ON THIS PAGE
Configuring PKI Based MNHA Link Encryption
Configuration
CLI Quick Configuration
Physically connect the two devices and ensure that they are the same models.Loading certificate on SRX-1 Device
set security pki ca-profile Root-CA ca-identity Root-CA
set security pki ca-profile Root-CA enrollment url http://10.204.141.168/certsrv/mscep/mscep.dll
set security pki ca-profile Root-CA enrollment retry 5
set security pki ca-profile Root-CA enrollment retry-interval 0
set security pki ca-profile Root-CA revocation-check disable
user@host> clear security pki node-local local-certificate all
user@host> clear security pki node-local certificate-request all
user@host> clear security pki node-local key-pair all
user@host> clear security pki crl all
user@host> clear security pki ca-certificate all
user@host> request security pki node-local generate-key-pair certificate-id rsa-2048-active size 2048 type rsa
root@vm# curl "http://<PKI-Server-IP>/certsrv/certnew.cer?
ReqID=CACert=0=bin" -o /tmp/dut_ca.cer
root@vm# scp /tmp/dut_ca.cer root@node0-host-name:/var/tmp
user@host> request security pki ca-certificate load ca-profile Root-CA filename /var/tmp/dut_ca.cer
user@host> show security pki ca-certificate
root@vm# curl "http://PKI-Server-IP/certsrv/certcrl.crl?Renewal=0=bin"
-o /tmp/dut.crl
root@vm# scp /tmp/dut.crl root@node0-host-name:/var/tmp
user@host> request security pki crl load ca-profile Root-CA filename /var/tmp/dut.crl
user@host> show security pki crl
user@host> request security pki node-local generate-certificate-request certificate-id rsa-2048-active subject CN=test,OU=QA,O=JuniperNetworks,L=SBU,ST=CA,C=CN domain-name r0.juniper.net ip-address 22.0.0.1 email r0@juniper.net
root@vm# rm -rf /cert
root@vm# mkdir /cert
root@vm# chmod 777 /cert
root@vm# echo -----BEGIN CERTIFICATE REQUEST-----copy-generatedkey-----END CERTIFICATE
REQUEST----- /cert/dsakey
root@vm# cat /cert/dsakey
root@vm# chmod 777 /cert/dsakey
root@vm# chmod o+w /tftpboot
root@vm# rm -f /etc/xinetd.d/tftp.org
root@vm# cp /etc/xinetd.d/tftp /etc/xinetd.d/tftp.org
root@vm# sed -e 's/server_args.*/server_args = -s \/tftpboot -c/g' /etc/xinetd.d/tftp /etc/
xinetd.d/tftp.mdf
root@vm# mv -f /etc/xinetd.d/tftp.mdf /etc/xinetd.d/tftp
root@vm# systemctl enable tftp.service
root@vm# /bin/systemctl restart xinetd.service
root@vm# mv -f /etc/xinetd.d/tftp.org /etc/xinetd.d/tftp
root@vm# dir /tftpboot/pki.tcl
root@vm# /bin/cp /tftpboot/pki.tcl /cert/
root@vm# chmod 775 /cert/pki.tcl
root@vm# /cert/pki.tcl PKI-Server-IP /cert/dsakey /cert/dut.cer
root@vm# scp /cert/dut.cer root@node0-host-name:/var/tmp
user@host> clear security pki node-local local-certificate all
user@host> request security pki node-local local-certificate load certificate-id rsa-2048-active filename /var/tmp/<r0.cer>or<dut_cer>
Loading certificate on SRX-2 Device
set security pki ca-profile Root-CA ca-identity Root-CA
set security pki ca-profile Root-CA enrollment url http://10.204.141.168/certsrv/mscep/mscep.dll
set security pki ca-profile Root-CA enrollment retry 5
set security pki ca-profile Root-CA enrollment retry-interval 0
set security pki ca-profile Root-CA revocation-check disable
user@host> clear security pki node-local local-certificate all
user@host> clear security pki node-local certificate-request all
user@host> clear security pki node-local key-pair all
user@host> clear security pki crl all
user@host> clear security pki ca-certificate all
user@host> request security pki node-local generate-key-pair certificate-id rsa-2048-backup size 2048 type rsa
root@vm# curl "http://<PKI-Server-IP>/certsrv/certnew.cer?
