Example: Configuring a Hub-and-Spoke VPN

Requirements

This example uses the following hardware:

• SRX240 device
• SRX5800 device
• SSG140 device

Before you begin, read VPN Overview.

Overview

This example describes how to configure a hub-and-spoke VPN typically found in branch deployments. The hub is the corporate office, and there are two spokes—a branch office in Sunnyvale, California, and a branch office in Westford, Massachusetts. Users in the branch offices will use the VPN to securely transfer data with the corporate office.

Figure 1 shows an example of a hub-and-spoke VPN topology. In this topology, an SRX5800 device is located at the corporate office. An SRX240 device is located at the Westford branch, and an SSG140 device is located at the Sunnyvale branch.

Figure 1: Hub-and-Spoke VPN Topology

In this example, you configure the corporate office hub, the Westford spoke, and the Sunnyvale spoke. First you configure interfaces, IPv4 static and default routes, security zones, and address books. Then you configure IKE Phase 1 and IPsec Phase 2 parameters, and bind the st0.0 interface to the IPsec VPN. On the hub, you configure st0.0 for multipoint and add a static NHTB table entry for the Sunnyvale spoke. Finally, you configure security policy and TCP-MSS parameters. See Table 1 through Table 5 for specific configuration parameters used in this example.

Configuration

• Configuring Basic Network, Security Zone, and Address Book Information for the Hub
• Configuring IKE for the Hub
• Configuring IPsec for the Hub
• Configuring Security Policies for the Hub
• Configuring TCP-MSS for the Hub
• Configuring Basic Network, Security Zone, and Address Book Information for the Westford Spoke
• Configuring IKE for the Westford Spoke
• Configuring IPsec for the Westford Spoke
• Configuring Security Policies for the Westford Spoke
• Configuring TCP-MSS for the Westford Spoke
• Configuring the Sunnyvale Spoke

Configuring Basic Network, Security Zone, and Address Book Information for the Hub

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure Ethernet interface information.
   [edit]user@hub# set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.1/24user@hub# set interfaces ge-0/0/3 unit 0 family inet address 1.1.1.2/30user@hub# set interfaces st0 unit 0 family inet address 10.11.11.10/24
2. Configure static route information.
   [edit]user@hub# set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1user@hub# set routing-options static route 192.168.168.0/24 next-hop 10.11.11.11user@hub# set routing-options static route 192.168.178.0/24 next-hop 10.11.11.12
3. Configure the untrust security zone.
   [edit ]user@hub# set security zones security-zone untrust
4. Assign an interface to the untrust security zone.
   [edit security zones security-zone untrust]user@hub# set interfaces ge-0/0/3.0
5. Specify allowed system services for the untrust security zone.
   [edit security zones security-zone untrust]user@hub# set host-inbound-traffic system-services ike
6. Configure the trust security zone.
   [edit]user@hub# edit security zones security-zone trust
7. Assign an interface to the trust security zone.
   [edit security zones security-zone trust]user@hub# set interfaces ge-0/0/0.0
8. Specify allowed system services for the trust security zone.
   [edit security zones security-zone trust]user@hub# set host-inbound-traffic system-services all
9. Create an address book and attach a zone to it.
   [edit security address-book book1]user@hub# set address local-net 10.10.10.0/24 user@hub# set attach zone trust
10. Configure the vpn security zone.
    [edit]user@hub# edit security zones security-zone vpn
11. Assign an interface to the vpn security zone.
    [edit security zones security-zone vpn]user@hub# set interfaces st0.0
12. Create another address book and attach a zone to it.
    [edit security address-book book2]user@hub# set address sunnyvale-net 192.168.168.0/24 user@hub# set address westford-net 192.168.178.0/24 user@hub# set attach zone vpn

Results

From configuration mode, confirm your configuration by entering the show interfaces, show routing-options, show security zones, and show security address-book commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring IKE for the Hub

