Use Case: Hub-and-Spoke IPsec WAN
This solution validates the SRX400 firewall series for enterprise secure router deployments.
Overview
The topology models a typical enterprise WAN deployment with a hub-and-spoke architecture, consisting of a regional headquarters acting as the hub and two branch offices acting as spokes. The environment includes three devices:
- Hubdevice—One central HUB router deployed at the regional headquarters
- Spokedevice1—One branch site deployed as a high-availability (MNHA) pair
- Spokedevice2—One branch site deployed as a standalone router
The hub is the central SRX device deployed at the regional headquarters. In this topology, SRX400 firewall series functions as the hub, terminating VPN connections from all branch sites, distributing routing information across the network, and hosting critical services such as the corporate LAN infrastructure that branch users rely on.
A secure hub-and-spoke WAN uses IKEv2 and IPsec tunnels to provide encrypted connectivity between a central hub and branch sites over untrusted networks. When routing requires multicast or broadcast traffic, GRE is encapsulated over IPsec to support routing protocols such as OSPF, OSPFv3, and iBGP for dynamic IPv4 and IPv6 reachability. OSPF, OSPFv3 and BGP can also operate directly over IPsec tunnels without GRE. Multiple parallel tunnels can be leveraged with ECMP to distribute traffic and improve resiliency, while branch sites can deploy active/backup high availability to ensure minimal disruption during failover. The design also supports integrated services QoS with DSCP preservation, along with operational features like link monitoring and traffic visibility, enabling a scalable, resilient, and dynamically routed WAN overlay independent of the underlay network. The Bidirectional Forwarding Detection (BFD) enables faster detection. You can use BFD to detect failures in reachability between devices.
Benefits
-
Encrypts hub-to-branch traffic over untrusted WAN links, reducing exposure of internal addressing and application data in transit.
-
Improves routing stability by using dynamic routing to adapt to link or tunnel failures, reducing manual route changes during outages.
-
Maintains branch connectivity during device failures by keeping session and routing state available across an active/backup HA pair.
-
Supports IPv4 and IPv6 connectivity in the same design, enabling phased IPv6 adoption without separate physical WANs.
-
Preserves traffic-class markings through tunnel encapsulation so QoS policies can prioritize critical applications consistently from branch to hub.
Topology
Deploy the SRX400 firewall series for secure routing and ensure the solution works consistently using the IPsec VPN tunnels.
Baseline Configurations
Interfaces
Configure interfaces for ICL, internal traffic, and for external traffic on the
firewall. Setup the loopback interface lo0 to reach the peer
gateway:
set interfaces ge-0/0/1 unit 0 family inet address 10.0.0.2/24 set interfaces ge-0/0/1 unit 0 description lan set interfaces ge-0/0/3 unit 0 family inet address 10.0.1.3/24 set interfaces ge-0/0/3 unit 0 description wan set interfaces ge-0/0/0 unit 0 description icl set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.2/24 set interfaces fti0 unit 1 tunnel encapsulation gre source address 172.16.1.1 set interfaces fti0 unit 1 tunnel encapsulation gre destination address 172.16.1.2 set interfaces fti0 unit 1 family inet address 10.200.11.1/24 set interfaces lo0 unit 0 family inet address 10.0.0.1/32 set interfaces lo0 unit 0 family inet address 10.0.0.2/32 set interfaces st0 unit 1 family inet address 172.16.1.1/30
Security Policies
Configure the security policy as per your network requirement.
set security policies from-zone lan to-zone vpn policy lan-to-vpn match source-address any set security policies from-zone lan to-zone vpn policy lan-to-vpn match destination-address any set security policies from-zone lan to-zone vpn policy lan-to-vpn match application any set security policies from-zone lan to-zone vpn policy lan-to-vpn then permit set security policies from-zone vpn to-zone lan policy vpn-to-lan match source-address any set security policies from-zone vpn to-zone lan policy vpn-to-lan match destination-address any set security policies from-zone vpn to-zone lan policy vpn-to-lan match application any set security policies from-zone vpn to-zone lan policy vpn-to-lan then permit
Security Zones
Configure security zones as required for your network along with necessary host-inbound system services.