ReqID=CACert=0=bin" -o /tmp/dut_ca.cer
root@vm# scp /tmp/dut_ca.cer root@node0-host-name:/var/tmp
user@host> request security pki ca-certificate load ca-profile Root-CA filename /var/tmp/dut_ca.cer
user@host> show security pki ca-certificate
root@vm# curl "http://PKI-Server-IP/certsrv/certcrl.crl?Renewal=0=bin"
-o /tmp/dut.crl
root@vm# scp /tmp/dut.crl root@node0-host-name:/var/tmp
user@host> request security pki crl load ca-profile Root-CA filename /var/tmp/dut.crl
user@host> show security pki crl
user@host> request security pki node-local generate-certificate-request certificate-id rsa-2048-backup subject CN=test,OU=QA,O=JuniperNetworks,L=SBU,ST=CA,C=CN domain-name r0.juniper.net ip-address 22.0.0.2 email r0@juniper.net
root@vm# rm -rf /cert
root@vm# mkdir /cert
root@vm# chmod 777 /cert
root@vm# echo -----BEGIN CERTIFICATE REQUEST-----copy-generatedkey-----END CERTIFICATE
REQUEST----- /cert/dsakey
root@vm# cat /cert/dsakey
root@vm# chmod 777 /cert/dsakey
root@vm# chmod o+w /tftpboot
root@vm# rm -f /etc/xinetd.d/tftp.org
root@vm# cp /etc/xinetd.d/tftp /etc/xinetd.d/tftp.org
root@vm# sed -e 's/server_args.*/server_args = -s \/tftpboot -c/g' /etc/xinetd.d/tftp /etc/
xinetd.d/tftp.mdf
root@vm# mv -f /etc/xinetd.d/tftp.mdf /etc/xinetd.d/tftp
root@vm# systemctl enable tftp.service
root@vm# /bin/systemctl restart xinetd.service
root@vm# mv -f /etc/xinetd.d/tftp.org /etc/xinetd.d/tftp
root@vm# dir /tftpboot/pki.tcl
root@vm# /bin/cp /tftpboot/pki.tcl /cert/
root@vm# chmod 775 /cert/pki.tcl
root@vm# /cert/pki.tcl PKI-Server-IP /cert/dsakey /cert/dut.cer
root@vm# scp /cert/dut.cer root@node0-host-name:/var/tmp
user@host> clear security pki node-local local-certificate all
user@host> request security pki node-local local-certificate load certificate-id rsa-2048-backup filename /var/tmp/<r0.cer>or<dut_cer>
To quickly configure this example, copy the following commands,
paste them into a text file, remove any line breaks, change any details
necessary to match your network configuration, copy and paste the commands into
the CLI at the [edit] hierarchy level, and then enter
commit from configuration mode.
