Ejemplo: configurar VPN IPSec en alta disponibilidad activa/activa de múltiples nodos en firewalls de la serie SRX en una red de capa 3
En este ejemplo, se muestra cómo configurar y comprobar VPN IPsec para la configuración de alta disponibilidad multinodo activa-activa.
Descripción general
La alta disponibilidad de múltiples nodos admite VPN IPsec en modo activo/activo con varios SRG1 (SRG1+). Cada SRG sigue funcionando en modo de copia de seguridad activa entre los dos nodos, pero diferentes SRG pueden estar activos en diferentes nodos. Este modelo permite establecer múltiples túneles IPsec activos desde ambos nodos simultáneamente, lo que permite el cifrado y descifrado en ambos nodos y mejora la utilización del ancho de banda.
En este ejemplo, se configura la alta disponibilidad multinodo (MNHA) entre dos firewalls y se establecen túneles VPN IPsec de alta disponibilidad desde el par de firewalls MNHA a un dispositivo par. El objetivo es garantizar que los túneles IPsec se puedan establecer y mantener con éxito con una tolerancia a fallos fluida entre los firewalls en la configuración de MNHA.
Ejemplo de requisitos previos
Requisitos de software |
|
Antes de empezar
Beneficios |
La VPN IPsec activa/activa en una configuración de MNHA mejora la disponibilidad y el rendimiento al permitir que ambos nodos terminen y reenvíen simultáneamente el tráfico VPN, lo que permite compartir la carga, una convergencia más rápida y una interrupción mínima del tráfico durante las fallas. |
Saber más |
|
Más información |
Descripción general funcional
Tecnologías utilizadas |
|
Tareas de verificación primaria |
|
Descripción general de la topología
En la figura 1 , se muestra la topología utilizada en este ejemplo.
Figura 1: Alta disponibilidad de múltiples nodos activo/activo en el despliegue
de capa 3
de capa 3
La topología demuestra un despliegue de VPN IPsec activo/activo que usa alta disponibilidad multinodo (MNHA) con dos firewalls que forman un clúster de MNHA y establecen túneles VPN IPsec a un firewall remoto (SRX-03).
El dispositivo SRX-03 actúa como un dispositivo par para la configuración de MNHA y establece túneles VPN IPsec individuales, cada uno con dispositivos SRX-01 y SRX-02. Desde la perspectiva de SRX-03, el par MNHA funciona como un único punto de conexión VPN lógico.
El tráfico desde el host interno fluye a través del enrutador 1 → la configuración de MNHA→ los túneles IPsec → el enrutador 2 → SRX-03 → el enrutador 3. El tráfico de retorno sigue las mismas rutas cifradas. En este ejemplo, se verifica la accesibilidad del tráfico desde el enrutador 3, donde SRX-03 (el dispositivo par) está conectado, al enrutador 1, que tiene una PC de host remoto conectada.
- SRX-01 y SRX-02 funcionan como un par MNHA con múltiples SRG (SRG1+), lo que permite que el tráfico se procese activamente en ambos nodos.
- Cada SRG se ejecuta internamente en modo activo-copia de respaldo, mientras que la solución general proporciona reenvío VPN activo-activo a través de SRG.
- Los nodos se conectan a través de un vínculo entre chasis (ICL) enrutado y cifrado en la zona de vínculos de alta disponibilidad mediante direcciones IP flotantes de circuito cerrado para sincronizar el control y el estado de VPN. En este ejemplo, el vínculo utiliza la interfaz ge-0/0/2.0 directamente entre dispositivos en lugar de pasar a través de una red enrutada intermedia.
- Las interfaces de zona de confianza conectan el clúster de MNHA hacia la red interna a través del enrutador 1 (AS 65030).
- Las interfaces de zona de no confianza conectan SRX-01 y SRX-02 al enrutador 2 (AS 65035), que proporciona accesibilidad ascendente hacia el sitio de VPN remoto.
- Interfaz de circuito cerrado (lo0.0) en cada host SRX Direcciones IP flotantes.
- SRX-03 termina los túneles VPN IPsec del clúster MNHA y se conecta al enrutador 3.
- El SRX remoto utiliza su propia interfaz de circuito cerrado como punto de conexión VPN, lo que garantiza la estabilidad del túnel independientemente del estado de la interfaz física.
- Las interfaces VPN se colocan en la zona VPN, lo que separa el tráfico cifrado de las redes de tránsito que no son de confianza.
- Se establecen varios túneles IPsec entre el clúster de MNHA y SRX-03, enlazados a diferentes SRG. Si se produce un error en un nodo o SRG, el tráfico se redirige al SRG activo restante sin renegociación de túnel, ya que los puntos de conexión VPN utilizan direcciones IP flotantes.
En la siguiente tabla, se muestran los detalles sobre la configuración de interfaces que se utilizan en este ejemplo.
| Dispositivo | Interfaz | Zona | Dirección IP | Configurado para |
|---|---|---|---|---|
SRX-01 |
lo0.0 | No confiar |
10.11.0.1/32 |
Dirección IP flotante Dirección de puerta de enlace IKE |
10.12.0.1/32 |
Dirección de puerta de enlace IKE |
|||
GE-0/0/2.0 |
Enlace de alta disponibilidad |
10.22.0.2/24 |
Conexión de ICL |
|
GE-0/0/4.0 |
No confiar |
10.5.0.1/24 |
Se conecta al enrutador R2 |
|
GE-0/0/3.0 |
Confianza |
10.3.0.2/24 |
Se conecta al enrutador R1 |
|
SRX-02 |
lo0.0 |
No confiar |
10.12.0.1/32 |
Dirección IP flotante Dirección de puerta de enlace IKE |
10.11.0.1/32 |
Dirección de puerta de enlace IKE |
|||
GE-0/0/2.0 |
Enlace de alta disponibilidad |
10.22.0.1/24 |
Conexión de ICL |
|
GE-0/0/3.0 |
Confianza |
10.2.0.2/24 |
Se conecta al enrutador R1 |
|
GE-0/0/4.0 |
No confiar |
10.4.0.1/24 |
Se conecta al enrutador R2 |
|
SRX-03 |
lo0.0 | No confiar |
10.112.0.1/32 |
Dirección de puerta de enlace IKE |
10.112.0.5/32 |
Dirección de puerta de enlace IKE |
|||
GE-0/0/0.0 |
No confiar |
10.7.0.1/24 |
Se conecta al enrutador R2 |
|
GE-0/0/1.0 |
Confianza |
10.6.0.2/24 |
Conecta el enrutador |
| Dispositivo | Interfaz | Dirección IP | Configurado para |
|---|---|---|---|
| Enrutador 2 (R2) | lo0 | 10.111.0.2/32 |
Dirección de interfaz de circuito cerrado de R2 |
GE-0/0/1 |
10.4.0.2/24 |
Se conecta a |
|
GE-0/0/0 |
10.5.0.2/24 |
Se conecta a |
|
GE-0/0/2 |
10.7.0.2/24 |
Se conecta a |
|
| Enrutador 1 (R1) | lo0 | 10.111.0.1/32 |
Dirección de interfaz de circuito cerrado de R1 |
GE-0/0/0 |
10.3.0.1/24 |
Se conecta a |
|
GE-0/0/1 |
10.2.0.1/24 |
Se conecta a |
|
|
|
Se conecta a la red del host | |
| Enrutador 3 (R3) | GE-0/0/0 |
10.6.0.1/24 |
Se conecta a |
| lo0 | 10.6.255.1/32 |
Dirección de interfaz de circuito cerrado de R3 |
Configurar firewalls
Configuración en dispositivo par VPN
Configure el dispositivo par VPN SRX-03 con las opciones de VPN IPsec correspondientes. Asegúrese de que los parámetros IKE e IPsec (pares, propuestas y políticas) coincidan con esas opciones en SRX-01 y SRX-02 para que los túneles funcionen correctamente.
