Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Example: Single MX Series (ECMP Based Consistent Hashing) and Scaled-Out SRX Series Firewalls (Standalone) for IPsec VPN

In this configuration, you’ll learn to setup a single MX Series with scaled-out SRX Series Firewalls in standalone for IPsec VPN services.

Overview

Table 1 shows the deployment components used in the example.

Table 1: Deployment Details
CSDS Components Details
Forwarding Layer MX304 with Junos OS Release 23.4R1 or later
Services Layer vSRX 3.0 with Junos OS Release 23.4R1 or later
Redundancy

Single MX Series with ECMP based Consistent Hashing for load balancer.

SRX Series Firewalls (Standalone)
Features IPsec VPN
Additional Component IPsec initiator device – MX router with SPC3 card. You can use any IPsec initiator device.

See Table 2 and Table 3 for traffic flow and VPN details.

Table 2: Traffic Flows for IPsec VPN
Feature Traffic Flow Component IP Address
IPsec VPN on SRX1, SRX2 and SRX3 IKE Gateway Source (IPsec Initiator) 200.0.0.0/8
IKE Gateway Destination (IPsec Responder) 100.0.0.1/32
IPsec Data Source 6.0.0.0/8
IPsec Data Destination 75.0.0.0/8
Table 3: IPsec VPN Details
Device IKE Gateways IPsec Data Endpoints
SRX1 200.0.0.1 and 100.0.0.1 Tunnel 1 between 6.0.0.3 and 75.0.0.3
SRX2 200.0.0.2 and 100.0.0.1 Tunnel 2 between 6.0.0.2 and 75.0.0.2
SRX3 200.0.0.6 and 100.0.0.1 Tunnel 3 between 6.0.0.1 and 75.0.0.1

See Table 4 for traffic flow.

Table 4: Load Balancer to SRX Series Firewalls for IPsec VPN Services
Flow Type Traffic Flow Component IP Address
IKE Initiator to SRX Source Load Balancer (Route Filter on MX) 100.0.0.1/32
IPsec VPN forward Flow Routing-Based  
IPsec VPN Reverse Flow Routing-Based Unique ARI route per SRX

Topology Illustration

Figure 1: Single MX Series (ECMP based Consistent Hashing) and Scaled-Out SRX Series Firewalls for IPsec VPN Services Single MX Series (ECMP based Consistent Hashing) and Scaled-Out SRX Series Firewalls for IPsec VPN Services
Figure 2: Route Advertisements in IKE Gateway for IPsec VPN Services Route Advertisements in IKE Gateway for IPsec VPN Services
Figure 3: Route Advertisements for IPsec Endpoint for IPsec VPN Services Route Advertisements for IPsec Endpoint for IPsec VPN Services

Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

These configurations are captured from a lab environment and are provided for reference only. Actual configurations might vary based on the specific requirements of your environment.

The following items show a list of configuration components for this example:

  • Configure MX Series
  • Configure the IPsec Initiator
  • Configure SRX1
  • Configure SRX2
  • Configure SRX3
Configure MX Series
Configure IPsec Initiator
Configure SRX1
Configure SRX2
Configure SRX3

Verification

The following items highlight a list of show commands used to verify the feature in this example.

  • Verify MX Series configuration
  • Verify SRX1 configuration
  • Verify SRX2 configuration
  • Verify SRX3 configuration
Verify MX Series Configuration
Verify IPsec Initiator Configuration
Verify SRX1 Configuration
Verify SRX2 Configuration
Verify SRX3 Configuration