On SRX-1 Device
set system syslog file pkid_syslog match "iked|pkid" set system syslog file vpn_syslog any info set system syslog file vpn_syslog daemon any set system syslog file vpn_syslog match "iked|pkid|kmd|ikemd|authd|jsrpd|chassisd|bfd" set chassis high-availability local-id 1 set chassis high-availability local-id local-ip 22.0.0.1 set chassis high-availability no-hardware-monitoring set chassis high-availability peer-id 2 peer-ip 22.0.0.2 set chassis high-availability peer-id 2 interface ge-0/0/5.0 set chassis high-availability peer-id 2 vpn-profile L3HA_IPSEC_VPN set chassis high-availability peer-id 2 liveness-detection minimum-interval 300 set chassis high-availability peer-id 2 liveness-detection multiplier 5 set chassis high-availability traceoptions flag all set chassis high-availability traceoptions level all set chassis high-availability services-redundancy-group 0 peer-id 2 set chassis high-availability services-redundancy-group 1 peer-id 2 set chassis high-availability services-redundancy-group 1 floating-ip 11.0.0.1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 111.0.0.1 set chassis high-availability services-redundancy-group 1 active-signal-route 39.1.1.1 set chassis high-availability services-redundancy-group 1 backup-signal-route 39.1.1.2 set chassis high-availability services-redundancy-group 1 prefix-list any-prefix set chassis high-availability services-redundancy-group 1 managed-services ipsec set chassis high-availability services-redundancy-group 1 activeness-priority 200 set security pki ca-profile Root-CA ca-identity Root-CA set security pki ca-profile Root-CA enrollment url http://10.204.141.168/certsrv/mscep/mscep.dll set security pki ca-profile Root-CA enrollment retry 5 set security pki ca-profile Root-CA enrollment retry-interval 0 set security pki ca-profile Root-CA revocation-check disable set security pki traceoptions flag all set security ike traceoptions file iked set security ike traceoptions file size 10m set security ike traceoptions flag all set security ike traceoptions level 15 set security ike traceoptions trace-buffer set security ike respond-bad-spi 5 set security ike proposal L3HA_IKE_PROP description l3ha_link_encr_tunnel set security ike proposal L3HA_IKE_PROP authentication-method rsa-signatures set security ike proposal L3HA_IKE_PROP dh-group group14 set security ike proposal L3HA_IKE_PROP authentication-algorithm sha-256 set security ike proposal L3HA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal L3HA_IKE_PROP lifetime-seconds 300 set security ike policy L3HA_IKE_POL description l3ha_link_encr_tunnel set security ike policy L3HA_IKE_POL proposals L3HA_IKE_PROP set security ike policy L3HA_IKE_POL certificate local-certificate rsa-2048-active set security ike gateway L3HA_IKE_GW ike-policy L3HA_IKE_POL set security ike gateway L3HA_IKE_GW version v2-only set security ipsec traceoptions flag all set security ipsec proposal L3HA_IPSEC_PROP description l3ha_link_encr_tunnel set security ipsec proposal L3HA_IPSEC_PROP protocol esp set security ipsec proposal L3HA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal L3HA_IPSEC_PROP lifetime-seconds 300 set security ipsec policy L3HA_IPSEC_POL description l3ha_link_encr_tunnel set security ipsec policy L3HA_IPSEC_POL proposals L3HA_IPSEC_PROP set security ipsec vpn L3HA_IPSEC_VPN ha-link-encryption set security ipsec vpn L3HA_IPSEC_VPN ike gateway L3HA_IKE_GW set security ipsec vpn L3HA_IPSEC_VPN ike ipsec-policy L3HA_IPSEC_POL set security forwarding-options family inet6 mode flow-based set security flow traceoptions file flow.log set security flow traceoptions file size 100m set security flow traceoptions flag all set security policies default-policy permit-all set security traceoptions file security.log set security traceoptions file size 100m set security traceoptions flag all set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces ge-0/0/1.0 set security zones security-zone untrust interfaces lo0.0 set security zones security-zone vpn host-inbound-traffic system-services all set security zones security-zone vpn host-inbound-traffic protocols all