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the IKE Phase 1 proposal.
   [edit security ike]user@hub# set proposal ike-phase1-proposal
2. Define the IKE proposal authentication method.
   [edit security ike proposal ike-phase1-proposal]user@hub# set authentication-method pre-shared-keys
3. Define the IKE proposal Diffie-Hellman group.
   [edit security ike proposal ike-phase1-proposal]user@hub# set dh-group group2
4. Define the IKE proposal authentication algorithm.
   [edit security ike proposal ike-phase1-proposal]user@hub# set authentication-algorithm sha1
5. Define the IKE proposal encryption algorithm.
   [edit security ike proposal ike-phase1-proposal]user@hub# set encryption-algorithm aes-128-cbc
6. Create an IKE Phase 1 policy.
   [edit security ike]user@hub# set policy ike-phase1-policy
7. Set the IKE Phase 1 policy mode.
   [edit security ike policy ike-phase1-policy]user@hub# set mode main
8. Specify a reference to the IKE proposal.
   [edit security ike policy ike-phase1-policy]user@hub# set proposals ike-phase1-proposal
9. Define the IKE Phase 1 policy authentication method.
   [edit security ike policy ike-phase1-policy]user@hub# set pre-shared-key ascii-text 395psksecr3t
10. Create an IKE Phase 1 gateway and define its external interface.
    [edit security ike]user@hub# set gateway gw-westford external-interface ge-0/0/3.0
11. Define the IKE Phase 1 policy reference.
    [edit security ike]user@hub# set gateway gw-westford ike-policy ike-phase1-policy
12. Define the IKE Phase 1 gateway address.
    [edit security ike]user@hub# set gateway gw-westford address 3.3.3.2
13. Create an IKE Phase 1 gateway and define its external interface.
    [edit security ike]user@hub# set gateway gw-sunnyvale external-interface ge-0/0/3.0
14. Define the IKE Phase 1 policy reference.
    [edit security ike gateway]user@hub# set gateway gw-sunnyvale ike-policy ike-phase1-policy
15. Define the IKE Phase 1 gateway address.
    [edit security ike gateway]user@hub# set gateway gw-sunnyvale address 2.2.2.2

Results

From configuration mode, confirm your configuration by entering the show security ike command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring IPsec for the Hub

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create an IPsec Phase 2 proposal.
   [edit]user@hub# set security ipsec proposal ipsec-phase2-proposal
2. Specify the IPsec Phase 2 proposal protocol.
   [edit security ipsec proposal ipsec-phase2-proposal]user@hub# set protocol esp
3. Specify the IPsec Phase 2 proposal authentication algorithm.
   [edit security ipsec proposal ipsec-phase2-proposal]user@hub# set authentication-algorithm hmac-sha1-96
4. Specify the IPsec Phase 2 proposal encryption algorithm.
   [edit security ipsec proposal ipsec-phase2-proposal]user@hub# set encryption-algorithm aes-128-cbc
5. Create the IPsec Phase 2 policy.
   [edit security ipsec]user@hub# set policy ipsec-phase2-policy
6. Specify the IPsec Phase 2 proposal reference.
   [edit security ipsec policy ipsec-phase2-policy]user@hub# set proposals ipsec-phase2-proposal
7. Specify IPsec Phase 2 PFS to use Diffie-Hellman group 2.
   [edit security ipsec policy ipsec-phase2-policy]user@host# set perfect-forward-secrecy keys group2
8. Specify the IKE gateways.
   [edit security ipsec]user@hub# set vpn vpn-westford ike gateway gw-westforduser@hub# set vpn vpn-sunnyvale ike gateway gw-sunnyvale
9. Specify the IPsec Phase 2 policies.
   [edit security ipsec]user@hub# set vpn vpn-westford ike ipsec-policy ipsec-phase2-policyuser@hub# set vpn vpn-sunnyvale ike ipsec-policy ipsec-phase2-policy
10. Specify the interface to bind.
    [edit security ipsec]user@hub# set vpn vpn-westford bind-interface st0.0user@hub# set vpn vpn-sunnyvale bind-interface st0.0
11. Configure the st0 interface as multipoint.
    [edit]user@hub# set interfaces st0 unit 0 multipoint
12. Add static NHTB table entries for the Sunnyvale and Westford offices.
    [edit]user@hub# set interfaces st0 unit 0 family inet next-hop-tunnel 10.11.11.11 ipsec-vpn vpn-sunnyvaleuser@hub# set interfaces st0 unit 0 family inet next-hop-tunnel 10.11.11.12 ipsec-vpn vpn-westford

