290, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27971 seconds
Hard lifetime: Expires in 28786 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Direction: outbound, SPI: 3998160043, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27971 seconds
Hard lifetime: Expires in 28786 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
DUT:
[edit]
security-administrator@host:fips# show services
| display set
set services service-set ss1 next-hop-service inside-service-interface ms-2/0/0.1
set services service-set ss1 next-hop-service outside-service-interface ms-2/0/0.2
set services service-set ss1 ipsec-vpn-options local-gateway 11.0.1.1
set services service-set ss1 ipsec-vpn-rules rule1
set services ipsec-vpn rule rule1 term term1 from source-address 30.0.0.0/16
set services ipsec-vpn rule rule1 term term1 from destination-address 80.0.0.0/16
set services ipsec-vpn rule rule1 term term1 then remote-gateway 11.0.1.2
set services ipsec-vpn rule rule1 term term1 then dynamic ike-policy ike_policy1
set services ipsec-vpn rule rule1 term term1 then dynamic ipsec-policy ipsec_policy1
set services ipsec-vpn rule rule1 term term1 then anti-replay-window-size 4096
set services ipsec-vpn rule rule1 match-direction input
set services ipsec-vpn ipsec proposal ipsec_proposal1 protocol esp
set services ipsec-vpn ipsec proposal ipsec_proposal1 authentication-algorithm hmac-sha-256-128
set services ipsec-vpn ipsec proposal ipsec_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ipsec policy ipsec_policy1 perfect-forward-secrecy keys group20
set services ipsec-vpn ipsec policy ipsec_policy1 proposals ipsec_proposal1
set services ipsec-vpn ike proposal ike_proposal1 authentication-method ecdsa-signatures-256
set services ipsec-vpn ike proposal ike_proposal1 dh-group group20
set services ipsec-vpn ike proposal ike_proposal1 authentication-algorithm sha-256
set services ipsec-vpn ike proposal ike_proposal1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ike policy ike_policy1 version 2
set services ipsec-vpn ike policy ike_policy1 proposals ike_proposal1
set services ipsec-vpn ike policy ike_policy1 local-id fqdn R0.englab.juniper.net
set services ipsec-vpn ike policy ike_policy1 local-certificate r0_cert_id
set services ipsec-vpn ike policy ike_policy1 remote-id fqdn R2.englab.juniper.net
set services ipsec-vpn traceoptions file ipsec_toby
set services ipsec-vpn traceoptions level all
set services ipsec-vpn traceoptions flag all
set services ipsec-vpn establish-tunnels immediately
[edit]
security-administrator@host:fips# show interfaces
| display set
set interfaces ge-0/1/3 unit 0 family inet address 11.0.1.1/30
set interfaces ms-2/0/0 unit 0 family inet
set interfaces ms-2/0/0 unit 1 family inet
set interfaces ms-2/0/0 unit 1 service-domain inside
set interfaces ms-2/0/0 unit 2 family inet
set interfaces ms-2/0/0 unit 2 service-domain outside
set interfaces lo0 unit 0 family inet address 30.0.0.1/24
[edit]
security-administrator@host:fips# show routing-options
| display set
set routing-options static route 80.0.0.0/16 next-hop ms-2/0/0.1[edit]
security-administrator@host:fips# show security
| display set
set security pki ca-profile ca_profile1 ca-identity ca_profile1_id[edit]
security-administrator@host:fips# run show
services ipsec-vpn ike security-associations detail
IKE peer 11.0.1.2
Role: Initiator, State: Matured
