Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

IPsec Security Services

Read this topic to understand how the cloud-native router integrates with Juniper's cSRX to provide IPsec security services.

Juniper Cloud-Native Router offers containerized routing functionality for both cloud-based and on-premise 5G environments. There is a growing demand for integrating security services with Cloud-Native Router. This functionality can be achieved using host-based service chaining. The cloud-native router is integrated with Juniper's containerized SRX (cSRX) platform to provide security services such as IPsec.

Overview

Let us consider an IPsec security services use case with the Cloud-Native router. In the figure below, the cloud-native router connects the provider edge (PE) routers in a service provider network. The customer edge (CE) routers or devices in the source network securely transfer data to the destination CEs via an IPsec tunnel. In the given scenario, the IPsec tunnel initiates from the cloud-native router's security services (cSRX) and terminates on the destination CEs. The cloud-native router and its peer PE provides the underlay connectivity to the IPsec tunnel.

jn-000731.png

The cloud-native router is chained with a security service instance (cSRX) in the same Kubernetes cluster. The cSRX instance runs as a pod service in L3 mode.

Note:

A cloud-native router instance can be service chained with one or more cSRX instances. Each cSRX instance is deployed in a separate Kubernetes namespace with dedicated VRFs. A single cSRX instance can support multiple IPSec tunnels for single-tenancy and multi-tenancy deployments. For deployments requiring additional IPSec tunnel capacity beyond a single cSRX instance, you can deploy multiple cSRX instances on a single cloud-native router.

Configuration

Cloud-Native Router can steer selective traffic through IPsec services. This is achieved by defining static routes to a destination via the cSRX interface. When the selective traffic is received on Cloud-Native Router, it is forwarded to cSRX. The cSRX subjects the packet to IPsec encryption based on the configuration and forwards it to Cloud-Native Router. Cloud-Native Router performs a route lookup in the untrust VRF and forwards traffic through the configured fabric interface. When IPsec packet is received from the remote end, Cloud-Native Router sends it to the security services. The cSRX decrypts the packet and forwards it to Cloud-Native Router on the trust interface. Cloud-Native Router then forwards the packet to the pod. The IP addresses of the tunnel endpoints are configured in Cloud-Native Router as static routes and advertised through an IGP to the remote end.

You can customize the cSRX deployment by specifying a range of configuration parameters in the helm chart (values.yaml) for cSRX.

Key configuration options include:

  • enableUserConfig: Controls if the tunnel configuration is defined and applied at the time of cSRX installation or post-deployment using a configlet. When set to true, the IPSec tunnel configuration must be performed using a configlet.

  • interfaceType: This is the type of interface on the cSRX to connect to Cloud-Native Router. Must be set to vhost only.

  • interfaceConfigs: This is an array defining the interface IP address, gateway address and optionally routes. The routes should contain prefixes to steer decrypted traffic to Cloud-Native Router and reachability route for IPSec gateway.

  • ipSecTunnelConfigs: This is an array defining the IPsec configuration details such as ike-phase1, proposal, policy and gateway configuration. Traffic selector should contain traffic that is expected to be encrypted. You can define one or multiple tunnel configurations. You can define the tunnel configuration using the installation helm chart or post-deployment using a configlet, based on the enableUserConfig flag.

  • jcnr_config: This is an array defining the routes to be configured in Cloud-Native Router to steer traffic from Cloud-Native Router to cSRX and to steer IPsec traffic from the remote IPsec gateway to the cSRX to apply the security service chain.

For installation procedures, Helm chart configuration examples, configlet-based configuration, end-to-end configuration examples, and verification steps, see Deploying Service Chain (cSRX) with Cloud-Native Router in the Cloud-Native Router Deployment Guide.

Related Documentation