set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone vpn interfaces ge-0/0/3.0 set security zones security-zone vpn interfaces lo0.0 set security zones security-zone vpn interfaces st0.1 set security zones security-zone vpn host-inbound-traffic system-services ping set security zones security-zone vpn host-inbound-traffic system-services ike set security zones security-zone vpn host-inbound-traffic protocols bfd set security zones security-zone vpn host-inbound-traffic protocols ospf set security zones security-zone vpn host-inbound-traffic protocols bgp set security zones security-zone vpn host-inbound-traffic protocols ospf3 set security zones security-zone lan host-inbound-traffic system-services ssh set security zones security-zone lan host-inbound-traffic protocols bfd set security zones security-zone lan interfaces ge-0/0/1.0 set security zones security-zone lan host-inbound-traffic protocols bgp
Policy Options
Configure routing policy and routing options. Define policies that support MNHA failover and traffic steering.
set policy-options policy-statement EXPORT-TO-EBGP term active from protocol bgp set policy-options policy-statement EXPORT-TO-EBGP term active from protocol ospf3 set policy-options policy-statement EXPORT-TO-EBGP term active from protocol ospf set policy-options policy-statement EXPORT-TO-EBGP term active from condition mnha-active set policy-options policy-statement EXPORT-TO-EBGP term active then metric 10 set policy-options policy-statement EXPORT-TO-EBGP term active then accept set policy-options policy-statement EXPORT-TO-EBGP term backup from protocol bgp set policy-options policy-statement EXPORT-TO-EBGP term backup from protocol ospf3 set policy-options policy-statement EXPORT-TO-EBGP term backup from protocol ospf set policy-options policy-statement EXPORT-TO-EBGP term backup from condition mnha-backup set policy-options policy-statement EXPORT-TO-EBGP term backup then metric 20 set policy-options policy-statement EXPORT-TO-EBGP term backup then accept
IKE and IPsec
Define IKE and IPsec parameters that protect MNHA control and state synchronization over the ICL
set security ike proposal MNHA_IKE_PROP authentication-method pre-shared-keys set security ike proposal MNHA_IKE_PROP dh-group group14 set security ike proposal MNHA_IKE_PROP authentication-algorithm sha-256 set security ike proposal MNHA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal MNHA_IKE_PROP lifetime-seconds 3600 set security ike policy MNHA_IKE_POL proposals MNHA_IKE_PROP set security ike policy MNHA_IKE_POL pre-shared-key ascii-text "$9$AZnkuBElK8db2cyb24aiHtuO1cyevWx-V" set security ike gateway MNHA_GW_1 ike-policy MNHA_IKE_POL set security ike gateway MNHA_GW_1 address 172.16.0.1 set security ike gateway MNHA_GW_1 dead-peer-detection probe-idle-tunnel set security ike gateway MNHA_GW_1 node-local set security ike gateway MNHA_GW_1 external-interface lo0 set security ike gateway MNHA_GW_1 local-address 10.0.0.2/32 set security ike gateway MNHA_GW_1 version v2-only set security ipsec proposal MNHA_IPSEC_PROP protocol esp set security ipsec proposal MNHA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal MNHA_IPSEC_PROP lifetime-seconds 3600 set security ipsec policy MNHA_IPSEC_POL proposals MNHA_IPSEC_PROP set security ipsec vpn N1_VPN_1 bind-interface st0.1 set security ipsec vpn N1_VPN_1 ike gateway MNHA_GW_1 set security ipsec vpn N1_VPN_1 ike ipsec-policy MNHA_IPSEC_POL set security ipsec vpn N1_VPN_1 establish-tunnels immediately
Protocols
Configure BGP, OSPF, and OSPF3.