Initiator cookie: 0f81b5e9e1c9b88a, Responder cookie: fad59006894eb4d7
Exchange type: IKEv2, Authentication method: ECDSA-signatures (256 bit key)
Local gateway interface: ge-0/1/3.0
Local: 11.0.1.1, Remote: 11.0.1.2
Lifetime: Expires in 3574 seconds
Peer ike-id: fqdn(any:0,[0..22]=R2.englab.juniper.net)
Algorithms:
Authentication : hmac-sha256-128
Encryption : aes256-cbc
Pseudo random function: hmac-sha256
Diffie-Hellman group : 20
Traffic statistics:
Input bytes : 1097
Output bytes : 1152
Input packets: 2
Output packets: 2
Flags: IKE SA created
IPSec security associations: 2 created, 0 deleted
[edit]
security-administrator@host:fips# run show
services ipsec-vpn ipsec security-associations detail
Service set: ss1, IKE Routing-instance: default
Rule: rule1, Term: term1, Tunnel index: 1
Local gateway: 11.0.1.1, Remote gateway: 11.0.1.2
IPSec inside interface: ms-2/0/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Local identity: ipv4_subnet(any:0,[0..7]=30.0.0.0/16)
Remote identity: ipv4_subnet(any:0,[0..7]=80.0.0.0/16)
NATT Detection: Not Detected, NATT keepalive interval: 0
Total uptime: 0 days 0 hrs 0 mins 33 secs
Direction: inbound, SPI: 3998160043, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27905 seconds
Hard lifetime: Expires in 28767 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Direction: outbound, SPI: 1648581290, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-cbc (256 bits)
Soft lifetime: Expires in 27905 seconds
Hard lifetime: Expires in 28767 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
[edit]
security-administrator@host:fips# run ping
80.0.0.1 source 30.0.0.1
PING 80.0.0.1 (80.0.0.1): 56 data bytes
64 bytes from 80.0.0.1: icmp_seq=0 ttl=64 time=1.717 ms
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.994 ms
^C
--- 80.0.0.1 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.994/1.356/1.717/0.361 ms
Sample Configuration for Distinguished Name as Reference Identifier
DUT:
[edit]
security-administrator@host:fips# show services
| display set
set services service-set ipsec_ss_ms_2_1_0_1 next-hop-service inside-service-interface ms-2/1/0.1
set services service-set ipsec_ss_ms_2_1_0_1 next-hop-service outside-service-interface ms-2/1/0.2
set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-options local-gateway 20.0.0.1
set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-rules vpn_rule_ms_2_1_0_1
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from source-address 10.1.0.0/16
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from destination-address 30.1.0.0/16
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then remote-gateway 20.0.0.2
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ike-policy ike_policy_ms_2_1_0_1
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ipsec-policy ipsec_policy_ms_2_1_0_1
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then anti-replay-window-size 4096
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 match-direction input
set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 protocol esp
set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 authentication-algorithm hmac-sha-256-128
set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 perfect-forward-secrecy keys group20
set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 proposals ipsec_proposal_ms_2_1_0_1
set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 authentication-method rsa-signatures
