[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring the Local Gateway Address

If you configure an IPSec service set, you must also configure a local IPv4 or IPv6 address by including the local-gateway statement:

If the Internet Key Exchange (IKE) gateway IP address is in inet.0 (the default situation), you configure the following statement:local-gateway address;
If the IKE gateway IP address is in a VPN routing and forwarding (VRF) instance, you configure the following statement:local-gateway address routing-instance instance-name;

You can configure all the link-type tunnels that share the same local gateway address in a single next-hop-style service set. The value you specify for the inside-service-interface statement at the [edit services service-set service-set-name] hierarchy level should match the ipsec-inside-interface value, which you configure at the [edit services ipsec-vpn rule rule-name term term-name from] hierarchy level. For more information about IPSec configuration, see Configuring IPSec Service Rules.

You can configure Internet Key Exchange (IKE) gateway IP addresses that are present in a VPN routing and forwarding (VRF) instance as long as the peer is reachable through the VRF instance.

For next-hop service sets, the key management process (kmd) places the IKE packets in the routing instance that contains the outside-service-interface value you specify, as in this example:



routing-instances vrf-nxthop {
instance-type vrf;
interface sp-1/1/0.2;
...
}
services service-set service-set-1 {


next-hop-service {
inside-service-interface sp-1/1/0.1;
outside-service-interface sp-1/1/0.2;
}


...
}

For interface service sets, the service-interface statement determines the VRF, as in this example:



routing-instances vrf-intf {
instance-type vrf;
interface sp-1/1/0.3;
interface ge-1/2/0.1; # interface on which service set
is applied
...
}
services service-set service-set-2 {


interface-service {
service-interface sp-1/1/0.3; 
}


...
}

[Contents] [Prev] [Next] [Index] [Report an Error]