Results

From configuration mode, confirm your configuration by entering the show security ipsec command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring Security Policies for the Hub

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the security policy to permit traffic from the trust zone to the vpn zone.
   [edit security policies from-zone trust to-zone vpn]user@hub# set policy local-to-spokes match source-address local-netuser@hub# set policy local-to-spokes match destination-address sunnyvale-netuser@hub# set policy local-to-spokes match destination-address westford-netuser@hub# set policy local-to-spokes match application anyuser@hub# set policy local-to-spokes then permit
2. Create the security policy to permit traffic from the vpn zone to the trust zone.
   [edit security policies from-zone vpn to-zone trust]user@hub# set policy spokes-to-local match source-address sunnyvale-netuser@hub# set policy spokes-to-local match source-address westford-netuser@hub# set policy spokes-to-local match destination-address local-netuser@hub# set policy spokes-to-local match application anyuser@hub# set policy spokes-to-local then permit
3. Create the security policy to permit intrazone traffic.
   [edit security policies from-zone vpn to-zone vpn]user@hub# set policy spoke-to-spoke match source-address anyuser@hub# set policy spoke-to-spoke match destination-address anyuser@hub# set policy spoke-to-spoke match application anyuser@hub# set policy spoke-to-spoke then permit

Results

From configuration mode, confirm your configuration by entering the show security policies command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring TCP-MSS for the Hub

CLI Quick Configuration

To quickly configure this section of the example, copy the following command, paste it into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the command into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure TCP-MSS information.
   [edit]user@hub# set security flow tcp-mss ipsec-vpn mss 1350

Results

From configuration mode, confirm your configuration by entering the show security flow command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring Basic Network, Security Zone, and Address Book Information for the Westford Spoke

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure Ethernet interface information.
   [edit]user@spoke# set interfaces ge-0/0/0 unit 0 family inet address 3.3.3.2/30user@spoke# set interfaces ge-0/0/3 unit 0 family inet address 192.168.178.1/24user@spoke# set interfaces st0 unit 0 family inet address 10.11.11.12/24
2. Configure static route information.
   [edit]user@spoke# set routing-options static route 0.0.0.0/0 next-hop 3.1.1.1user@spoke# set routing-options static route 10.10.10.0/24 next-hop 10.11.11.10user@spoke# set routing-options static route 192.168.168.0/24 next-hop 10.11.11.10
3. Configure the untrust security zone.
   [edit]user@spoke# set security zones security-zone untrust
4. Assign an interface to the security zone.
   [edit security zones security-zone untrust]user@spoke# set interfaces ge-0/0/0.0
5. Specify allowed system services for the untrust security zone.
   [edit security zones security-zone untrust]user@spoke# set host-inbound-traffic system-services ike
6. Configure the trust security zone.
   [edit]user@spoke# edit security zones security-zone trust
7. Assign an interface to the trust security zone.
   [edit security zones security-zone trust]user@spoke# set interfaces ge-0/0/3.0
8. Specify allowed system services for the trust security zone.
   [edit security zones security-zone trust]user@spoke# set host-inbound-traffic system-services all
9. Configure the vpn security zone.
   [edit]user@spoke# edit security zones security-zone vpn
10. Assign an interface to the vpn security zone.
    [edit security zones security-zone vpn]user@spoke# set interfaces st0.0
11. Create an address book and attach a zone to it.
    [edit security address-book book1]user@spoke# set address local-net 192.168.178.0/24 user@spoke# set attach zone trust
12. Create another address book and attach a zone to it.
    [edit security address-book book2]user@spoke# set address corp-net 10.10.10.0/24 user@spoke# set address sunnyvale-net 192.168.168.0/24 user@spoke# set attach zone vpn

Results

From configuration mode, confirm your configuration by entering the show interfaces, show routing-options, show security zones, and show security address-book commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring IKE for the Westford Spoke