set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 dh-group group20
set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 version 2
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 proposals ike_proposal_ms_2_1_0_1
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 local-id distinguished-name
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 local-certificate juniperb
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 remote-id distinguished-name wildcard CN=juniperA
set services ipsec-vpn traceoptions file ipsec_fw_log1
set services ipsec-vpn traceoptions level all
set services ipsec-vpn traceoptions flag all
set services ipsec-vpn establish-tunnels immediately
[edit]
security-administrator@host:fips# show interfaces
| display set
set interfaces ge-0/0/2 unit 0 family inet address 10.1.0.2/24
set interfaces ge-0/1/3 unit 0 family inet address 20.0.0.1/30
set interfaces ms-2/1/0 unit 0 family inet
set interfaces ms-2/1/0 unit 1 family inet
set interfaces ms-2/1/0 unit 1 family inet6
set interfaces ms-2/1/0 unit 1 service-domain inside
set interfaces ms-2/1/0 unit 2 family inet
set interfaces ms-2/1/0 unit 2 family inet6
set interfaces ms-2/1/0 unit 2 service-domain outside
[edit]
security-administrator@host:fips# show routing-options
| display set
set routing-options static route 30.1.0.0/16 next-hop ms-2/1/0.1[edit]
security-administrator@host:fips# show security
| display set
set security pki ca-profile root ca-identity root[edit]
security-administrator@host:fips# run show
security pki local-certificate certificate-id juniperb detail
Certificate identifier: juniperb
Certificate version: 3
Serial number: 0000000a
Issuer:
Common name: juniperCA
Subject:
Country: US, State: MD, Common name: juniperB
Subject string:
C=US, ST=MD, CN=juniperB
Validity:
Not before: 02-26-2019 17:22 UTC
Not after: 02-24-2020 19:20 UTC
Public key algorithm: rsaEncryption(2048 bits)
30:82:01:0a:02:82:01:01:00:d1:e2:09:34:d0:e2:a8:e8:1d:eb:9d
7e:1c:62:f4:b5:ac:3d:1a:ab:9c:13:e6:bf:3d:7a:06:19:2a:1d:11
83:28:6d:15:73:ff:b7:ea:3d:50:76:99:e0:a4:fa:82:2b:42:3e:71
3c:96:45:70:70:d1:76:fd:79:79:df:c0:e5:ce:87:8b:80:82:15:af
01:23:b6:76:8b:28:98:41:c4:6a:f9:0d:3b:b4:f8:f9:0f:0c:3c:d5
94:39:25:1b:69:d8:e5:80:83:35:57:3d:f0:92:be:10:1f:19:8a:69
61:dd:a3:cd:98:bd:df:87:df:70:30:3d:ab:2a:24:a2:9b:e6:92:72
a7:0a:fc:b4:4c:8a:29:c3:cb:13:89:85:53:a9:5e:44:80:1c:7f:25
57:13:2f:de:ce:d4:f4:38:ed:3e:a1:e6:a9:10:29:13:33:07:47:fb
72:84:f8:f0:e4:a4:30:ca:c1:ec:cc:75:16:66:79:89:18:a1:13:e9
dc:3a:13:c9:96:b5:0c:3b:6c:18:02:b3:0b:86:09:f2:8c:e6:64:ea
7a:d6:43:f2:29:9d:a3:00:10:f8:10:c1:f7:31:ef:50:d9:a8:03:d5
58:78:b2:83:fc:eb:f2:7a:20:3c:9b:82:03:7b:20:43:51:73:41:7b
1d:f1:21:ca:fd:02:03:01:00:01
Signature algorithm: sha256WithRSAEncryption
Use for key: Data encipherment, Key encipherment, Non rupudiation, Digital signature
Fingerprint:
29:69:17:76:92:f4:68:9d:20:d2:04:6e:38:2e:e5:77:42:71:ad:f9 (sha1)
Auto-re-enrollment:
Status: Disabled
Next trigger time: Timer not started
[edit]
security-administrator@host:fips# run show
security pki ca-certificate ca-profile root detail
Certificate identifier: root
Certificate version: 3
Serial number: 00000001
Issuer:
Common name: juniperCA
Subject:
Common name: juniperCA
Subject string:
CN=juniperCA
Validity:
Not before: 02-24-2019 19:20 UTC
Not after: 02-24-2020 19:20 UTC
Public key algorithm: rsaEncryption(2048 bits)