Verificación
Utilice los comandos show para confirmar que la configuración funciona correctamente.
| Comando | Tarea de verificación |
|---|---|
|
Muestra detalles del estado de MNHA en su dispositivo de seguridad, incluido el estado de salud del nodo par. |
show security ike security-associationsshow securiti ipsec security-associations |
Muestra el estado de las conexiones VPN IPsec |
- Compruebe la configuración de alta disponibilidad de múltiples nodos
- Comprobar grupos de redundancia del servicio de alta disponibilidad multinodo
- Comprobar el estado de VPN IPsec
- Probar el flujo de tráfico a través de la VPN
- Verificar el estado de cifrado del vínculo de interchasis (ICL)
Compruebe la configuración de alta disponibilidad de múltiples nodos
Propósito
Vea y verifique los detalles de la configuración de alta disponibilidad multinodo configurada en su dispositivo de seguridad.
Acción
Desde el modo operativo, ejecute el siguiente comando:
SRX-01
user@srx-01> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Grid-id: 0
Local-id: 2
Local-IP: 10.22.0.2
HA Peer Information:
Peer Id: 1 IP address: 10.22.0.1 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Configured BFD Detection Time: 3 * 200ms
Cold Sync Status: COMPLETE
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: ROUTING
Status: BACKUP
Activeness Priority: 200
Preemption: ENABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
Services Redundancy Group: 2
Deployment Type: ROUTING
Status: ACTIVE
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: READY
SRX-02
user@srx-02> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Grid-id: 0
Local-id: 1
Local-IP: 10.22.0.1
HA Peer Information:
Peer Id: 2 IP address: 10.22.0.2 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Configured BFD Detection Time: 3 * 200ms
Cold Sync Status: COMPLETE
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: ROUTING
Status: ACTIVE
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 2
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: NOT READY
Services Redundancy Group: 2
Deployment Type: ROUTING
Status: BACKUP
Activeness Priority: 200
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 2
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
Significado
Compruebe estos detalles en el resultado del comando:
Detalles del nodo local y del nodo par, como la dirección IP y el ID.
El campo
Encrypted: YESindica que el tráfico está protegido.El campo
Deployment Type: ROUTINGindica una configuración de modo de capa 3, es decir, la red tiene enrutadores en ambos lados.El campo
Services Redundancy Group: 1eServices Redundancy Group: 2indicar el estado de SRG1 y SRG2 (activo o de respaldo) en ese nodo.
Comprobar grupos de redundancia del servicio de alta disponibilidad multinodo
Propósito
Compruebe que los SRG estén configurados y funcionen correctamente.
Acción
Desde el modo operativo, ejecute el siguiente comando:
user@srx-01> show chassis high-availability services-redundancy-group 1
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: ROUTING
Status: BACKUP
Activeness Priority: 200
Preemption: ENABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
Signal Route Info:
Active Signal Route:
IP: 10.39.1.1
Routing Instance: default
Status: NOT INSTALLED
Backup Signal Route:
IP: 10.39.1.2
Routing Instance: default
Status: INSTALLED
Split-brain Prevention Probe Info:
DST-IP: 10.111.0.1
SRC-IP: 10.3.0.2
Routing Instance: default
Type: ICMP Probe
Status: NOT RUNNING
Result: N/A Reason: N/A
BFD Monitoring:
Status: UNKNOWN
SRC-IP: 10.5.0.1 DST-IP: 10.5.0.2
Routing Instance: default
Type: SINGLE-HOP
IFL Name: ge-0/0/3.0
State: INSTALLED
Interface Monitoring:
Status: UP
IF Name: ge-0/0/4 State: Up
IF Name: ge-0/0/3 State: Up
IP SRGID Table:
SRGID IP Prefix Routing Table
1 10.11.0.0/24 default
user@srx-01> show chassis high-availability services-redundancy-group 2
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 2
Deployment Type: ROUTING
Status: ACTIVE
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: READY
Signal Route Info:
Active Signal Route:
IP: 10.49.1.1
Routing Instance: default
Status: INSTALLED
Backup Signal Route:
IP: 10.49.1.2
Routing Instance: default
Status: NOT INSTALLED
Split-brain Prevention Probe Info:
DST-IP: 10.111.0.1
SRC-IP: 10.12.0.1
Routing Instance: default
Type: ICMP Probe
Status: NOT RUNNING
Result: N/A Reason: N/A
BFD Monitoring:
Status: UNKNOWN
SRC-IP: 10.5.0.1 DST-IP: 10.5.0.2
Routing Instance: default
Type: SINGLE-HOP
IFL Name: ge-0/0/3.0
State: INSTALLED
Interface Monitoring:
Status: UP
IF Name: ge-0/0/4 State: Up
IF Name: ge-0/0/3 State: Up
IP SRGID Table:
SRGID IP Prefix Routing Table
2 10.12.0.0/24 default
Significado
Compruebe estos detalles en el resultado del comando:
Detalles del nodo emparejado, como el tipo de despliegue, el estado, las rutas de señal activas y de respaldo.
Sonda de prevención de cerebro dividido, monitoreo de IP y estado de monitoreo de BFD.
Tabla de prefijos IP asociada.
Comprobar el estado de VPN IPsec
Propósito
Confirme el estado de VPN comprobando el estado de cualquier asociación de seguridad de IKE en el nivel de SRG.