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the IKE Phase 1 proposal.
   [edit security ike]user@spoke# set proposal ike-phase1-proposal
2. Define the IKE proposal authentication method.
   [edit security ike proposal ike-phase1-proposal]user@spoke# set authentication-method pre-shared-keys
3. Define the IKE proposal Diffie-Hellman group.
   [edit security ike proposal ike-phase1-proposal]user@spoke# set dh-group group2
4. Define the IKE proposal authentication algorithm.
   [edit security ike proposal ike-phase1-proposal]user@spoke# set authentication-algorithm sha1
5. Define the IKE proposal encryption algorithm.
   [edit security ike proposal ike-phase1-proposal]user@spoke# set encryption-algorithm aes-128-cbc
6. Create an IKE Phase 1 policy.
   [edit security ike]user@spoke# set policy ike-phase1-policy
7. Set the IKE Phase 1 policy mode.
   [edit security ike policy ike-phase1-policy]user@spoke# set mode main
8. Specify a reference to the IKE proposal.
   [edit security ike policy ike-phase1-policy]user@spoke# set proposals ike-phase1-proposal
9. Define the IKE Phase 1 policy authentication method.
   [edit security ike policy ike-phase1-policy]user@spoke# set pre-shared-key ascii-text 395psksecr3t
10. Create an IKE Phase 1 gateway and define its external interface.
    [edit security ike]user@spoke# set gateway gw-corporate external-interface ge-0/0/0.0
11. Define the IKE Phase 1 policy reference.
    [edit security ike]user@spoke# set gateway gw-corporate ike-policy ike-phase1-policy
12. Define the IKE Phase 1 gateway address.
    [edit security ike]user@spoke# set gateway gw-corporate address 1.1.1.2

Results

From configuration mode, confirm your configuration by entering the show security ike command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring IPsec for the Westford Spoke

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create an IPsec Phase 2 proposal.
   [edit]user@spoke# set security ipsec proposal ipsec-phase2-proposal
2. Specify the IPsec Phase 2 proposal protocol.
   [edit security ipsec proposal ipsec-phase2-proposal]user@spoke# set protocol esp
3. Specify the IPsec Phase 2 proposal authentication algorithm.
   [edit security ipsec proposal ipsec-phase2-proposal]user@spoke# set authentication-algorithm hmac-sha1-96
4. Specify the IPsec Phase 2 proposal encryption algorithm.
   [edit security ipsec proposal ipsec-phase2-proposal]user@spoke# set encryption-algorithm aes-128-cbc
5. Create the IPsec Phase 2 policy.
   [edit security ipsec]user@spoke# set policy ipsec-phase2-policy
6. Specify the IPsec Phase 2 proposal reference.
   [edit security ipsec policy ipsec-phase2-policy]user@spoke# set proposals ipsec-phase2-proposal
7. Specify IPsec Phase 2 PFS to use Diffie-Hellman group 2.
   [edit security ipsec policy ipsec-phase2-policy]user@host# set perfect-forward-secrecy keys group2
8. Specify the IKE gateway.
   [edit security ipsec]user@spoke# set vpn vpn-corporate ike gateway gw-corporate
9. Specify the IPsec Phase 2 policy.
   [edit security ipsec]user@spoke# set vpn vpn-corporate ike ipsec-policy ipsec-phase2-policy
10. Specify the interface to bind.
    [edit security ipsec]user@spoke# set vpn vpn-corporate bind-interface st0.0

Results

From configuration mode, confirm your configuration by entering the show security ipsec command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring Security Policies for the Westford Spoke

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the security policy to permit traffic from the trust zone to the vpn zone.
   [edit security policies from-zone trust to-zone vpn]user@spoke# set policy to-corp match source-address local-netuser@spoke# set policy to-corp match destination-address corp-netuser@spoke# set policy to-corp match destination-address sunnyvale-netuser@spoke# set policy to-corp match application anyuser@spoke# set policy to-corp then permit
2. Create the security policy to permit traffic from the vpn zone to the trust zone.
   [edit security policies from-zone vpn to-zone trust]user@spoke# set policy spokes-to-local match source-address corp-netuser@spoke# set policy spokes-to-local match source-address sunnyvale-netuser@spoke# set policy spokes-to-local match destination-address local-netuser@spoke# set policy spokes-to-local match application anyuser@spoke# set policy spokes-to-local then permit