30:82:01:0a:02:82:01:01:00:d1:e2:09:34:d0:e2:a8:e8:1d:eb:9d
7e:1c:62:f4:b5:ac:3d:1a:ab:9c:13:e6:bf:3d:7a:06:19:2a:1d:11
83:28:6d:15:73:ff:b7:ea:3d:50:76:99:e0:a4:fa:82:2b:42:3e:71
3c:96:45:70:70:d1:76:fd:79:79:df:c0:e5:ce:87:8b:80:82:15:af
01:23:b6:76:8b:28:98:41:c4:6a:f9:0d:3b:b4:f8:f9:0f:0c:3c:d5
94:39:25:1b:69:d8:e5:80:83:35:57:3d:f0:92:be:10:1f:19:8a:69
61:dd:a3:cd:98:bd:df:87:df:70:30:3d:ab:2a:24:a2:9b:e6:92:72
a7:0a:fc:b4:4c:8a:29:c3:cb:13:89:85:53:a9:5e:44:80:1c:7f:25
57:13:2f:de:ce:d4:f4:38:ed:3e:a1:e6:a9:10:29:13:33:07:47:fb
72:84:f8:f0:e4:a4:30:ca:c1:ec:cc:75:16:66:79:89:18:a1:13:e9
dc:3a:13:c9:96:b5:0c:3b:6c:18:02:b3:0b:86:09:f2:8c:e6:64:ea
7a:d6:43:f2:29:9d:a3:00:10:f8:10:c1:f7:31:ef:50:d9:a8:03:d5
58:78:b2:83:fc:eb:f2:7a:20:3c:9b:82:03:7b:20:43:51:73:41:7b
1d:f1:21:ca:fd:02:03:01:00:01
Signature algorithm: sha256WithRSAEncryption
Use for key: CRL signing, Certificate signing
Fingerprint:
9b:22:63:46:32:6f:f0:1c:fe:37:5f:eb:59:bb:8d:87:05:d3:b1:a6 (sha1)
[edit]
security-administrator@host:fips# run show
services ipsec-vpn ike security-associations detail
IKE peer 20.0.0.2
Role: Initiator, State: Matured
Initiator cookie: 7b7229d8e0d058d6, Responder cookie: ad14892b16f0ec47
Exchange type: IKEv2, Authentication method: RSA-signatures
Local: 20.0.0.1, Remote: 20.0.0.2
Lifetime: Expires in 2885 seconds
Peer ike-id: der_asn1_dn(any:0,[0..46]=C=US, ST=MD, CN=juniperA)
Algorithms:
Authentication : hmac-sha1-96
Encryption : aes256-cbc
Pseudo random function: hmac-sha1
Diffie-Hellman group : 20
Traffic statistics:
Input bytes : 0
Output bytes : 0
Input packets: 0
Output packets: 0
Flags: IKE SA created
IPSec security associations: 0 created, 0 deleted
[edit]
security-administrator@host:fips# run show
services ipsec-vpn ipsec security-associations detail
Service set: ipsec_ss_ms_2_1_0_1, IKE Routing-instance: default
Rule: vpn_rule_ms_2_1_0_1, Term: term1, Tunnel index: 1
Local gateway: 20.0.0.1, Remote gateway: 20.0.0.2
IPSec inside interface: ms-2/1/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Local identity: ipv4_subnet(any:0,[0..7]=10.1.0.0/16)
Remote identity: ipv4_subnet(any:0,[0..7]=30.1.0.0/16)
NATT Detection: Not Detected, NATT keepalive interval: 0
Total uptime: 0 days 0 hrs 55 mins 37 secs
Direction: inbound, SPI: 2743594902, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-256-cbc
Soft lifetime: Expires in 24470 seconds
Hard lifetime: Expires in 25463 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Direction: outbound, SPI: 779717468, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-256-cbc
Soft lifetime: Expires in 24470 seconds
Hard lifetime: Expires in 25463 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
R2:
[edit]
security-administrator@host:fips# show services
| display set
set services service-set ipsec_ss_ms_2_1_0_1 next-hop-service inside-service-interface ms-2/1/0.1
set services service-set ipsec_ss_ms_2_1_0_1 next-hop-service outside-service-interface ms-2/1/0.2
set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-options local-gateway 20.0.0.2
set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-rules vpn_rule_ms_2_1_0_1
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from source-address 30.1.0.0/16
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from destination-address 10.1.0.0/16
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then remote-gateway 20.0.0.1