Acción
Ejecute los siguientes comandos en SRX-01, SRX-02 y SRX-03 (dispositivo par VPN):
SRX-01
user@srx-01> show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 16777489 UP 1fef3ef467ee0439 8c2139689c37cbc8 IKEv2 10.112.0.1 33554706 UP a3eb35ebcb216367 2ad794a8e09152c4 IKEv2 10.112.0.5
user@srx-01> show security ike security-associations srg-id 1 Index State Initiator cookie Responder cookie Mode Remote Address 16777489 UP 1fef3ef467ee0439 8c2139689c37cbc8 IKEv2 10.112.0.1 16777491 UP 81dc38812e7869d0 f6c9b8cddd8228a6 IKEv2 10.112.0.1
user@srx-01> show security ike security-associations srg-id 2 Index State Initiator cookie Responder cookie Mode Remote Address 33554706 UP a3eb35ebcb216367 2ad794a8e09152c4 IKEv2 10.112.0.5
user@srx-01> show security ipsec security-associations Total active tunnels: 2 Total IPsec sas: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <17277217 ESP:aes-cbc-256/sha256 0x27ea1472 1225/ unlim - root 500 10.112.0.1 >17277217 ESP:aes-cbc-256/sha256 0x4f257994 1225/ unlim - root 500 10.112.0.1 <34054492 ESP:aes-cbc-256/sha256 0x5b93d8cb 1078/ unlim - root 500 10.112.0.5 >34054492 ESP:aes-cbc-256/sha256 0x7c1356b8 1078/ unlim - root 500 10.112.0.5
user@srx-01> show security ipsec statistics ESP Statistics: Encrypted bytes: 5772 Decrypted bytes: 2604 Encrypted packets: 37 Decrypted packets: 31 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication failures: 0, Replay errors: 0 ESP authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0 Invalid SPI: 0, TS check fail: 0 Exceeds tunnel MTU: 0 Discarded: 0
SRX-02
user@srx-02> show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 16777503 UP ed0571780c0e05a7 9d760fc5677e5072 IKEv2 10.112.0.1 33554720 UP 8b6ca20b53f20e90 4249b4b9afe23888 IKEv2 10.112.0.5
user@srx-02> show security ike security-associations srg-id 1 Index State Initiator cookie Responder cookie Mode Remote Address 16777503 UP ed0571780c0e05a7 9d760fc5677e5072 IKEv2 10.112.0.1
user@srx-02> show security ike security-associations srg-id 2 Index State Initiator cookie Responder cookie Mode Remote Address 33554720 UP 8b6ca20b53f20e90 4249b4b9afe23888 IKEv2 10.112.0.5
user@srx-01> show security ipsec security-associations
Total active tunnels: 2 Total IPsec sas: 2
ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway
<17277217 ESP:aes-cbc-256/sha256 0xba7f1385 1524/ unlim - root 500 10.112.0.1
>17277217 ESP:aes-cbc-256/sha256 0x8dd71e97 1524/ unlim - root 500 10.112.0.1
<34054492 ESP:aes-cbc-256/sha256 0xb9de9d4b 1136/ unlim - root 500 10.112.0.5
>34054492 ESP:aes-cbc-256/sha256 0x5daab807 1136/ unlim - root 500 10.112.0.5
SRX-03
user@srx-03> show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 305 UP ed0571780c0e05a7 9d760fc5677e5072 IKEv2 10.11.0.1 306 UP 8b6ca20b53f20e90 4249b4b9afe23888 IKEv2 10.12.0.1
user@srx-03> show security ipsec security-associations Total active tunnels: 2 Total IPsec sas: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <500064 ESP:aes-cbc-256/sha256 0x5daab807 1014/ unlim - root 500 10.12.0.1 >500064 ESP:aes-cbc-256/sha256 0xb9de9d4b 1014/ unlim - root 500 10.12.0.1 <500063 ESP:aes-cbc-256/sha256 0x8dd71e97 1402/ unlim - root 500 10.11.0.1 >500063 ESP:aes-cbc-256/sha256 0xba7f1385 1402/ unlim - root 500 10.11.0.1
user@srx-03> show security ipsec statistics ESP Statistics: Encrypted bytes: 5928 Decrypted bytes: 3192 Encrypted packets: 38 Decrypted packets: 38 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication failures: 0, Replay errors: 0 ESP authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0 Invalid SPI: 0, TS check fail: 0 Exceeds tunnel MTU: 0 Discarded: 0
Significado
Compruebe estos detalles en el resultado del comando:
- Direcciones IP de los pares remotos.
- El estado que aparece ACTIVO para ambos pares remotos indica la asociación correcta del establecimiento de la fase 1 y la fase 2.
- La dirección IP del par remoto, la política de IKE y las interfaces externas son correctas.
- Los túneles IPsec están activos, pasan tráfico activamente y funcionan sin errores
Probar el flujo de tráfico a través de la VPN
Propósito
Compruebe el flujo de tráfico a través de la VPN.
Acción
Use el ping comando del enrutador 3, que está conectado al firewall VPN par (SRX-03), para probar el flujo de tráfico al enrutador 1, donde está conectado el host.
Desde el modo operativo, introduzca el ping comando.
user@router-03> ping 10.1.0.1 source 10.6.0.1 count 2 PING 10.1.0.1 (10.1.0.1): 56 data bytes 64 bytes from 10.1.0.1: icmp_seq=0 ttl=62 time=16.757 ms 64 bytes from 10.1.0.1: icmp_seq=1 ttl=62 time=4.536 ms --- 10.1.0.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.536/10.646/16.757/6.111 ms
user@router-03> ping 10.1.1.1 source 10.6.255.1 count 2 PING 10.1.1.1 (10.1.1.1): 56 data bytes 64 bytes from 10.1.1.1: icmp_seq=0 ttl=62 time=4.747 ms 64 bytes from 10.1.1.1: icmp_seq=1 ttl=62 time=4.876 ms --- 10.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.747/4.812/4.876/0.064 ms
Significado
Este resultado de ping confirma la conectividad correcta de extremo a extremo a través de la VPN IPsec entre el sitio remoto y la red interna.
Si se produce un error en el ping comando, es posible que exista un problema con el enrutamiento, las políticas de seguridad, el host final o el cifrado y descifrado de los paquetes ESP
Verificar el estado de cifrado del vínculo de interchasis (ICL)
Propósito
Verifique el estado del vínculo de interchasis (ICL).
Acción
Ejecute el comando siguiente en SRX-01:
user@srx-01> show security ipsec security-associations ha-link-encryption detail
ID: 495005 Virtual-system: root, VPN Name: L3HA_IPSEC_VPN
Local Gateway: 10.22.0.2, Remote Gateway: 10.22.0.1
Traffic Selector Name: __L3HA_IPSEC_VPN__ICL__1__0__multi_node__
Local Identity: ipv4(180.100.1.2-180.100.1.2)
Remote Identity: ipv4(180.100.1.1-180.100.1.1)
TS Type: traffic-selector
Version: IKEv2
Quantum Secured: No
Hardware Offloaded: No
PFS group: N/A, Packet Encapsulation: None, Dest port: 0
Passive mode tunneling: Disabled
DF-bit: clear, Copy-Outer-DSCP: Disabled, Bind-interface: st0.16000, Policy-name: L3HA_IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
HA Link Encryption Mode: Inter-Chassis-Link
Location: FPC -, PIC -
Anchorship: Thread -
Distribution-Profile: default-profile
Direction: inbound, SPI: 0x000a3f8b, AUX-SPI: 0
, VPN Monitoring: UP Mode: Always-Send Interval: 10secs Threshold: 10
Hard lifetime: Expires in 288 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 220 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 0, PIC 0
Anchorship: Thread 0
IKE SA Index: 16777052
Direction: outbound, SPI: 0x000449f7, AUX-SPI: 0
, VPN Monitoring: UP Mode: Always-Send Interval: 10secs Threshold: 10
Hard lifetime: Expires in 288 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 220 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 0, PIC 0
Anchorship: Thread 0
IKE SA Index: 16777052
Significado
La salida del comando proporciona las SA de IPsec que se usan para cifrar el vínculo ICL de MNHA. Protege el tráfico de control, enrutamiento y sincronización de estado entre SRX-01 y SRX-02
PRECAUCIÓN:
El rango de IP (180.100.1.x) que se muestra en la salida del comando sirve como selector de tráfico IPsec de ICL. El sistema asigna dinámicamente este rango de IP, y es fundamental no alterarlo ni modificarlo. Además, BFD (detección de reenvío bidireccional) se habilitará automáticamente para el rango IP 180.x.x.x más amplio.
