Roadwarrior
This scenario shows different ways to setup a roadwarrior VPN connection; in which, instead of using a N2N (network to network) connection, a single machine (e.g., a host) is able to connect to a remote private network.
On the one hand, DUT2 and DUT0 represent a remote branch
office. On the other hand, DUT1 is a roadwarrior that can
establish a connection to DUT2 using different virtual IPs.
Note that security associations (SAs) have to be manually
flushed with the command clear vpn ipsec sa. Depending on
the configuration parameter connection-type, the new tunnel
connections will be created or not. In this case, on-demand
was configured in the roadwarrior to establish the VPN connection
as soon as the first plain IP payload attempts to traverse the
tunnel.
Test VPN Roadwarrior Connection With VTI
Description
In this scenario, DUT0 uses a VTI interface
to encapsulate the VPN traffic.
Scenario
Step 1: Set the following configuration in DUT2:
set interfaces eth0 address 10.1.0.2/24 set protocols static route 0.0.0.0/0 next-hop 10.1.0.1
Step 2: Set the following configuration in DUT1:
set interfaces eth0 address 80.0.0.2/24 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set interfaces dum0 address 10.3.0.1/24 set vpn ipsec site-to-site peer PEER local-address 80.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1 set vpn ipsec site-to-site peer PEER vti remote-prefix 10.1.0.0/24 set vpn ipsec site-to-site peer PEER connection-type on-demand set interfaces vti0 ipsec PEER set interfaces vti0 local-address 80.0.0.2 set protocols static route 0.0.0.0/0 interface vti0 set vpn ipsec esp-group CHILD-SA mode tunnel
Step 3: Set the following configuration in DUT0:
set interfaces eth0 address 80.0.0.1/24 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set interfaces eth1 address 10.1.0.1/24 set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER local-address 80.0.0.1 set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2 set vpn ipsec site-to-site peer PEER vti local-prefix 10.1.0.0/24 set interfaces vti vti0 ipsec PEER set interfaces vti vti0 local-address 80.0.0.1 set interfaces vti vti0 remote-address 0.0.0.0 set protocols static route 10.3.0.0/24 interface vti0 set vpn ipsec esp-group CHILD-SA mode tunnel
Step 4: Ping IP address 80.0.0.1 from DUT1:
admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data. 64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.844 ms --- 80.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.844/0.844/0.844/0.000 ms
Step 5: Ping IP address 80.0.0.2 from DUT0:
admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data. 64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.554 ms --- 80.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.554/0.554/0.554/0.000 ms
Step 6: Ping IP address 10.1.0.2 from DUT0:
admin@DUT0$ ping 10.1.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.768 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.768/0.768/0.768/0.000 ms
Step 7: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.574 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.574/0.574/0.574/0.000 ms
Step 8: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=1.09 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.093/1.093/1.093/0.000 ms
Step 9: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, db0b7b740f4342ca_i 6a3b66294850def4_r* local '80.0.0.1' @ 80.0.0.1[500] remote '80.0.0.2' @ 80.0.0.2[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 24568s peer-PEER-tunnel-VTI: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3241s, expires in 3959s in cf693481 (0x90000000), 168 bytes, 2 packets, 0s ago out c816041c (0x90000000), 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 0.0.0.0/0
Step 10: Run command vpn ipsec clear sa at DUT1 and expect this output:
Show output
Deleting IPSec SAs... 100% Closed tunnels: 1
Step 11: Set the following configuration in DUT1:
del interfaces dum0 set interfaces dum0 address 10.3.0.2/24
Step 12: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.646 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.646/0.646/0.646/0.000 ms
Step 13: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=1.09 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.086/1.086/1.086/0.000 ms
Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 6f9572c49b813332_i 9a9528bd687eb689_r* local '80.0.0.1' @ 80.0.0.1[500] remote '80.0.0.2' @ 80.0.0.2[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 21191s peer-PEER-tunnel-VTI: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3296s, expires in 3959s in c9062f7a (0x90000000), 168 bytes, 2 packets, 0s ago out c6d9606f (0x90000000), 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 0.0.0.0/0
Attention
The command vpn show ipsec policy can be used to debug
the IPSec selectors that have been installed in OSDx devices.