set protocols bgp group ebgp-lan type external set protocols bgp group ebgp-lan export EXPORT-TO-EBGP set protocols bgp group ebgp-lan local-as 2002 set protocols bgp group ebgp-lan bfd-liveness-detection minimum-interval 1000 set protocols bgp group ebgp-lan bfd-liveness-detection multiplier 3 set protocols bgp group ibgp-vpn type internal set protocols bgp group ibgp-vpn local-as 100 set protocols bgp group ibgp-vpn bfd-liveness-detection minimum-interval 1000 set protocols bgp group ibgp-vpn bfd-liveness-detection minimum-receive-interval 1000 set protocols bgp group ibgp-vpn bfd-liveness-detection multiplier 3 set protocols bgp group ibgp-vpn neighbor 172.16.1.2 local-address 172.16.1.1 set protocols bgp group ibgp-gre type internal set protocols bgp group ibgp-gre local-as 100 set protocols bgp group ibgp-gre bfd-liveness-detection minimum-interval 1000 set protocols bgp group ibgp-gre bfd-liveness-detection minimum-receive-interval 1000 set protocols bgp group ibgp-gre bfd-liveness-detection multiplier 3 set protocols bgp group ibgp-gre neighbor 10.200.11.2 set protocols ospf area 0.0.0.0 interface st0.1 interface-type p2p set protocols ospf area 0.0.0.0 interface st0.1 retransmit-interval 10 set protocols ospf area 0.0.0.0 interface st0.1 hello-interval 30 set protocols ospf area 0.0.0.0 interface st0.1 dead-interval 120 set protocols ospf area 0.0.0.0 interface st0.1 bfd-liveness-detection minimum-interval 1000 set protocols ospf area 0.0.0.0 interface st0.1 bfd-liveness-detection minimum-receive-interval 1000 set protocols ospf area 0.0.0.0 interface st0.1 bfd-liveness-detection multiplier 3 set protocols ospf area 0.0.0.0 interface fti0.1 interface-type p2p set protocols ospf area 0.0.0.0 interface fti0.1 retransmit-interval 10 set protocols ospf area 0.0.0.0 interface fti0.1 hello-interval 30 set protocols ospf area 0.0.0.0 interface fti0.1 dead-interval 120 set protocols ospf area 0.0.0.0 interface fti0.1 bfd-liveness-detection minimum-interval 1000 set protocols ospf area 0.0.0.0 interface fti0.1 bfd-liveness-detection multiplier 3 set protocols ospf3 area 0.0.0.0 interface st0.101 interface-type p2p set protocols ospf3 area 0.0.0.0 interface st0.101 bfd-liveness-detection minimum-interval 1000 set protocols ospf3 area 0.0.0.0 interface st0.101 bfd-liveness-detection multiplier 3
MNHA
Configure MNHA. For more information, see Example: Configure Multinode High Availability on SRX Series Firewalls.
set chassis high-availability local-id 1 set chassis high-availability local-id local-ip 10.0.0.1 set chassis high-availability no-hardware-monitoring set chassis high-availability peer-id 2 peer-ip 10.0.0.2 set chassis high-availability peer-id 2 interface ge-0/0/0.0 set chassis high-availability peer-id 2 liveness-detection minimum-interval 1000 set chassis high-availability peer-id 2 liveness-detection multiplier 5 set chassis high-availability services-redundancy-group 1 deployment-type routing set chassis high-availability services-redundancy-group 1 peer-id 2 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip src-ip 10.1.0.1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 10.1.0.2 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/1 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.0.0.1 src-ip 10.0.0.2 set chassis high-availability services-redundancy-group 1 active-signal-route 10.1.1.1 set chassis high-availability services-redundancy-group 1 active-signal-route routing-instance mnha set chassis high-availability services-redundancy-group 1 backup-signal-route 10.2.2.2 set chassis high-availability services-redundancy-group 1 backup-signal-route routing-instance mnha set chassis high-availability services-redundancy-group 1 process-packet-on-backup set chassis high-availability services-redundancy-group 1 activeness-priority 200
Verify and Monitor
This topology demonstrates a scalable enterprise WAN design that combines:
- Secure connectivity using IKEv2/IPsec
- GRE for routing flexibility (optional)
- MNHA clustering for branch resiliency
- ECMP for redundancy and load balancing
- Dynamic routing for automated reachability
Verify your configurations using the following commands:
show chassis high-availability information detailshow chassis high-availability peer-infoshow security ike sa(tunnel UP between HUB and MNHA pair)show security ipsec sashow bgp summaryshow ospf neighborshow bfd sessionshow security monitoring