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ike-policy ike_policy_ms_2_1_0_1
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ipsec-policy ipsec_policy_ms_2_1_0_1
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then anti-replay-window-size 4096
set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 match-direction input
set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 protocol esp
set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 authentication-algorithm hmac-sha-256-128
set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 perfect-forward-secrecy keys group20
set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 proposals ipsec_proposal_ms_2_1_0_1
set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 authentication-method rsa-signatures
set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 dh-group group20
set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 version 2
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 proposals ike_proposal_ms_2_1_0_1
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 local-id distinguished-name
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 local-certificate junipera
set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 remote-id distinguished-name wildcard CN=juniperB
set services ipsec-vpn traceoptions file ipsec_fw_log1
set services ipsec-vpn traceoptions level all
set services ipsec-vpn traceoptions flag all
set services ipsec-vpn establish-tunnels immediately
[edit]
security-administrator@host:fips# show interfaces
| display set
set interfaces ge-0/1/7 unit 0 family inet address 30.1.0.2/24
set interfaces ge-0/1/8 unit 0 family inet address 20.0.0.2/30
set interfaces ms-2/1/0 unit 0 family inet
set interfaces ms-2/1/0 unit 1 family inet
set interfaces ms-2/1/0 unit 1 family inet6
set interfaces ms-2/1/0 unit 1 service-domain inside
set interfaces ms-2/1/0 unit 2 family inet
set interfaces ms-2/1/0 unit 2 family inet6
set interfaces ms-2/1/0 unit 2 service-domain outside
[edit]
security-administrator@host:fips# show routing-options
|display set
set routing-options static route 10.1.0.0/16 next-hop ms-2/1/0.1[edit]
security-administrator@host:fips# show security
| display set
set security pki ca-profile root ca-identity root[edit]
security-administrator@host:fips# run show
security pki local-certificate certificate-id junipera detail
Certificate identifier: junipera
Certificate version: 3
Serial number: 00000009
Issuer:
Common name: juniperCA
Subject:
Country: US, State: MD, Common name: juniperA
Subject string:
C=US, ST=MD, CN=juniperA
Validity:
Not before: 02-26-2019 17:21 UTC
Not after: 02-24-2020 19:20 UTC
Public key algorithm: rsaEncryption(2048 bits)
30:82:01:0a:02:82:01:01:00:d1:e2:09:34:d0:e2:a8:e8:1d:eb:9d
7e:1c:62:f4:b5:ac:3d:1a:ab:9c:13:e6:bf:3d:7a:06:19:2a:1d:11
83:28:6d:15:73:ff:b7:ea:3d:50:76:99:e0:a4:fa:82:2b:42:3e:71
3c:96:45:70:70:d1:76:fd:79:79:df:c0:e5:ce:87:8b:80:82:15:af
01:23:b6:76:8b:28:98:41:c4:6a:f9:0d:3b:b4:f8:f9:0f:0c:3c:d5
94:39:25:1b:69:d8:e5:80:83:35:57:3d:f0:92:be:10:1f:19:8a:69
61:dd:a3:cd:98:bd:df:87:df:70:30:3d:ab:2a:24:a2:9b:e6:92:72
a7:0a:fc:b4:4c:8a:29:c3:cb:13:89:85:53:a9:5e:44:80:1c:7f:25
57:13:2f:de:ce:d4:f4:38:ed:3e:a1:e6:a9:10:29:13:33:07:47:fb
72:84:f8:f0:e4:a4:30:ca:c1:ec:cc:75:16:66:79:89:18:a1:13:e9
dc:3a:13:c9:96:b5:0c:3b:6c:18:02:b3:0b:86:09:f2:8c:e6:64:ea
7a:d6:43:f2:29:9d:a3:00:10:f8:10:c1:f7:31:ef:50:d9:a8:03:d5