set security zones security-zone vpn interfaces st0.1 set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/0.0 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/5.0 set interfaces ge-0/0/0 description trust set interfaces ge-0/0/0 unit 0 family inet address 2.0.0.2/24 set interfaces ge-0/0/0 unit 0 family inet6 address 2000::2/112 set interfaces ge-0/0/1 description untrust set interfaces ge-0/0/1 unit 0 family inet address 4.0.0.2/24 set interfaces ge-0/0/1 unit 0 family inet6 address 4000::2/112 set interfaces ge-0/0/5 description ha_link set interfaces ge-0/0/5 unit 0 family inet address 22.0.0.1/24 set interfaces ge-0/0/5 unit 0 family inet6 address 2200::1/112 set interfaces lo0 description untrust set interfaces lo0 unit 0 family inet address 11.0.0.1/32 set interfaces lo0 unit 0 family inet address 11.0.0.2/32 set interfaces lo0 unit 0 family inet address 11.0.0.3/32 set interfaces lo0 unit 0 family inet6 address 1100::1/128 set interfaces lo0 unit 0 family inet6 address 1100::2/128 set interfaces lo0 unit 0 family inet6 address 1100::3/128 set interfaces st0 unit 1 family inet set interfaces st0 unit 1 family inet6 set policy-options prefix-list any-prefix 0.0.0.0/0 set policy-options prefix-list any-prefix ::/0 set policy-options policy-statement ipsec_pol term 1 from instance-any set policy-options policy-statement ipsec_pol term 1 from condition active_route_exists set policy-options policy-statement ipsec_pol term 1 then metric 10 set policy-options policy-statement ipsec_pol term 1 then accept set policy-options policy-statement ipsec_pol term 2 from instance-any set policy-options policy-statement ipsec_pol term 2 from condition backup_route_exists set policy-options policy-statement ipsec_pol term 2 then metric 20 set policy-options policy-statement ipsec_pol term 2 then accept set policy-options policy-statement ipsec_pol term 3 from instance-any set policy-options policy-statement ipsec_pol term 3 then metric 30 set policy-options policy-statement ipsec_pol term 3 then accept set policy-options policy-statement ipsec_pol term default then reject set policy-options condition active_route_exists if-route-exists address-family inet 39.1.1.1/32 set policy-options condition active_route_exists if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists if-route-exists address-family inet 39.1.1.2/32 set policy-options condition backup_route_exists if-route-exists address-family inet table inet.0 set protocols bfd traceoptions flag all set protocols bgp group trust type internal set protocols bgp group trust local-address 2.0.0.2 set protocols bgp group trust export ipsec_pol set protocols bgp group trust local-as 100 set protocols bgp group trust bfd-liveness-detection minimum-interval 500 set protocols bgp group trust bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group trust bfd-liveness-detection multiplier 3 set protocols bgp group trust neighbor 2.0.0.1 set protocols bgp group untrust type internal set protocols bgp group untrust local-address 4.0.0.2 set protocols bgp group untrust export ipsec_pol set protocols bgp group untrust local-as 100 set protocols bgp group untrust bfd-liveness-detection minimum-interval 500 set protocols bgp group untrust bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group untrust bfd-liveness-detection multiplier 3 set protocols bgp group untrust neighbor 4.0.0.1 set protocols bgp group trust_ip6 type internal set protocols bgp group trust_ip6 local-address 2000::2 set protocols bgp group trust_ip6 export ipsec_pol set protocols bgp group trust_ip6 local-as 100 set protocols bgp group trust_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group trust_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group trust_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group trust_ip6 neighbor 2000::1 set protocols bgp group untrust_ip6 type internal set protocols bgp group untrust_ip6 local-address 4000::2 set protocols bgp group untrust_ip6 export ipsec_pol set protocols bgp group untrust_ip6 local-as 100 set protocols bgp group untrust_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group