Results

From configuration mode, confirm your configuration by entering the show security policies command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring TCP-MSS for the Westford Spoke

CLI Quick Configuration

To quickly configure this section of the example, copy the following command, paste it into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the command into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure TCP-MSS information.
   [edit]user@spoke# set security flow tcp-mss ipsec-vpn mss 1350

Results

From configuration mode, confirm your configuration by entering the show security flow command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring the Sunnyvale Spoke

CLI Quick Configuration

This example uses an SSG Series device for the Sunnyvale spoke. For reference, the configuration for the SSG Series device is provided. For information about configuring SSG Series devices, see the Concepts and Examples ScreenOS Reference Guide, which is located at https://www.juniper.net/techpubs .

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI.

Step-by-Step Procedure

Verification

To confirm that the configuration is working properly, perform these tasks:

• Verifying the IKE Phase 1 Status
• Verifying the IPsec Phase 2 Status
• Verifying Next-Hop Tunnel Bindings
• Verifying Static Routes for Remote Peer Local LANs
• Reviewing Statistics and Errors for an IPsec Security Association
• Testing Traffic Flow Across the VPN

Verifying the IKE Phase 1 Status

Purpose

Verify the IKE Phase 1 status.

Action

Note: Before starting the verification process, you need to send traffic from a host in the 10.10.10/24 network to a host in the 192.168.168/24 and 192.168.178/24 networks to bring the tunnels up. For route-based VPNs, you can send traffic initiated from the SRX Series device through the tunnel. We recommend that when testing IPsec tunnels, you send test traffic from a separate device on one side of the VPN to a second device on the other side of the VPN. For example, initiate a ping from 10.10.10.10 to 192.168.168.10.

From operational mode, enter the show security ike security-associations command. After obtaining an index number from the command, use the show security ike security-associations index index_number detail command.

Index   Remote Address  State  Initiator cookie  Responder cookie  Mode
6       3.3.3.2         UP     94906ae2263bbd8e  1c35e4c3fc54d6d3  Main
7       2.2.2.2         UP     7e7a1c0367dfe73c  f284221c656a5fbc  Main

IKE peer 3.3.3.2, Index 6,
  Role: Responder, State: UP
  Initiator cookie: 94906ae2263bbd8e,, Responder cookie: 1c35e4c3fc54d6d3
  Exchange type: Main, Authentication method: Pre-shared-keys
  Local: 1.1.1.2:500, Remote: 3.3.3.2:500
  Lifetime: Expires in 3571 seconds
  Algorithms:
   Authentication        : sha1
   Encryption            : aes-cbc (128 bits)
   Pseudo random function: hmac-sha1
  Traffic statistics:
   Input bytes    :                1128
   Output bytes   :                 988
   Input packets  :                   6
   Output packets :                   5
  Flags: Caller notification sent
  IPSec security associations: 1 created, 0 deleted
  Phase 2 negotiations in progress: 1
    Negotiation type: Quick mode, Role: Responder, Message ID: 1350777248
    Local: 1.1.1.2:500, Remote: 3.3.3.2:500
    Local identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
    Remote identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
    Flags: Caller notification sent, Waiting for done

Meaning

The show security ike security-associations command lists all active IKE Phase 1 SAs. If no SAs are listed, there was a problem with Phase 1 establishment. Check the IKE policy parameters and external interface settings in your configuration.

If SAs are listed, review the following information:

• Index—This value is unique for each IKE SA, which you can use in the show security ike security-associations index detail command to get more information about the SA.
• Remote Address—Verify that the remote IP address is correct.
• State
  • UP—The Phase 1 SA has been established.
  • DOWN—There was a problem establishing the Phase 1 SA.
• Mode—Verify that the correct mode is being used.