Establecer comandos en todos los dispositivos
- Firewall virtual vSRX (SRX-01)
- Firewall virtual vSRX (SRX-02)
- Firewall virtual vSRX (SRX-03)
- Enrutador 1
- Enrutador 2
- Enrutador 3
Firewall virtual vSRX (SRX-01)
set chassis high-availability local-id 2 set chassis high-availability local-id local-ip 10.22.0.2 set chassis high-availability peer-id 1 peer-ip 10.22.0.1 set chassis high-availability peer-id 1 interface ge-0/0/2.0 set chassis high-availability peer-id 1 vpn-profile L3HA_IPSEC_VPN set chassis high-availability peer-id 1 liveness-detection minimum-interval 200 set chassis high-availability peer-id 1 liveness-detection multiplier 3 set chassis high-availability services-redundancy-group 1 deployment-type routing set chassis high-availability services-redundancy-group 1 peer-id 1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip src-ip 10.3.0.2 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 src-ip 10.5.0.1 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 session-type singlehop set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 1 active-signal-route 10.39.1.1 set chassis high-availability services-redundancy-group 1 backup-signal-route 10.39.1.2 set chassis high-availability services-redundancy-group 1 prefix-list SRG1_PFX set chassis high-availability services-redundancy-group 1 managed-services ipsec set chassis high-availability services-redundancy-group 1 preemption set chassis high-availability services-redundancy-group 1 activeness-priority 200 set chassis high-availability services-redundancy-group 2 peer-id 1 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip src-ip 10.12.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 src-ip 10.5.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 session-type singlehop set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 2 active-signal-route 10.49.1.1 set chassis high-availability services-redundancy-group 2 backup-signal-route 10.49.1.2 set chassis high-availability services-redundancy-group 2 prefix-list SRG2_PFX set chassis high-availability services-redundancy-group 2 managed-services ipsec set chassis high-availability services-redundancy-group 2 activeness-priority 1 set security ike proposal L3HA_IKE_PROP description l3ha_link_encr_tunnel set security ike proposal L3HA_IKE_PROP authentication-method pre-shared-keys set security ike proposal L3HA_IKE_PROP dh-group group14 set security ike proposal L3HA_IKE_PROP authentication-algorithm sha-256 set security ike proposal L3HA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal L3HA_IKE_PROP lifetime-seconds 300 set security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG1_IKE_PROP dh-group group14 set security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG1_IKE_PROP lifetime-seconds 3600 set security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG2_IKE_PROP dh-group group14 set security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG2_IKE_PROP lifetime-seconds 3600 set security ike policy L3HA_IKE_POL description l3ha_link_encr_tunnel set security ike policy L3HA_IKE_POL proposals L3HA_IKE_PROP set security ike policy L3HA_IKE_POL pre-shared-key ascii-text "$abc123" set security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP set security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$abc123" set security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP set security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$abc123" set security ike gateway L3HA_IKE_GW ike-policy L3HA_IKE_POL set security ike gateway L3HA_IKE_GW version v2-only set security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1 set security ike gateway SRG1_IKE_GW1 address 10.112.0.1 set security ike gateway SRG1_IKE_GW1 external-interface lo0 set security ike gateway SRG1_IKE_GW1 local-address 10.11.0.1 set security ike gateway SRG1_IKE_GW1 version v2-only set security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500 set security ike gateway SRG2_IKE_GW500 address 10.112.0.5 set security ike gateway SRG2_IKE_GW500 external-interface lo0 set security ike gateway SRG2_IKE_GW500 local-address 10.12.0.1 set security ike gateway SRG2_IKE_GW500 version v2-only set security ipsec proposal L3HA_IPSEC_PROP description l3ha_link_encr_tunnel set security ipsec proposal L3HA_IPSEC_PROP protocol esp set security ipsec proposal L3HA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal L3HA_IPSEC_PROP lifetime-seconds 300 set security ipsec proposal SRG1_IPSEC_PROP protocol esp set security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800 set security ipsec proposal SRG2_IPSEC_PROP protocol esp set security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800 set security ipsec policy L3HA_IPSEC_POL description l3ha_link_encr_tunnel set security ipsec policy L3HA_IPSEC_POL proposals L3HA_IPSEC_PROP set security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL501 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL502 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL503 proposals SRG2_IPSEC_PROP set security ipsec vpn L3HA_IPSEC_VPN ha-link-encryption set security ipsec vpn L3HA_IPSEC_VPN ike gateway L3HA_IKE_GW set security ipsec vpn L3HA_IPSEC_VPN ike ipsec-policy L3HA_IPSEC_POL set security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1 set security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1 set security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1 set security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels on-traffic set security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500 set security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500 set security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.1.1.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.6.255.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels on-traffic set security zones security-zone vpn host-inbound-traffic system-services ping set security zones security-zone vpn host-inbound-traffic protocols bgp set security zones security-zone vpn host-inbound-traffic protocols bfd set security zones security-zone vpn interfaces st0.1 set security zones security-zone vpn interfaces st0.500 set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services ssh set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces lo0.0 set security zones security-zone untrust interfaces ge-0/0/4.0 set security zones security-zone trust host-inbound-traffic system-services ike set security zones security-zone trust host-inbound-traffic system-services ping set security zones security-zone trust host-inbound-traffic system-services ssh set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust host-inbound-traffic protocols bgp set security zones security-zone trust host-inbound-traffic protocols bfd set security zones security-zone trust interfaces ge-0/0/3.0 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/2.0 set security policies default-policy permit-all set interfaces ge-0/0/1 unit 0 family inet set interfaces ge-0/0/2 description ha_link set interfaces ge-0/0/2 unit 0 family inet address 10.22.0.2/24 set interfaces ge-0/0/3 description trust set interfaces ge-0/0/3 unit 0 family inet address 10.3.0.2/24 set interfaces ge-0/0/4 description route2 set interfaces ge-0/0/4 unit 0 family inet address 10.5.0.1/24 set interfaces lo0 description untrust set interfaces lo0 unit 0 family inet address 10.11.0.1/32 set interfaces lo0 unit 0 family inet address 10.12.0.1/32 set interfaces st0 unit 1 family inet set interfaces st0 unit 1 family inet6 set interfaces st0 unit 500 family inet set interfaces st0 unit 500 family inet6 set policy-options prefix-list SRG1_PFX 10.11.0.0/24 set policy-options prefix-list SRG2_PFX 10.12.0.0/24 set policy-options route-filter-list srg1_rf_list 10.11.