untrust_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group untrust_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group untrust_ip6 neighbor 4000::1 set routing-options rib inet6.0 static route 111::2/128 next-hop 4000::1 set routing-options rib inet6.0 static route 1000::/64 next-hop 2000::1 set routing-options rib inet6.0 static route 1110::1/128 next-hop 2000::1 set routing-options rib inet6.0 static route 1200::/64 next-hop 4000::1 set routing-options rib inet6.0 static route 6000::/112 next-hop 4000::1 set routing-options autonomous-system 100 set routing-options static route 1.0.0.0/8 next-hop 2.0.0.1 set routing-options static route 6.0.0.0/24 next-hop 4.0.0.1 set routing-options static route 12.0.0.0/16 next-hop 4.0.0.1 set routing-options static route 13.0.0.0/16 next-hop 4.0.0.1 set routing-options static route 111.0.0.1/32 next-hop 2.0.0.1 set routing-options static route 111.0.0.2/32 next-hop 4.0.0.1
On SRX-2 Device
set system syslog file pkid_syslog match "iked|pkid" set system syslog file vpn_syslog any info set system syslog file vpn_syslog daemon any set system syslog file vpn_syslog match "iked|pkid|kmd|ikemd|authd|jsrpd|chassisd|bfd" set chassis high-availability local-id 2 set chassis high-availability local-id local-ip 22.0.0.2 set chassis high-availability no-hardware-monitoring set chassis high-availability peer-id 1 peer-ip 22.0.0.1 set chassis high-availability peer-id 1 interface ge-0/0/5.0 set chassis high-availability peer-id 1 vpn-profile L3HA_IPSEC_VPN set chassis high-availability peer-id 1 liveness-detection minimum-interval 300 set chassis high-availability peer-id 1 liveness-detection multiplier 5 set chassis high-availability traceoptions flag all set chassis high-availability traceoptions level all set chassis high-availability services-redundancy-group 0 peer-id 1 set chassis high-availability services-redundancy-group 1 peer-id 1 set chassis high-availability services-redundancy-group 1 floating-ip 11.0.0.1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 111.0.0.1 set chassis high-availability services-redundancy-group 1 active-signal-route 39.1.1.1 set chassis high-availability services-redundancy-group 1 backup-signal-route 39.1.1.2 set chassis high-availability services-redundancy-group 1 prefix-list any-prefix set chassis high-availability services-redundancy-group 1 managed-services ipsec set chassis high-availability services-redundancy-group 1 activeness-priority 100 set security pki ca-profile Root-CA ca-identity Root-CA set security pki ca-profile Root-CA enrollment url http://10.204.141.168/certsrv/mscep/mscep.dll set security pki ca-profile Root-CA enrollment retry 5 set security pki ca-profile Root-CA enrollment retry-interval 0 set security pki ca-profile Root-CA revocation-check disable set security pki traceoptions flag all set security ike traceoptions file iked set security ike traceoptions file size 10m set security ike traceoptions flag all set security ike traceoptions level 15 set security ike respond-bad-spi 5 set security ike proposal L3HA_IKE_PROP description l3ha_link_encr_tunnel set security ike proposal L3HA_IKE_PROP authentication-method rsa-signatures set security ike proposal L3HA_IKE_PROP dh-group group14 set security ike proposal L3HA_IKE_PROP authentication-algorithm sha-256 set security ike proposal L3HA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal L3HA_IKE_PROP lifetime-seconds 300 set security ike policy L3HA_IKE_POL description l3ha_link_encr_tunnel set security ike policy L3HA_IKE_POL proposals L3HA_IKE_PROP set security ike policy L3HA_IKE_POL certificate local-certificate rsa-2048-backup set security ike gateway L3HA_IKE_GW ike-policy L3HA_IKE_POL set security ike gateway L3HA_IKE_GW version v2-only set security ipsec traceoptions flag all set security ipsec proposal L3HA_IPSEC_PROP description l3ha_link_encr_tunnel set security ipsec proposal L3HA_IPSEC_PROP protocol esp set security ipsec proposal L3HA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal L3HA_IPSEC_PROP lifetime-seconds 300 set security ipsec policy L3HA_IPSEC_POL description l3ha_link_encr_tunnel set