Verify that the following information is correct in your configuration:

• External interfaces (the interface must be the one that receives IKE packets)
• IKE policy parameters
• Preshared key information
• Phase 1 proposal parameters (must match on both peers)

The show security ike security-associations index 1 detail command lists additional information about the security association with an index number of 1:

• Authentication and encryption algorithms used
• Phase 1 lifetime
• Traffic statistics (can be used to verify that traffic is flowing properly in both directions)
• Initiator and responder role information

  Note: Troubleshooting is best performed on the peer using the responder role.

• Number of IPsec SAs created
• Number of Phase 2 negotiations in progress

Verifying the IPsec Phase 2 Status

Purpose

Verify the IPsec Phase 2 status.

Action

From operational mode, enter the show security ipsec security-associations command. After obtaining an index number from the command, use the show security ipsec security-associations index index_number detail command.

  total configured sa: 4
  ID    Gateway          Port  Algorithm          SPI      Life:sec/kb  Mon vsys
  <16384 2.2.2.2         500   ESP:aes-128/sha1   b2fc36f8 3364/ unlim   -   0
  >16384 2.2.2.2         500   ESP:aes-128/sha1   5d73929e 3364/ unlim   -   0
  ID    Gateway          Port  Algorithm          SPI      Life:sec/kb  Mon vsys
  <16385 3.3.3.2         500   ESP:3des/sha1      70f789c6 28756/unlim   -   0
  >16385 3.3.3.2         500   ESP:3des/sha1      80f4126d 28756/unlim   -   0

  Virtual-system: Root
  Local Gateway: 1.1.1.2, Remote Gateway: 3.3.3.2
  Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/24)
  Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
    DF-bit: clear
    Direction: inbound, SPI: 1895270854, AUX-SPI: 0
    Hard lifetime: Expires in 28729 seconds
    Lifesize Remaining: Unlimited
    Soft lifetime: Expires in 28136 seconds
    Mode: tunnel, Type: dynamic, State: installed, VPN Monitoring: -
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)    
    Anti-replay service: enabled, Replay window size: 32

    Direction: outbound, SPI: 2163479149, AUX-SPI: 0
    Hard lifetime: Expires in 28729 seconds
    Lifesize Remaining: Unlimited
    Soft lifetime: Expires in 28136 seconds
    Mode: tunnel, Type: dynamic, State: installed, VPN Monitoring: -
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)    
    Anti-replay service: enabled, Replay window size: 32

Meaning

The output from the show security ipsec security-associations command lists the following information:

• The ID number is 16385. Use this value with the show security ipsec security-associations index command to get more information about this particular SA.
• There is one IPsec SA pair using port 500, which indicates that no NAT-traversal is implemented. (NAT-traversal uses port 4500 or another random high-number port.)
• The SPIs, lifetime (in seconds), and usage limits (or lifesize in KB) are shown for both directions. The 28756/ unlim value indicates that the Phase 2 lifetime expires in 28756 seconds, and that no lifesize has been specified, which indicates that it is unlimited. Phase 2 lifetime can differ from Phase 1 lifetime, as Phase 2 is not dependent on Phase 1 after the VPN is up.
• VPN monitoring is not enabled for this SA, as indicated by a hyphen in the Mon column. If VPN monitoring is enabled, U indicates that monitoring is up, and D indicates that monitoring is down.
• The virtual system (vsys) is the root system, and it always lists 0.

The output from the show security ipsec security-associations index 16385 detail command lists the following information:

• The local identity and remote identity make up the proxy ID for the SA.

  A proxy ID mismatch is one of the most common causes for a Phase 2 failure. If no IPsec SA is listed, confirm that Phase 2 proposals, including the proxy ID settings, are correct for both peers. For route-based VPNs, the default proxy ID is local=0.0.0.0/0, remote=0.0.0.0/0, and service=any. Issues can occur with multiple route-based VPNs from the same peer IP. In this case, a unique proxy ID for each IPsec SA must be specified. For some third-party vendors, the proxy ID must be manually entered to match.

• Another common reason for Phase 2 failure is not specifying the ST interface binding. If IPsec cannot complete, check the kmd log or set traceoptions.

Verifying Next-Hop Tunnel Bindings

Purpose

After Phase 2 is complete for all peers, verify the next-hop tunnel bindings.