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.1.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.6.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.12.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.1.1.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.6.255.0/24 orlonger set policy-options policy-statement ipsec_pol term 1 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 1 from condition active_route_exists_srg1 set policy-options policy-statement ipsec_pol term 1 then metric 10 set policy-options policy-statement ipsec_pol term 1 then accept set policy-options policy-statement ipsec_pol term 2 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 2 from condition backup_route_exists_srg1 set policy-options policy-statement ipsec_pol term 2 then metric 20 set policy-options policy-statement ipsec_pol term 2 then accept set policy-options policy-statement ipsec_pol term 3 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 3 from condition active_route_exists_srg2 set policy-options policy-statement ipsec_pol term 3 then metric 10 set policy-options policy-statement ipsec_pol term 3 then accept set policy-options policy-statement ipsec_pol term 4 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 4 from condition backup_route_exists_srg2 set policy-options policy-statement ipsec_pol term 4 then metric 20 set policy-options policy-statement ipsec_pol term 4 then accept set policy-options policy-statement ipsec_pol term default then reject set policy-options condition active_route_exists_srg1 if-route-exists address-family inet 10.39.1.1/32 set policy-options condition active_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet 10.49.1.1/32 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet 10.39.1.2/32 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet 10.49.1.2/32 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet table inet.0 set protocols bgp group 65030 type internal set protocols bgp group 65030 local-address 10.3.0.2 set protocols bgp group 65030 export ipsec_pol set protocols bgp group 65030 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65030 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65030 bfd-liveness-detection multiplier 3 set protocols bgp group 65030 neighbor 10.3.0.1 set protocols bgp group 65035 type external set protocols bgp group 65035 export ipsec_pol set protocols bgp group 65035 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65035 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65035 bfd-liveness-detection multiplier 3 set protocols bgp group 65035 neighbor 10.5.0.2 peer-as 65035 set routing-options autonomous-system 65030 set routing-options static route 10.6.0.1/32 next-hop st0.1 set routing-options static route 10.7.0.0/16 next-hop 10.5.0.2 set routing-options static route 10.112.0.0/24 next-hop 10.5.0.2
Firewall virtual vSRX (SRX-02)
set chassis high-availability local-id 1 set chassis high-availability local-id local-ip 10.22.0.1 set chassis high-availability peer-id 2 peer-ip 10.22.0.2 set chassis high-availability peer-id 2 interface ge-0/0/2.0 set chassis high-availability peer-id 2 vpn-profile L3HA_IPSEC_VPN set chassis high-availability peer-id 2 liveness-detection minimum-interval 200 set chassis high-availability peer-id 2 liveness-detection multiplier 3 set chassis high-availability services-redundancy-group 1 deployment-type routing set chassis high-availability services-redundancy-group 1 peer-id 2 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip src-ip 10.2.0.2 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 src-ip 10.4.0.1 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 session-type singlehop set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 1 active-signal-route 10.39.1.1 set chassis high-availability services-redundancy-group 1 backup-signal-route 10.39.1.2 set chassis high-availability services-redundancy-group 1 prefix-list SRG1_PFX set chassis high-availability services-redundancy-group 1 managed-services ipsec set chassis high-availability services-redundancy-group 1 activeness-priority 1 set chassis high-availability services-redundancy-group 2 peer-id 2 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip src-ip 10.12.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 src-ip 10.4.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 session-type singlehop set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 2 active-signal-route 10.49.1.1 set chassis high-availability services-redundancy-group 2 backup-signal-route 10.49.1.2 set chassis high-availability services-redundancy-group 2 prefix-list SRG2_PFX set chassis high-availability services-redundancy-group 2 managed-services ipsec set chassis high-availability services-redundancy-group 2 activeness-priority 200 set security ike proposal L3HA_IKE_PROP description l3ha_link_encr_tunnel set security ike proposal L3HA_IKE_PROP authentication-method pre-shared-keys set security ike proposal L3HA_IKE_PROP dh-group group14 set security ike proposal L3HA_IKE_PROP authentication-algorithm sha-256 set security ike proposal L3HA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal L3HA_IKE_PROP lifetime-seconds 300 set security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG1_IKE_PROP dh-group group14 set security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG1_IKE_PROP lifetime-seconds 3600 set security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG2_IKE_PROP dh-group group14 set security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG2_IKE_PROP lifetime-seconds 3600 set security ike policy L3HA_IKE_POL description l3ha_link_encr_tunnel set security ike policy L3HA_IKE_POL proposals L3HA_IKE_PROP set security ike policy L3HA_IKE_POL pre-shared-key ascii-text "$abc123" set security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP set security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$abc123" set security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP set security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$abc123" set security ike gateway L3HA_IKE_GW ike-policy L3HA_IKE_POL set security ike gateway L3HA_IKE_GW version v2-only set security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1 set security ike gateway SRG1_IKE_GW1 address 10.112.0.1 set security ike gateway SRG1_IKE_GW1 external-interface lo0 set security ike gateway SRG1_IKE_GW1 local-address 10.11.0.1 set security ike gateway SRG1_IKE_GW1 version v2-only set security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500 set security ike gateway SRG2_IKE_GW500 address 10.112.0.5 set security ike gateway SRG2_IKE_GW500 external-interface lo0 set security ike gateway SRG2_IKE_GW500 local-address 10.12.0.1 set security ike gateway SRG2_IKE_GW500 version v2-only set security ipsec proposal L3HA_IPSEC_PROP description l3ha_link_encr_tunnel set security ipsec proposal L3HA_IPSEC_PROP protocol esp set security ipsec proposal L3HA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal L3HA_IPSEC_PROP lifetime-seconds 300 set security ipsec proposal SRG1_IPSEC_PROP protocol esp set security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800 set security ipsec proposal SRG2_IPSEC_PROP protocol esp set security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800 set security ipsec policy L3HA_IPSEC_POL description l3ha_link_encr_tunnel set security ipsec policy L3HA_IPSEC_POL proposals L3HA_IPSEC_PROP set security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL501 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL502 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL503 proposals SRG2_IPSEC_PROP set security ipsec vpn L3HA_IPSEC_VPN ha-link-encryption set security ipsec vpn L3HA_IPSEC_VPN ike gateway L3HA_IKE_GW set security ipsec vpn L3HA_IPSEC_VPN ike ipsec-policy L3HA_IPSEC_POL set security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1 set security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1 set security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1 set security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels on-traffic set security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500 set security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500 set security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.1.1.