security ipsec policy L3HA_IPSEC_POL proposals L3HA_IPSEC_PROP set security ipsec vpn L3HA_IPSEC_VPN ha-link-encryption set security ipsec vpn L3HA_IPSEC_VPN ike gateway L3HA_IKE_GW set security ipsec vpn L3HA_IPSEC_VPN ike ipsec-policy L3HA_IPSEC_POL set security forwarding-options family inet6 mode flow-based set security flow traceoptions file flow.log set security flow traceoptions file size 100m set security flow traceoptions flag all set security policies default-policy permit-all set security traceoptions file security.log set security traceoptions file size 100m set security traceoptions flag all set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces ge-0/0/1.0 set security zones security-zone untrust interfaces lo0.0 set security zones security-zone vpn host-inbound-traffic system-services all set security zones security-zone vpn host-inbound-traffic protocols all set security zones security-zone vpn interfaces st0.1 set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/0.0 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/5.0 set interfaces ge-0/0/0 description trust set interfaces ge-0/0/0 unit 0 family inet address 3.0.0.2/24 set interfaces ge-0/0/0 unit 0 family inet6 address 3000::2/112 set interfaces ge-0/0/1 description untrust set interfaces ge-0/0/1 unit 0 family inet address 5.0.0.2/24 set interfaces ge-0/0/1 unit 0 family inet6 address 5000::2/112 set interfaces ge-0/0/5 description ha_link set interfaces ge-0/0/5 unit 0 family inet address 22.0.0.2/24 set interfaces ge-0/0/5 unit 0 family inet6 address 2200::2/112 set interfaces lo0 description untrust set interfaces lo0 unit 0 family inet address 11.0.0.1/32 set interfaces lo0 unit 0 family inet address 11.0.0.2/32 set interfaces lo0 unit 0 family inet address 11.0.0.3/32 set interfaces lo0 unit 0 family inet6 address 1100::1/128 set interfaces lo0 unit 0 family inet6 address 1100::2/128 set interfaces lo0 unit 0 family inet6 address 1100::3/128 set interfaces st0 unit 1 family inet set interfaces st0 unit 1 family inet6 set policy-options prefix-list any-prefix 0.0.0.0/0 set policy-options prefix-list any-prefix ::/0 set policy-options route-filter-list ipsec 7.0.0.0/8 orlonger set policy-options route-filter-list loopback 11.0.0.0/24 orlonger set policy-options policy-statement ipsec_pol term 1 from instance-any set policy-options policy-statement ipsec_pol term 1 from condition active_route_exists set policy-options policy-statement ipsec_pol term 1 then metric 10 set policy-options policy-statement ipsec_pol term 1 then accept set policy-options policy-statement ipsec_pol term 2 from instance-any set policy-options policy-statement ipsec_pol term 2 from condition backup_route_exists set policy-options policy-statement ipsec_pol term 2 then metric 20 set policy-options policy-statement ipsec_pol term 2 then accept set policy-options policy-statement ipsec_pol term 3 from instance-any set policy-options policy-statement ipsec_pol term 3 then metric 30 set policy-options policy-statement ipsec_pol term 3 then accept set policy-options policy-statement ipsec_pol term default then reject set policy-options condition active_route_exists if-route-exists address-family inet 39.1.1.1/32 set policy-options condition active_route_exists if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists if-route-exists address-family inet 39.1.1.2/32 set policy-options condition backup_route_exists if-route-exists address-family inet table inet.0 set protocols bfd traceoptions flag all set protocols bgp group trust type internal set protocols bgp group trust local-address 3.0.0.2 set protocols bgp group trust export ipsec_pol set protocols bgp group trust local-as 100 set protocols bgp group trust bfd-liveness-detection minimum-interval 500 set protocols bgp group trust bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group trust bfd-liveness-detection multiplier 3 set protocols bgp group trust neighbor 3.0.0.1 set protocols bgp group untrust type internal set protocols bgp group untrust local-address 5.0.0.2 set protocols bgp group untrust export ipsec_pol set protocols bgp group untrust local-as 100 