Action

From operational mode, enter the show security ipsec next-hop-tunnels command.

Next-hop gateway  interface    IPSec VPN name                Flag
10.11.11.11       st0.0        sunnyvale-vpn                 Static
10.11.11.12       st0.0        westford-vpn                  Auto

Meaning

The next-hop gateways are the IP addresses for the st0 interfaces of all remote spoke peers. The next hop should be associated with the correct IPsec VPN name. If no NHTB entry exists, there is no way for the hub device to differentiate which IPsec VPN is associated with which next hop.

The Flag field has one of the following values:

• Static— NHTB was manually configured in the st0.0 interface configurations, which is required if the peer is not an SRX Series device.
• Auto— NHTB was not configured, but the entry was automatically populated into the NHTB table during Phase 2 negotiations between two SRX Series devices

There is no NHTB table for any of the spoke sites in this example. From the spoke perspective, the st0 interface is still a point-to-point link with only one IPsec VPN binding.

Verifying Static Routes for Remote Peer Local LANs

Purpose

Verify that the static route references the spoke peer’s st0 IP address.

Action

From operational mode, enter the show route command.

inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

192.168.168.0/24   *[Static/5] 00:08:33
                    > to 10.11.11.11 via st0.0

inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

192.168.178.0/24   *[Static/5] 00:04:04
                    > to 10.11.11.12 via st0.0

The next hop is the remote peer’s st0 IP address, and both routes point to st0.0 as the outgoing interface.

Reviewing Statistics and Errors for an IPsec Security Association

Purpose

Review ESP and authentication header counters and errors for an IPsec security association.

Action

From operational mode, enter the show security ipsec statistics index command.

ESP Statistics:
  Encrypted bytes:              920
  Decrypted bytes:             6208
  Encrypted packets:              5
  Decrypted packets:             87
AH Statistics:
  Input bytes:                    0
  Output bytes:                   0
  Input packets:                  0
  Output packets:                 0
Errors:
  AH authentication failures: 0, Replay errors: 0
  ESP authentication failures: 0, ESP decryption failures: 0
  Bad headers: 0, Bad trailers: 0

You can also use the show security ipsec statistics command to review statistics and errors for all SAs.

To clear all IPsec statistics, use the clear security ipsec statistics command.

Meaning

If you see packet loss issues across a VPN, you can run the show security ipsec statistics or show security ipsec statistics detail command several times to confirm that the encrypted and decrypted packet counters are incrementing. You should also check whether the other error counters are incrementing.

Testing Traffic Flow Across the VPN

Purpose

Verify the traffic flow across the VPN.

Action

You can use the ping command from the SRX Series device to test traffic flow to a remote host PC. Make sure that you specify the source interface so that the route lookup is correct and the appropriate security zones are referenced during policy lookup.

From operational mode, enter the ping command.

PING 192.168.168.10 (192.168.168.10): 56 data bytes
64 bytes from 192.168.168.10: icmp_seq=0 ttl=127 time=8.287 ms
64 bytes from 192.168.168.10: icmp_seq=1 ttl=127 time=4.119 ms
64 bytes from 192.168.168.10: icmp_seq=2 ttl=127 time=5.399 ms
64 bytes from 192.168.168.10: icmp_seq=3 ttl=127 time=4.361 ms
64 bytes from 192.168.168.10: icmp_seq=4 ttl=127 time=5.137 ms

--- 192.168.168.10 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 4.119/5.461/8.287/1.490 ms

You can also use the ping command from the SSG Series device.

Type escape sequence to abort
Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 1 seconds from ethernet0/6
!!!!!
Success Rate is 100 percent (5/5), round-trip time min/avg/max=4/4/5 ms

Type escape sequence to abort
Sending 5, 100-byte ICMP Echos to 192.168.178.10, timeout is 1 seconds from
ethernet0/6
!!!!!
Success Rate is 100 percent (5/5), round-trip time min/avg/max=8/8/10 ms

Meaning

If the ping command fails from the SRX Series or SSG Series device, there might be a problem with the routing, security policies, end host, or encryption and decryption of ESP packets.