58:78:b2:83:fc:eb:f2:7a:20:3c:9b:82:03:7b:20:43:51:73:41:7b
1d:f1:21:ca:fd:02:03:01:00:01
Signature algorithm: sha256WithRSAEncryption
Use for key: Data encipherment, Key encipherment, Non rupudiation, Digital signature
Fingerprint:
b2:49:38:a0:c9:2b:33:17:8a:33:97:91:e4:93:41:af:20:9f:4c:86 (sha1)
Auto-re-enrollment:
Status: Disabled
[edit]
security-administrator@host:fips# run show
services ipsec-vpn ike security-associations detail
IKE peer 20.0.0.1
Role: Responder, State: Matured
Initiator cookie: 7b7229d8e0d058d6, Responder cookie: ad14892b16f0ec47
Exchange type: IKEv2, Authentication method: RSA-signatures
Local: 20.0.0.2, Remote: 20.0.0.1
Lifetime: Expires in 3415 seconds
Peer ike-id: der_asn1_dn(any:0,[0..46]=C=US, ST=MD, CN=juniperB)
Algorithms:
Authentication : hmac-sha1-96
Encryption : aes256-cbc
Pseudo random function: hmac-sha1
Diffie-Hellman group : 20
Traffic statistics:
Input bytes : 0
Output bytes : 0
Input packets: 0
Output packets: 0
Flags: IKE SA created
IPSec security associations: 0 created, 0 deleted
[edit]
security-administrator@host:fips# run show
services ipsec-vpn ipsec security-associations detail
Service set: ipsec_ss_ms_2_1_0_1, IKE Routing-instance: default
Rule: vpn_rule_ms_2_1_0_1, Term: term1, Tunnel index: 1
Local gateway: 20.0.0.2, Remote gateway: 20.0.0.1
IPSec inside interface: ms-2/1/0.1, Tunnel MTU: 1500
UDP encapsulate: Disabled, UDP Destination port: 0
Local identity: ipv4_subnet(any:0,[0..7]=30.1.0.0/16)
Remote identity: ipv4_subnet(any:0,[0..7]=10.1.0.0/16)
NATT Detection: Not Detected, NATT keepalive interval: 0
Total uptime: 0 days 0 hrs 46 mins 38 secs
Direction: inbound, SPI: 779717468, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-256-cbc
Soft lifetime: Expires in 25054 seconds
Hard lifetime: Expires in 26002 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Direction: outbound, SPI: 2743594902, AUX-SPI: 0
Mode: tunnel, Type: dynamic, State: Installed
Protocol: ESP, Authentication: hmac-sha-256-128, Encryption: aes-256-cbc
Soft lifetime: Expires in 25054 seconds
Hard lifetime: Expires in 26002 seconds
Anti-replay service: Enabled, Replay window size: 4096
Copy ToS: Enabled
Copy TTL: Disabled, TTL value: 64
SA lifetime: 28800 seconds
Generating Certificate Signing Request (CSR)
Sample commands for generating key-pair and CSR:
security-administrator@host:fips> request
security pki generate-key-pair type ecdsa size 256 certificate-id
r1_cert_id
Generated key pair r1_cert_id, key size 256 bitssecurity-administrator@host:fips> request
security pki generate-certificate-request certificate-id r1_cert_id
filename subject CN=11.0.1.2 email router@juniper.net /var/tmp/11.0.1.2.csr
Generated certificate request
-----BEGIN CERTIFICATE REQUEST-----
MIIBAjCBpwIBADATMREwDwYDVQQDEwgxMS4wLjEuMjBZMBMGByqGSM49AgEGCCqG
SM49AwEHA0IABLRebeXGFF+AnH6I0AQu8gFQwOCbAm89wazpUpQs5RIGiVfYGgV1
xrwTGcQoKYc+a8PqJ7EQcffSttdQ1fUG9KqgMjAwBgkqhkiG9w0BCQ4xIzAhMB8G
A1UdEQQYMBaBFCJiYWxhamlAanVuaXBlci5uZXQiMAwGCCqGSM49BAMCBQADSAAw
RQIgKbEsYSH8QE4ZKo97z3jDwIWutr2pOp4H42jTvqONL+kCIQChgA/if9Tcf1ya
yrX/0duSsUHi/tcOeP+RxWdAgpb6dA==
-----END CERTIFICATE REQUEST-----
For more information, refer https://www.juniper.net/documentation/en_US/junos/topics/reference/command-summary/request-security-pki-generate-certificate-request.html.Configuring Firewall Rules
MX devices allow configuring firewall filter to allow or reject specific traffic.