Example for device DUT0:
Show output
src 10.1.0.0/24 dst 0.0.0.0/0 dev vti0 dir out priority 387709 mark 0x90000000/0xffffffff tmpl src 80.0.0.1 dst 80.0.0.2 proto esp spi 0xc6d9606f reqid 2 mode tunnel src 0.0.0.0/0 dst 10.1.0.0/24 dir fwd priority 387711 mark 0x90000000/0xffffffff tmpl src 80.0.0.2 dst 80.0.0.1 proto esp reqid 2 mode tunnel src 0.0.0.0/0 dst 10.1.0.0/24 dir in priority 387711 mark 0x90000000/0xffffffff tmpl src 80.0.0.2 dst 80.0.0.1 proto esp reqid 2 mode tunnel src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src ::/0 dst ::/0 socket in priority 0 src ::/0 dst ::/0 socket out priority 0 src ::/0 dst ::/0 socket in priority 0 src ::/0 dst ::/0 socket out priority 0
Test VPN Roadwarrior Connection With Global Policies
Description
In this scenario, DUT0 uses global VPN
policies (or selectors) to encapsulate traffic.
Scenario
Step 1: Set the following configuration in DUT2:
set interfaces eth0 address 10.1.0.2/24 set protocols static route 0.0.0.0/0 next-hop 10.1.0.1
Step 2: Set the following configuration in DUT1:
set interfaces eth0 address 80.0.0.2/24 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set interfaces dum0 address 10.3.0.1/24 set vpn ipsec site-to-site peer PEER local-address 80.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1 set vpn ipsec site-to-site peer PEER vti remote-prefix 10.1.0.0/24 set vpn ipsec site-to-site peer PEER connection-type on-demand set interfaces vti0 ipsec PEER set interfaces vti0 local-address 80.0.0.2 set protocols static route 0.0.0.0/0 interface vti0 set vpn ipsec esp-group CHILD-SA mode tunnel
Step 3: Set the following configuration in DUT0:
set interfaces eth0 address 80.0.0.1/24 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set interfaces eth1 address 10.1.0.1/24 set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER local-address 80.0.0.1 set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.3.0.0/24 set protocols static route 10.3.0.0/24 interface eth0 set vpn ipsec esp-group CHILD-SA mode tunnel
Step 4: Ping IP address 80.0.0.1 from DUT1:
admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data. 64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.769 ms --- 80.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.769/0.769/0.769/0.000 ms
Step 5: Ping IP address 80.0.0.2 from DUT0:
admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data. 64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.499 ms --- 80.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.499/0.499/0.499/0.000 ms
Step 6: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.666 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.666/0.666/0.666/0.000 ms
Step 7: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=1.60 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.598/1.598/1.598/0.000 ms
Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 04693efbb0f2d979_i 7d077b199e9b6e34_r* local '80.0.0.1' @ 80.0.0.1[500] remote '80.0.0.2' @ 80.0.0.2[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 18778s peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3306s, expires in 3960s in c5f59258, 168 bytes, 2 packets, 1s ago out cc611083, 168 bytes, 2 packets, 1s ago local 10.1.0.0/24 remote 10.3.0.0/24
Step 9: Run command vpn ipsec clear sa at DUT1 and expect this output:
Show output
Deleting IPSec SAs... 100% Closed tunnels: 1
Step 10: Set the following configuration in DUT1:
del interfaces dum0 set interfaces dum0 address 10.3.0.2/24
Step 11: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.630 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.630/0.630/0.630/0.000 ms
Step 12: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=1.06 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.060/1.060/1.060/0.000 ms
Step 13: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 8ebfe7915c3b4c81_i 0b24d7d9f2a47bc0_r* local '80.0.0.1' @ 80.0.0.1[500] remote '80.0.0.2' @ 80.0.0.2[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 27280s peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3372s, expires in 3959s in c5cdc1d4, 168 bytes, 2 packets, 1s ago out c62e066a, 168 bytes, 2 packets, 1s ago local 10.1.0.0/24 remote 10.3.0.0/24
Attention
The command vpn show ipsec policy can be used to debug
the IPSec selectors that have been installed in OSDx devices.
Example for device DUT0:
Show output
src 10.1.0.0/24 dst 10.3.0.0/24 dev eth0 dir out priority 375423 tmpl src 80.0.0.1 dst 80.0.0.2 proto esp spi 0xc62e066a reqid 2 mode tunnel src 10.3.0.0/24 dst 10.1.0.0/24 dir fwd priority 375423 tmpl src 80.0.0.2 dst 80.0.0.1 proto esp reqid 2 mode tunnel src 10.3.0.0/24 dst 10.1.0.0/24 dir in priority 375423 tmpl src 80.0.0.2 dst 80.0.0.1 proto esp reqid 2 mode tunnel src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src ::/0 dst ::/0 socket in priority 0 src ::/0 dst ::/0 socket out priority 0 src ::/0 dst ::/0 socket in priority 0 src ::/0 dst ::/0 socket out priority 0