set protocols bgp group untrust bfd-liveness-detection minimum-interval 500 set protocols bgp group untrust bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group untrust bfd-liveness-detection multiplier 3 set protocols bgp group untrust neighbor 5.0.0.1 set protocols bgp group trust_ip6 type internal set protocols bgp group trust_ip6 local-address 3000::2 set protocols bgp group trust_ip6 export ipsec_pol set protocols bgp group trust_ip6 local-as 100 set protocols bgp group trust_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group trust_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group trust_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group trust_ip6 neighbor 3000::1 set protocols bgp group untrust_ip6 type internal set protocols bgp group untrust_ip6 local-address 5000::2 set protocols bgp group untrust_ip6 export ipsec_pol set protocols bgp group untrust_ip6 local-as 100 set protocols bgp group untrust_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group untrust_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group untrust_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group untrust_ip6 neighbor 5000::1 set routing-options rib inet6.0 static route 111::2/128 next-hop 5000::1 set routing-options rib inet6.0 static route 1000::/64 next-hop 3000::1 set routing-options rib inet6.0 static route 1110::1/128 next-hop 3000::1 set routing-options rib inet6.0 static route 1200::/64 next-hop 5000::1 set routing-options rib inet6.0 static route 6000::/112 next-hop 5000::1 set routing-options autonomous-system 100 set routing-options static route 1.0.0.0/8 next-hop 3.0.0.1 set routing-options static route 6.0.0.0/24 next-hop 5.0.0.1 set routing-options static route 12.0.0.0/16 next-hop 5.0.0.1 set routing-options static route 13.0.0.0/16 next-hop 5.0.0.1 set routing-options static route 111.0.0.1/32 next-hop 3.0.0.1 set routing-options static route 111.0.0.2/32 next-hop 5.0.0.1
Router(vsrx) SRX1_A1
set security forwarding-options family inet6 mode flow-based set security policies default-policy permit-all set security zones security-zone lan host-inbound-traffic system-services all set security zones security-zone lan host-inbound-traffic protocols all set security zones security-zone lan interfaces ge-0/0/3.0 set security zones security-zone l3ha host-inbound-traffic system-services all set security zones security-zone l3ha host-inbound-traffic protocols all set security zones security-zone l3ha interfaces ge-0/0/0.0 set security zones security-zone l3ha interfaces ge-0/0/1.0 set security zones security-zone loopback host-inbound-traffic system-services all set security zones security-zone loopback host-inbound-traffic protocols all set security zones security-zone loopback interfaces lo0.0 set interfaces ge-0/0/0 description l3ha_1 set interfaces ge-0/0/0 unit 0 family inet address 2.0.0.1/24 set interfaces ge-0/0/0 unit 0 family inet6 address 2000::1/112 set interfaces ge-0/0/1 description l3ha_2 set interfaces ge-0/0/1 unit 0 family inet address 3.0.0.1/24 set interfaces ge-0/0/1 unit 0 family inet6 address 3000::1/112 set interfaces ge-0/0/3 description lan set interfaces ge-0/0/3 unit 0 family inet address 1.0.0.1/8 set interfaces ge-0/0/3 unit 0 family inet6 address 1000::1/64 set interfaces lo0 description loopback set interfaces lo0 unit 0 family inet address 111.0.0.1/32 primary set interfaces lo0 unit 0 family inet address 111.0.0.1/32 preferred set interfaces lo0 unit 0 family inet6 address 1110::1/128 primary set interfaces lo0 unit 0 family inet6 address 1110::1/128 preferred set protocols bgp group l3ha_r0 type internal set protocols bgp group l3ha_r0 local-address 2.0.0.1 set protocols bgp group l3ha_r0 local-as 100 set protocols bgp group l3ha_r0 bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0 bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0 neighbor 2.0.0.2 set protocols bgp group l3ha_r0_b type internal set protocols bgp group l3ha_r0_b local-address 3.0.0.1 set protocols bgp group l3ha_r0_b local-as 100 set protocols bgp group l3ha_r0_b bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0_b bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0_b bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0_b neighbor 3.0.0.2 set protocols bgp group l3ha_r0_ip6 type internal set protocols bgp group l3ha_r0_ip6 local-address 2000::1 set protocols bgp group l3ha_r0_ip6 local-as 100 set protocols bgp group l3ha_r0_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0_ip6 neighbor 2000::2 set protocols bgp group l3ha_r0_b_ip6 type internal set protocols bgp group l3ha_r0_b_ip6 local-address 3000::1 set protocols bgp group l3ha_r0_b_ip6 local-as 100 set protocols bgp group l3ha_r0_b_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0_b_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0_b_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0_b_ip6 neighbor 3000::2 set routing-options autonomous-system 100
Router(vsrx) SRX1_A2
set security forwarding-options family inet6 mode flow-based set security policies default-policy permit-all set security zones security-zone lan host-inbound-traffic system-services all set security zones security-zone lan host-inbound-traffic protocols all set security zones security-zone lan interfaces ge-0/0/2.0 set security zones security-zone l3ha host-inbound-traffic system-services all set security zones security-zone l3ha host-inbound-traffic protocols all set security zones security-zone l3ha interfaces ge-0/0/0.0 set security zones security-zone l3ha interfaces ge-0/0/1.0 set security zones security-zone loopback host-inbound-traffic system-services all set security zones security-zone loopback host-inbound-traffic protocols all set security zones security-zone loopback interfaces lo0.0 set interfaces ge-0/0/0 description l3ha_1 set interfaces ge-0/0/0 unit 0 family inet address 4.0.0.1/24 set interfaces ge-0/0/0 unit 0 family inet6 address 4000::1/112 set interfaces ge-0/0/1 description l3ha_2 set interfaces ge-0/0/1 unit 0 family inet address 5.0.0.1/24 set interfaces ge-0/0/1 unit 0 family inet6 address 5000::1/112 set interfaces ge-0/0/2 description lan set interfaces ge-0/0/2 unit 0 family inet address 6.0.0.1/24 set interfaces ge-0/0/2 unit 0 family inet6 address 6000::1/112 set interfaces lo0 description loopback set interfaces lo0 unit 0 family inet address 111.0.0.2/32 primary set interfaces lo0 unit 0 family inet address 111.0.0.2/32 preferred set interfaces lo0 unit 0 family inet6 address 111::2/128 primary set interfaces lo0 unit 0 family inet6 address 111::2/128 preferred set protocols bgp group l3ha_r0 type internal set protocols bgp group l3ha_r0 local-address 4.0.0.1 set protocols bgp group l3ha_r0 local-as 100 set protocols bgp group l3ha_r0 bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0 bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0 neighbor 4.0.0.2 set protocols bgp group l3ha_r0_b type internal set protocols bgp group l3ha_r0_b local-address 5.0.0.1 set protocols bgp group l3ha_r0_b local-as 100 set protocols bgp group l3ha_r0_b bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0_b bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0_b bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0_b neighbor 5.0.0.2 set protocols bgp group l3ha_r0_ip6 type internal set protocols bgp group l3ha_r0_ip6 local-address 4000::1 set protocols bgp group l3ha_r0_ip6 local-as 100 set protocols bgp group l3ha_r0_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0_ip6 neighbor 4000::2 set protocols bgp group l3ha_r0_b_ip6 type internal set protocols bgp group l3ha_r0_b_ip6 local-address 5000::1 set protocols bgp group l3ha_r0_b_ip6 local-as 100 set protocols bgp group l3ha_r0_b_ip6 bfd-liveness-detection minimum-interval 500 set protocols bgp group l3ha_r0_b_ip6 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group l3ha_r0_b_ip6 bfd-liveness-detection multiplier 3 set protocols bgp group l3ha_r0_b_ip6 neighbor 5000::2 set routing-options rib inet6.0 static route 1200::/64 next-hop 6000::2 set routing-options autonomous-system 100 set routing-options static route 12.0.0.0/16 next-hop 6.0.0.2
Verification
The steps for verification remain the same as for verification of PSK based MNHA link encryption.