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.6.255.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels on-traffic set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services ssh set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces lo0.0 set security zones security-zone untrust interfaces ge-0/0/4.0 set security zones security-zone vpn host-inbound-traffic system-services ping set security zones security-zone vpn host-inbound-traffic protocols bgp set security zones security-zone vpn host-inbound-traffic protocols bfd set security zones security-zone vpn interfaces st0.1 set security zones security-zone vpn interfaces st0.500 set security zones security-zone trust host-inbound-traffic system-services ike set security zones security-zone trust host-inbound-traffic system-services ping set security zones security-zone trust host-inbound-traffic system-services ssh set security zones security-zone trust host-inbound-traffic protocols bgp set security zones security-zone trust host-inbound-traffic protocols bfd set security zones security-zone trust interfaces ge-0/0/3.0 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/2.0 set security policies default-policy permit-all set interfaces ge-0/0/1 unit 0 family inet set interfaces ge-0/0/2 description ha_link set interfaces ge-0/0/2 unit 0 family inet address 10.22.0.1/24 set interfaces ge-0/0/3 description trust set interfaces ge-0/0/3 unit 0 family inet address 10.2.0.2/24 set interfaces ge-0/0/4 description router2 set interfaces ge-0/0/4 unit 0 family inet address 10.4.0.1/24 set interfaces lo0 unit 0 family inet address 10.11.0.1/32 set interfaces lo0 unit 0 family inet address 10.12.0.1/32 set interfaces st0 unit 1 family inet set interfaces st0 unit 1 family inet6 set interfaces st0 unit 500 family inet set interfaces st0 unit 500 family inet6 set policy-options prefix-list SRG1_PFX 10.11.0.0/24 set policy-options prefix-list SRG2_PFX 10.12.0.0/24 set policy-options route-filter-list srg1_rf_list 10.11.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.1.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.6.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.12.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.1.1.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.6.255.0/24 orlonger set policy-options policy-statement ipsec_pol term 1 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 1 from condition active_route_exists_srg1 set policy-options policy-statement ipsec_pol term 1 then metric 10 set policy-options policy-statement ipsec_pol term 1 then accept set policy-options policy-statement ipsec_pol term 2 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 2 from condition backup_route_exists_srg1 set policy-options policy-statement ipsec_pol term 2 then metric 20 set policy-options policy-statement ipsec_pol term 2 then accept set policy-options policy-statement ipsec_pol term 3 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 3 from condition active_route_exists_srg2 set policy-options policy-statement ipsec_pol term 3 then metric 10 set policy-options policy-statement ipsec_pol term 3 then accept set policy-options policy-statement ipsec_pol term 4 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 4 from condition backup_route_exists_srg2 set policy-options policy-statement ipsec_pol term 4 then metric 20 set policy-options policy-statement ipsec_pol term 4 then accept set policy-options policy-statement ipsec_pol term default then reject set policy-options condition active_route_exists_srg1 if-route-exists address-family inet 10.39.1.1/32 set policy-options condition active_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet 10.49.1.1/32 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet 10.39.1.2/32 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet 10.49.1.2/32 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet table inet.0 set protocols bgp group 65030 type internal set protocols bgp group 65030 local-address 10.2.0.2 set protocols bgp group 65030 export ipsec_pol set protocols bgp group 65030 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65030 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65030 bfd-liveness-detection multiplier 3 set protocols bgp group 65030 neighbor 10.2.0.1 set protocols bgp group 65035 type external set protocols bgp group 65035 export ipsec_pol set protocols bgp group 65035 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65035 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65035 bfd-liveness-detection multiplier 3 set protocols bgp group 65035 neighbor 10.4.0.2 peer-as 65035 set routing-options autonomous-system 65030 set routing-options static route 10.6.0.1/32 next-hop st0.1 set routing-options static route 10.7.0.0/24 next-hop 10.4.0.2 set routing-options static route 10.112.0.0/24 next-hop 10.4.0.2
Firewall virtual vSRX (SRX-03)
set security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG1_IKE_PROP dh-group group14 set security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG1_IKE_PROP lifetime-seconds 3600 set security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG2_IKE_PROP dh-group group14 set security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG2_IKE_PROP lifetime-seconds 3600 set security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP set security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$abc123" set security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP set security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$abc123" set security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1 set security ike gateway SRG1_IKE_GW1 address 10.11.0.1 set security ike gateway SRG1_IKE_GW1 external-interface lo0 set security ike gateway SRG1_IKE_GW1 local-address 10.112.0.1 set security ike gateway SRG1_IKE_GW1 version v2-only set security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500 set security ike gateway SRG2_IKE_GW500 address 10.12.0.1 set security ike gateway SRG2_IKE_GW500 external-interface lo0 set security ike gateway SRG2_IKE_GW500 local-address 10.112.0.5 set security ike gateway SRG2_IKE_GW500 version v2-only set security ipsec proposal SRG1_IPSEC_PROP protocol esp set security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800 set security ipsec proposal SRG2_IPSEC_PROP protocol esp set security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800 set security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP set security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1 set security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1 set security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1 set security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels immediately set security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500 set security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500 set security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.6.255.