Configuring Service Sets

To use dynamic SAs on the Services Router, you must create service sets to define the following information for IPsec service:

• The local gateway. If the IKE gateway IP address is in a VPN routing and forwarding (VRF) instance, you must configure the routing instance.

  Note: You can configure Internet Key Exchange (IKE) gateway IP addresses that are present in a VPN routing and forwarding (VRF) instance as long as the peer is reachable through the VRF instance. For next-hop service sets, the key management process (kmd) places the IKE packets in the routing instance that contains the outside-service-interface value you specify. For interface service sets, the services interface (the interface on which the service set is applied) determines the VRF.

• A next-hop service set that defines which services interface to use for all inside-service next hops and all outside-service next hops (traffic inside the network and outside the network). Alternatively, you can create an interface service set that defines the services interface to be used for all IPsec traffic.
• An IPsec rule to act on input traffic, set the remote gateway on all traffic, and reference an IKE policy.

This configuration allows you to set the remote gateway address and perform IKE validation on all incoming traffic through the IPsec tunnel.

To configure a service set, you must complete the following tasks:

• Configure a gateway. See Configuring a Local Gateway
• Define a services interface. See either of the following tasks:
  • Configuring Next-Hop Services Interfaces
  • Configuring Interface Service Sets
• Apply a rule. See Applying IPsec Rules to Service Sets

The sample service set configuration in Table 36 configures the IPsec service set ipsec-dynamic and sets the local gateway to 10.90.90.2.

To configure a local gateway for the service set:

1. Navigate to the top of the configuration hierarchy in either the J-Web or CLI configuration editor.
2. Perform the configuration tasks described in Table 36.
3. Go on to one of the following:
   • Configuring Next-Hop Services Interfaces
   • Configuring Interface Service Sets

Table 36: Configuring a Local Gateway

The sample next-hop configuration in Table 37 adds the next-hop services interfaces to the IPsec service set ipsec-dynamic created in Table 36. This sample next-hop configuration sets the inside services interface to sp-0/0/0.1001, and sets the outside services interface (facing the remote IPsec site) to sp-0/0/0.2001.

To configure next-hop services interfaces:

1. Navigate to the top of the configuration hierarchy in either the J-Web or CLI configuration editor.
2. Perform the configuration tasks described in Table 37.
3. Go on to Applying IPsec Rules to Service Sets.

Table 37: Configuring Next-Hop Services Interfaces

The sample interface service set configuration in Table 38 adds the interface service-set configuration to the IPsec service set ipsec-dynamic created in Table 36. This sample interface service-set configuration sets the services interface sp-0/0/0.

To configure interface service sets:

1. Navigate to the top of the configuration hierarchy in either the J-Web or CLI configuration editor.
2. Perform the configuration tasks described in Table 38.
3. Go on to Applying IPsec Rules to Service Sets.

Table 38: Configuring Interface Service Sets

The sample configuration in Table 39 configures the service set ipsec-dynamic configured in Table 36 to use the IPsec rule ipsec-dynamic-rule defined in Table 34.

To apply an IPsec rule to a service set:

1. Navigate to the top of the configuration hierarchy in either the J-Web or CLI configuration editor.
2. Perform the configuration tasks described in Table 39.
3. If you are finished configuring the router, commit the configuration.
4. Go on to the optional task Configuring a NAT Pool.
5. To check the configuration, see Verifying the IPsec Tunnel Configuration.

Table 39: Applying IPsec Rules to Service Sets