The following procedures explain how to configure IPSec VPN and firewall rules:
- Configure IPsec VPN between R0-R1.
R0:
[edit]security-administrator@host:fips# show services | display setset services service-set ipsec_ss_ms_2_1_0_1 next-hop-service inside-service-interface ms-2/1/0.1 set services service-set ipsec_ss_ms_2_1_0_1 next-hop-service outside-service-interface ms-2/1/0.2 set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-options local-gateway 20.0.0.1 set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-rules vpn_rule_ms_2_1_0_1 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from source-address 10.1.0.0/16 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from destination-address 30.1.0.0/16 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then remote-gateway 20.0.0.2 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ike-policy ike_policy_ms_2_1_0_1 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ipsec-policy ipsec_policy_ms_2_1_0_1 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then anti-replay-window-size 4096 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 match-direction input set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 protocol esp set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 authentication-algorithm hmac-sha-256-128 set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 perfect-forward-secrecy keys group20 set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 proposals ipsec_proposal_ms_2_1_0_1 set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 authentication-method pre-shared-keys set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 dh-group group20 set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 version 2 set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 proposals ike_proposal_ms_2_1_0_1[edit]security-administrator@host:fips# prompt services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 pre-shared-key ascii-textNew ascii-text (secret):Retype new ascii-text (secret):[edit]security-administrator@host:fips# set services ipsec-vpn traceoptions file ipsec_fw_log1security-administrator@host:fips# set services ipsec-vpn traceoptions level allsecurity-administrator@host:fips# set services ipsec-vpn traceoptions flag allsecurity-administrator@host:fips# set services ipsec-vpn establish-tunnels immediately[edit]security-administrator@host:fips# show interfaces | display setset interfaces ge-0/0/2 unit 0 family inet address 10.1.0.2/24 set interfaces ge-0/1/3 unit 0 family inet address 20.0.0.1/30 set interfaces ms-2/1/0 unit 0 family inet set interfaces ms-2/1/0 unit 1 family inet set interfaces ms-2/1/0 unit 1 family inet6 set interfaces ms-2/1/0 unit 1 service-domain inside set interfaces ms-2/1/0 unit 2 family inet set interfaces ms-2/1/0 unit 2 family inet6 set interfaces ms-2/1/0 unit 2 service-domain outside[edit]security-administrator@host:fips# show routing-options | display setset routing-options static route 30.1.0.0/16 next-hop ms-2/1/0.1R1:
[edit]security-administrator@host:fips# show services | display setset services service-set ipsec_ss_ms_2_1_0_1 next-hop-service inside-service-interface ms-2/1/0.1 set services service-set ipsec_ss_ms_2_1_0_1 next-hop-service outside-service-interface ms-2/1/0.2 set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-options local-gateway 20.0.0.2 set services service-set ipsec_ss_ms_2_1_0_1 ipsec-vpn-rules vpn_rule_ms_2_1_0_1 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from source-address 30.1.0.0/16 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 from destination-address 10.1.0.0/16 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then remote-gateway 20.0.0.1 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ike-policy ike_policy_ms_2_1_0_1 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then dynamic ipsec-policy ipsec_policy_ms_2_1_0_1 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 term term1 then anti-replay-window-size 4096 set services ipsec-vpn rule vpn_rule_ms_2_1_0_1 