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.1.1.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels immediately set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services ssh set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust interfaces lo0.0 set security zones security-zone trust host-inbound-traffic system-services ike set security zones security-zone trust host-inbound-traffic system-services ping set security zones security-zone trust host-inbound-traffic system-services ssh set security zones security-zone trust host-inbound-traffic protocols bgp set security zones security-zone trust host-inbound-traffic protocols bfd set security zones security-zone trust interfaces ge-0/0/1.0 set security zones security-zone vpn host-inbound-traffic system-services ping set security zones security-zone vpn host-inbound-traffic protocols bgp set security zones security-zone vpn host-inbound-traffic protocols bfd set security zones security-zone vpn interfaces st0.1 set security zones security-zone vpn interfaces st0.500 set security policies default-policy permit-all set interfaces ge-0/0/0 description untrust set interfaces ge-0/0/0 unit 0 family inet address 10.7.0.1/24 set interfaces ge-0/0/1 description trust set interfaces ge-0/0/1 unit 0 family inet address 10.6.0.2/24 set interfaces lo0 unit 0 family inet address 10.112.0.1/32 set interfaces lo0 unit 0 family inet address 10.112.0.5/32 set interfaces st0 unit 1 family inet set interfaces st0 unit 500 family inet set routing-options autonomous-system 100 set routing-options static route 10.1.0.1/32 next-hop st0.1 set routing-options static route 10.4.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.5.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.6.255.0/24 next-hop 10.6.0.1 set routing-options static route 10.11.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.12.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.111.0.1/32 next-hop 10.7.0.2 set routing-options static route 10.111.0.2/32 next-hop 10.7.0.2
Enrutador 1
set interfaces ge-0/0/0 description srx1 set interfaces ge-0/0/0 unit 0 family inet address 10.3.0.1/24 set interfaces ge-0/0/1 description srx2 set interfaces ge-0/0/1 unit 0 family inet address 10.2.0.1/24 set interfaces ge-0/0/2 description host set interfaces ge-0/0/2 vlan-tagging set interfaces ge-0/0/2 unit 100 vlan-id 100 set interfaces ge-0/0/2 unit 100 family inet address 10.1.0.1/24 set interfaces ge-0/0/2 unit 101 vlan-id 101 set interfaces ge-0/0/2 unit 101 family inet address 10.1.1.1/24 set interfaces lo0 unit 0 family inet address 10.111.0.1/32 primary set interfaces lo0 unit 0 family inet address 10.111.0.1/32 preferred set policy-options policy-statement host term 1 from route-filter 10.1.0.0/24 exact set policy-options policy-statement host term 1 from route-filter 10.1.1.0/24 exact set policy-options policy-statement host term 1 then accept set routing-options autonomous-system 65030 set routing-options static route 10.4.0.0/24 next-hop 10.2.0.2 set routing-options static route 10.5.0.0/24 next-hop 10.3.0.2 set protocols bgp group srx2 type internal set protocols bgp group srx2 local-address 10.2.0.1 set protocols bgp group srx2 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx2 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx2 bfd-liveness-detection multiplier 3 set protocols bgp group srx2 neighbor 10.2.0.2 set protocols bgp group srx1 type internal set protocols bgp group srx1 local-address 10.3.0.1 set protocols bgp group srx1 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx1 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx1 bfd-liveness-detection multiplier 3 set protocols bgp group srx1 neighbor 10.3.0.2 set protocols bgp export host
Enrutador 2
set interfaces ge-0/0/0 description srx1 set interfaces ge-0/0/0 unit 0 family inet address 10.5.0.2/24 set interfaces ge-0/0/1 description srx2 set interfaces ge-0/0/1 unit 0 family inet address 10.4.0.2/24 set interfaces ge-0/0/2 description srx3 set interfaces ge-0/0/2 unit 0 family inet address 10.7.0.2/24 set interfaces lo0 unit 0 family inet address 10.111.0.2/32 primary set interfaces lo0 unit 0 family inet address 10.111.0.2/32 preferred set routing-options autonomous-system 65035 set routing-options static route 10.112.0.0/24 next-hop 10.7.0.1 set protocols bgp group srx2 type external set protocols bgp group srx2 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx2 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx2 bfd-liveness-detection multiplier 3 set protocols bgp group srx2 neighbor 10.4.0.1 peer-as 65030 set protocols bgp group srx1 type external set protocols bgp group srx1 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx1 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx1 bfd-liveness-detection multiplier 3 set protocols bgp group srx1 neighbor 10.5.0.1 peer-as 65030
Enrutador 3
set interfaces ge-0/0/0 unit 0 family inet address 10.6.0.1/24 set interfaces lo0 unit 0 family inet address 10.6.255.1/32 set routing-options static route 10.1.0.0/24 next-hop 10.6.0.2 set routing-options static route 10.1.1.0/24 next-hop 10.6.0.2 set routing-options static route 10.111.0.1/32 next-hop 10.6.0.2 set routing-options static route 10.112.0.1/32 next-hop 10.6.0.2
mostrar salida de configuración
Desde el modo de configuración, ingrese los comandos , y show interfaces para confirmar la show high availabilityshow security zonesconfiguración. Si el resultado no muestra la configuración deseada, repita las instrucciones de configuración de este ejemplo para corregirla.
Firewall virtual vSRX (SRX-01)
user@srx-01# show chassis high-availability
chassis {
high-availability {
local-id {
2;
local-ip 10.22.0.2;
}
peer-id 1 {
peer-ip 10.22.0.1;
interface ge-0/0/2.0;
vpn-profile L3HA_IPSEC_VPN;
liveness-detection {
minimum-interval 200;
multiplier 3;
}
}
services-redundancy-group 1 {
deployment-type routing;
peer-id {
1;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.3.0.2;
}
}
monitor {
bfd-liveliness 10.5.0.2 {
src-ip 10.5.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.39.1.1;
}
backup-signal-route {
10.39.1.2;
}
prefix-list SRG1_PFX;
managed-services ipsec;
preemption;
activeness-priority 200;
}
services-redundancy-group 2 {
peer-id {
1;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.12.0.1;
}
}
monitor {
bfd-liveliness 10.5.0.2 {
src-ip 10.5.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.49.1.1;
}
backup-signal-route {
10.49.1.2;
}
prefix-list SRG2_PFX;
managed-services ipsec;
activeness-priority 1;
}
}
}
user@srx-01# show security zonessecurity-zone vpn {
host-inbound-traffic {
system-services {
ping;
}
protocols {
bgp;
bfd;
}
}
interfaces {
st0.1;
st0.500;
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
lo0.0;
ge-0/0/4.0;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/3.0;
}
}
security-zone halink {
host-inbound-traffic {
system-services {
ike;
ping;
high-availability;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/2.0;
}
}
user@srx-01# show interfaces
interfaces {
ge-0/0/1 {
unit 0 {
family inet;
}
}
ge-0/0/2 {
description ha_link;
unit 0 {
family inet {
address 10.22.0.2/24;
}
}
}
ge-0/0/3 {
description trust;
unit 0 {
family inet {
address 10.3.0.2/24;
}
}
}
ge-0/0/4 {
description route2;
unit 0 {
family inet {
address 10.5.0.1/24;
}
}
}
lo0 {
description untrust;
unit 0 {
family inet {
address 10.11.0.1/32;
address 10.12.0.1/32;
}
}
}
st0 {
unit 1 {
family inet;
family inet6;
}
unit 500 {
family inet;
family inet6;
}
}
}
user@srx-01# show policy-options
policy-options {
prefix-list SRG1_PFX {
10.11.0.0/24;
}
prefix-list SRG2_PFX {
10.12.0.0/24;
}
route-filter-list srg1_rf_list {
