IPsec VPN Support in Multinode High Availability

IPsec VPN in Active-Backup Mode

SRX Series Firewalls support IPsec VPN tunnels in a Multinode High Availability setup. Prior to Junos OS Release 22.4R1, IPsec VPN tunnel anchors at SRG1, where SRG1 acts in stateful active / backup mode. In this mode, all VPN tunnels terminate on the same device where the SRG1 is active.

Multinode High Availability establishes IPsec tunnel and performs key exchanges by:

• Dynamically associating the floating IP address of the active SRG1 for the termination IP in routing deployment and assigns the termination IP, the virtual IP(VIP), which floats between the two devices in switching mode.

• Generating the CA profile, when there is a need for a dynamic CA profile to authenticate the tunnel establishment, on the node where SRG1 is active.

• Performing new authentication and loading the dynamic profile on the newly active node and clearing on the old node.

Although you can run the show commands on both active and backup nodes to display the status of IKE and IPsec security associations, you can delete the IKE and IPsec security associations only on the active node.

VPN service is automatically enabled when you enable the active/backup mode using the set chassis high-availability services-redundancy-group 1 command. See the configuration example for more details.

Note:

PKI files are synchronized to the peer node only if you enable link encryption for the ICL.

Tip:

We recommend following sequence when you configure VPN with Multinode High Availability on your security device:

• On the backup node, configure security IKE gateway, IPsec VPN, interfaces st0.x, and security zones and then commit the configuration.

• On the active node, configure security IKE gateway, IPsec VPN, st0.x interface, security zones, and static route and commit the configuration.

You must commit the configuration on the backup node before committing configuration on the active node if you don't use the commit synchronize option.

IPsec VPN in Active-Active Mode

Starting in Junos OS Release 22.4R1, you can configure Multinode High Availability to operate in active-active mode with support of multi SRG1s (SRG1+) for IPsec VPN. In this mode, some SRGs remain active on one node and some SRGs remain active on another node. A particular SRG always operates in active-backup mode; it operates in active mode on one node and backup mode on another node.

Multinode High Availability supports IPsec VPN in active-active mode with multiple SRGs (SRG1+). In this mode, you can establish multiple active tunnels from both the nodes, based on SRG activeness. Since different SRGs can be active on different nodes, tunnels belonging to these SRGs come up on both nodes independently. Having active tunnels on both the nodes enables encrypting/decrypting data traffic on both the nodes resulting in efficient use of bandwidth.

Figure 1 and Figure 2 show differences in active-backup and active-active Multinode High Availabilty IPsec VPN tunnels.

Multinode High Availability establishes IPsec tunnel and performs key exchanges by associating termination IP address (which also identifies the tunnels ending on it) to the SRG. Since different SRG1+ can be in active state or in backup state on each of the devices, Multinode High Availability steers the matching traffic effectively to the corresponding active SRG1. Multinode High Availability also maintains the SRG ID and IP prefix mapping information.

Table 1 and Table 2 provide details on impact on IPsec VPN tunnels due to change in SRG1+ changes.

Table 1: Impact on IPsec VPN Tunnels Due to SRG1+ Modification

SRG1 Changes	Impact on IPSec VPN Tunnels
SRG addition	No impact on existing tunnels
SRG deletion	Deletes all routes associated with the SRG.
SRG attribute (other than prefix-list) modification	No impact on existing tunnels
SRG ID modification	Deletes all existing tunnels associated with the SRG.
IP-prefix in prefix-list modification	Deletes all tunnels mapping to that particular IP prefix. No impact if there is no existing tunnel mapping to the modified IP prefix.

Table 2: Impact on IPsec VPN Tunnels Due to SRG1+ State Changes

SRG State Changes	Action from Multinode High Availability
Active to Backup	Deletes all data corresponding to that SRG, and resynchronizes from new the active SRG
Active to Ineligible	Deletes all data corresponding to that SRG, and resynchronizes from new the active SRG
Active to Hold	Not applicable
Backup to Active	No action
Ineligible to Active	No action
Hold to Active	No action
Hold to Backup	No action (possible state transition; if Active state is not involved in either pre or post state, no action is required)
Ineligible to Backup	No action (possible state transition; if Active state is not involved in either pre or post state, no action is required)
Hold to Ineligible	No action (possible state transition; if Active state is not involved in either pre or post state, no action is required)

See Example: Configure IPSec VPN in Active-Active Multinode High Availability in a Layer 3 Network for details.

Dynamic Routing Protocol Support for IPsec VPN

Starting in Junos OS Release 23.2R1, you can enable dynamic routing protocols for IPsec VPN in a Multinode High Availability setup by using node-local tunnels. The routes that the dynamic routing protocols add remain local to a node. These routes are not bound to any services redundancy group (SRG).

In the previous releases, Multinode High Availability supports only traffic selector deployment. That is, when you configure IPsec VPN by using traffic selectors, the configuration installs routes by considering the preference value and the routing metric based on traffic selector prefixes.

When you configure node-local tunnels, you have separate tunnels from a VPN peer device to both the nodes of the Multinode High Availability setup. That is—you have one node-local tunnel to each of the two Multinode High Availability nodes.

Figure 3, Figure 4, and Figure 5 show a Multinode High Availability IPsec VPN deployment with synced tunnels, node-local tunnels, and a combination of synced tunnels and node-local tunnels, respectively.

The preceding figure shows an IPsec VPN tunnel between a peer device and a Multinode High Availability setup. The IPsec VPN tunnel anchors at an active SRG1+. The tunnel remains active when the associated SRG1+ is active. In this deployment, traffic runs through the active tunnel (Tunnel 1).

In the preceding figure, you have two node-local tunnels between the VPN peer device and the Multinode High Availability setup. Each tunnel connects to one of the two nodes in the setup. These tunnels are not associated with any SRG1+. Either one or both the tunnels can remain active at any instant. Based on the configured routing protocol, at any instant, traffic runs either through Tunnel 2 or through Tunnel 3.

The preceding figure shows an IPsec VPN tunnel between a VPN peer device and a Multinode High Availability setup. Additionally, the figure shows two node-local tunnels between the VPN peer device and the Multinode High Availability setup.

The IPsec VPN tunnel anchors at an active SRG1+ and remains active when the associated SRG1+ is active. In the case of node-local tunnels, both the tunnels remain active.

Table 3 shows the difference between node-local tunnels and synced tunnels.

Table 3: Difference Between Node-Local Tunnels and Synced Tunnels

Functions	Node-Local Tunnels	Synced Tunnels
Association with SRG1+	No	Yes
Tunnel information synchronization between Multinode High Availability nodes	No	Yes
Number of active tunnels	Two	One