match-direction input set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 protocol esp set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 authentication-algorithm hmac-sha-256-128 set services ipsec-vpn ipsec proposal ipsec_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 perfect-forward-secrecy keys group20 set services ipsec-vpn ipsec policy ipsec_policy_ms_2_1_0_1 proposals ipsec_proposal_ms_2_1_0_1 set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 authentication-method pre-shared-keys set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 dh-group group20 set services ipsec-vpn ike proposal ike_proposal_ms_2_1_0_1 encryption-algorithm aes-256-cbc set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 version 2 set services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 proposals ike_proposal_ms_2_1_0_1[edit]security-administrator@host:fips# prompt services ipsec-vpn ike policy ike_policy_ms_2_1_0_1 pre-shared-key ascii-textNew ascii-text (secret):Retype new ascii-text (secret):[edit]security-administrator@host:fips# set services ipsec-vpn traceoptions file ipsec_fw_log1security-administrator@host:fips# set services ipsec-vpn traceoptions level allsecurity-administrator@host:fips# set services ipsec-vpn traceoptions flag allsecurity-administrator@host:fips# set services ipsec-vpn establish-tunnels immediately[edit]security-administrator@host:fips# show interfaces | display setset interfaces ge-0/1/8 unit 0 family inet address 20.0.0.2/30 set interfaces ge-0/1/7 unit 0 family inet address 30.1.0.2/24 set interfaces ms-2/1/0 unit 0 family inet set interfaces ms-2/1/0 unit 1 family inet set interfaces ms-2/1/0 unit 1 family inet6 set interfaces ms-2/1/0 unit 1 service-domain inside set interfaces ms-2/1/0 unit 2 family inet set interfaces ms-2/1/0 unit 2 family inet6 set interfaces ms-2/1/0 unit 2 service-domain outside[edit]security-administrator@host:fips# show routing-options | display setset routing-options static route 10.1.0.0/16 next-hop ms-2/1/0.1 - Configure firewall rule.
Enable firewall filter to allow traffic from specific source and destination addresses and reject all other traffic. For example, the first rule term 1 allows traffic from source-address 30.1.0.1/32 to communicate with only 10.1.0.1/32 address. The second rule rejects all other traffic.
[edit]security-administrator@host:fips# show firewall | display setset firewall family inet filter fw_filter1 term 1 from source-address 30.1.0.1/32 set firewall family inet filter fw_filter1 term 1 from destination-address 10.1.0.1/32 set firewall family inet filter fw_filter1 term 1 then count inc1 set firewall family inet filter fw_filter1 term 1 then log set firewall family inet filter fw_filter1 term 1 then accept set firewall family inet filter fw_filter1 term 2 then count inc2 set firewall family inet filter fw_filter1 term 2 then log set firewall family inet filter fw_filter1 term 2 then reject set firewall traceoptions file firewall_log set firewall traceoptions file size 1g set firewall traceoptions file world-readable set firewall traceoptions flag all
Note The firewall rules are processed in the order they are configured.
- Apply input firewall filter on R0 router MS-MPC interface.[edit]security-administrator@host:fips# set interfaces ms-2/1/0 unit 1 family inet filter input fw_filter1
- Send traffic from H1 to H0 and monitor firewall logs based
on accept or reject rule.
Accepted traffic logs on R0:
[edit]security-administrator@host:fips# run show firewall logLog : Time Filter Action Interface Protocol Src Addr Dest Addr 20:39:20 pfe A ms-2/1/0.1 ICMP 30.1.0.1 10.1.0.1 20:39:19 pfe A ms-2/1/0.1 ICMP 30.1.0.1 10.1.0.1 20:39:18 pfe A ms-2/1/0.1 ICMP 30.1.0.1 10.1.0.1
Rejected traffic logs on R0:
[edit]security-administrator@host:fips# run show firewall logLog : Time Filter Action Interface Protocol Src Addr Dest Addr 20:43:20 pfe R ms-2/1/0.1 ICMP 30.1.0.5 10.1.0.1 20:43:19 pfe R ms-2/1/0.1 ICMP 30.1.0.5 10.1.0.1 20:43:18 pfe R ms-2/1/0.1 ICMP 30.1.0.5 10.1.0.1