10.11.0.0/24 orlonger;
10.1.0.0/24 orlonger;
10.6.0.0/24 orlonger;
}
route-filter-list srg2_rf_list {
10.12.0.0/24 orlonger;
10.1.1.0/24 orlonger;
10.6.255.0/24 orlonger;
}
policy-statement ipsec_pol {
term 1 {
from {
route-filter-list srg1_rf_list;
condition active_route_exists_srg1;
}
then {
metric 10;
accept;
}
}
term 2 {
from {
route-filter-list srg1_rf_list;
condition backup_route_exists_srg1;
}
then {
metric 20;
accept;
}
}
term 3 {
from {
route-filter-list srg2_rf_list;
condition active_route_exists_srg2;
}
then {
metric 10;
accept;
}
}
term 4 {
from {
route-filter-list srg2_rf_list;
condition backup_route_exists_srg2;
}
then {
metric 20;
accept;
}
}
term default {
then reject;
}
}
condition active_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.1/32;
table inet.0;
}
}
}
}
condition active_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.1/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.2/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.2/32;
table inet.0;
}
}
}
}
}
user@srx-01# show protocols
protocols {
bgp {
group 65030 {
type internal;
local-address 10.3.0.2;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.3.0.1;
}
group 65035 {
type external;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.5.0.2 {
peer-as 65035;
}
}
}
}
user@srx-01# show routing-options
routing-options {
autonomous-system 65030;
static {
route 10.6.0.1/32 next-hop st0.1;
route 10.7.0.0/16 next-hop 10.5.0.2;
route 10.112.0.0/24 next-hop 10.5.0.2;
}
}
Firewall virtual vSRX (SRX-02)
user@srx-02# show chassis high-availability
chassis {
high-availability {
local-id {
1;
local-ip 10.22.0.1;
}
peer-id 2 {
peer-ip 10.22.0.2;
interface ge-0/0/2.0;
vpn-profile L3HA_IPSEC_VPN;
liveness-detection {
minimum-interval 200;
multiplier 3;
}
}
services-redundancy-group 1 {
deployment-type routing;
peer-id {
2;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.2.0.2;
}
}
monitor {
bfd-liveliness 10.4.0.2 {
src-ip 10.4.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.39.1.1;
}
backup-signal-route {
10.39.1.2;
}
prefix-list SRG1_PFX;
managed-services ipsec;
activeness-priority 1;
}
services-redundancy-group 2 {
peer-id {
2;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.12.0.1;
}
}
monitor {
bfd-liveliness 10.4.0.2 {
src-ip 10.4.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.49.1.1;
}
backup-signal-route {
10.49.1.2;
}
prefix-list SRG2_PFX;
managed-services ipsec;
activeness-priority 200;
}
}
}
user@srx-02# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
lo0.0;
ge-0/0/4.0;
}
}
security-zone vpn {
host-inbound-traffic {
system-services {
ping;
}
protocols {
bgp;
bfd;
}
}
interfaces {
st0.1;
st0.500;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/3.0;
}
}
security-zone halink {
host-inbound-traffic {
system-services {
ike;
ping;
high-availability;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/2.0;
}
}
user@srx-02# show interfaces
interfaces {
ge-0/0/1 {
unit 0 {
family inet;
}
}
ge-0/0/2 {
description ha_link;
unit 0 {
family inet {
address 10.22.0.1/24;
}
}
}
ge-0/0/3 {
description trust;
unit 0 {
family inet {
address 10.2.0.2/24;
}
}
}
ge-0/0/4 {
description router2;
unit 0 {
family inet {
address 10.4.0.1/24;
}
}
}
lo0 {
unit 0 {
family inet {
address 10.11.0.1/32;
address 10.12.0.1/32;
}
}
}
st0 {
unit 1 {
family inet;
family inet6;
}
unit 500 {
family inet;
family inet6;
}
}
}
user@srx-02# show policy-options
policy-options {
prefix-list SRG1_PFX {
10.11.0.0/24;
}
prefix-list SRG2_PFX {
10.12.0.0/24;
}
route-filter-list srg1_rf_list {
10.11.0.0/24 orlonger;
10.1.0.0/24 orlonger;
10.6.0.0/24 orlonger;
}
route-filter-list srg2_rf_list {
10.12.0.0/24 orlonger;
10.1.1.0/24 orlonger;
10.6.255.0/24 orlonger;
}
policy-statement ipsec_pol {
term 1 {
from {
route-filter-list srg1_rf_list;
condition active_route_exists_srg1;
}
then {
metric 10;
accept;
}
}
term 2 {
from {
route-filter-list srg1_rf_list;
condition backup_route_exists_srg1;
}
then {
metric 20;
accept;
}
}
term 3 {
from {
route-filter-list srg2_rf_list;
condition active_route_exists_srg2;
}
then {
metric 10;
accept;
}
}
term 4 {
from {
route-filter-list srg2_rf_list;
condition backup_route_exists_srg2;
}
then {
metric 20;
accept;
}
}
term default {
then reject;
}
}
condition active_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.1/32;
table inet.0;
}
}
}
}
condition active_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.1/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.2/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.2/32;
table inet.0;
}
}
}
}
}
user@srx-02# show protocols
protocols {
bgp {
group 65030 {
type internal;
local-address 10.2.0.2;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.2.0.1;
}
group 65035 {
type external;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.4.0.2 {
peer-as 65035;
}
}
}
}
user@srx-02# show routing-options
routing-options {
autonomous-system 65030;
static {
route 10.6.0.1/32 next-hop st0.1;
route 10.7.0.0/24 next-hop 10.4.0.2;
route 10.112.0.0/24 next-hop 10.4.0.2;
}
}
Firewall virtual vSRX (SRX-03)
user@srx-03# show security ike
ike {
proposal SRG1_IKE_PROP {
authentication-method pre-shared-keys;
dh-group group14;
authentication-algorithm sha-256;
encryption-algorithm aes-256-cbc;
lifetime-seconds 3600;
}
proposal SRG2_IKE_PROP {
authentication-method pre-shared-keys;
dh-group group14;
authentication-algorithm sha-256;
encryption-algorithm aes-256-cbc;
lifetime-seconds 3600;
}
policy SRG1_IKE_POL1 {
proposals SRG1_IKE_PROP;
pre-shared-key ascii-text "$abc123"; ## SECRET-DATA
}
policy SRG2_IKE_POL500 {
proposals SRG2_IKE_PROP;
pre-shared-key ascii-text "$abc123"; ## SECRET-DATA
}
gateway SRG1_IKE_GW1 {
ike-policy SRG1_IKE_POL1;
address 10.11.0.1;
external-interface lo0;
local-address 10.112.0.1;
version v2-only;
}
gateway SRG2_IKE_GW500 {
ike-policy SRG2_IKE_POL500;
address 10.12.0.1;
external-interface lo0;
local-address 10.112.0.5;
version v2-only;
}
}
user@srx-03# show security ipsec
ipsec {
proposal SRG1_IPSEC_PROP {
protocol esp;
authentication-algorithm hmac-sha-256-128;
encryption-algorithm aes-256-cbc;
lifetime-seconds 1800;
}
proposal SRG2_IPSEC_PROP {
protocol esp;
authentication-algorithm hmac-sha-256-128;
encryption-algorithm aes-256-cbc;
lifetime-seconds 1800;
}
policy SRG1_IPSEC_POL1 {
proposals SRG1_IPSEC_PROP;
}
policy SRG2_IPSEC_POL500 {
proposals SRG2_IPSEC_PROP;
}
vpn SRG1_IPSEC_VPN1 {
bind-interface st0.1;
ike {
gateway SRG1_IKE_GW1;
ipsec-policy SRG1_IPSEC_POL1;
}
establish-tunnels immediately;
}
vpn SRG2_IPSEC_VPN500 {
bind-interface st0.500;
ike {
gateway SRG2_IKE_GW500;
ipsec-policy SRG2_IPSEC_POL500;
}
traffic-selector ts500 {
local-ip 10.6.255.1/32;
remote-ip 10.1.1.1/32;
}
establish-tunnels immediately;
}
}
user@srx-03# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/0.0;
lo0.0;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/1.0;
}
}
security-zone vpn {
host-inbound-traffic {
system-services {
ping;
}
protocols {
bgp;
bfd;
}
}
interfaces {
st0.1;
st0.500;
}
}
user@srx-03# show interfaces
interfaces {
ge-0/0/0 {
description untrust;
unit 0 {
family inet {
address 10.7.0.1/24;
}
}
}
ge-0/0/1 {
description trust;
unit 0 {
family inet {
address 10.6.0.2/24;
}
}
}
lo0 {
unit 0 {
family inet {
address 10.112.0.1/32;
address 10.112.0.5/32;
}
}
}
st0 {
unit 1 {
family inet;
}
unit 500 {
family inet;
}
}
}
user@srx-03# show routing-options
routing-options {
autonomous-system 100;
static {
route 10.1.0.1/32 next-hop st0.1;
route 10.4.0.0/24 next-hop 10.7.0.2;
route 10.5.0.0/24 next-hop 10.7.0.2;
route 10.6.255.0/24 next-hop 10.6.0.1;
route 10.11.0.0/24 next-hop 10.7.0.2;
route 10.12.0.0/24 next-hop 10.7.0.2;
route 10.111.0.1/32 next-hop 10.7.0.2;
route 10.111.0.2/32 next-hop 10.7.0.2;
}
}