Same-Remote

This scenario shows how to configure a VPN responder that can receive incoming connections from the same virtual IP address.

Test Site-To-Site With Same Remote Address

Description

VPN site-to-site configuration to connect two subnets to an end-point using the same virtual IP address.

Scenario

Attention

In order to make this scenario work, the device needs a way to respond and reinject traffic through the appropriate VPN tunnel. This can be achieved by copying the packet mark into the conntrack mark and restoring it later. Therefore, the following configuration lines are needed:

Step 1: Set the following configuration in DUT0:

set interfaces eth0 address 80.0.0.1/24
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 0.0.0.0/0
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set interfaces dum0 address 10.1.0.1/24
set protocols static route 0.0.0.0/0 interface dum0
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec esp-group CHILD-SA mark-in unique
set vpn ipsec esp-group CHILD-SA mark-out unique
set traffic policy IN_MARK_TO_FLOW rule 1 copy mark connmark
set traffic policy OUT_FLOW_TO_MARK rule 1 copy connmark mark
set interfaces eth0 traffic policy in IN_MARK_TO_FLOW
set interfaces dum0 traffic policy local-out OUT_FLOW_TO_MARK

Step 2: Set the following configuration in DUT1:

set interfaces eth0 address 80.0.0.2/24
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24
set interfaces dum0 address 10.3.0.1/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA

Step 3: Set the following configuration in DUT2:

set interfaces eth0 address 80.0.0.3/24
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24
set interfaces dum0 address 10.3.0.1/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA

Step 4: Ping IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 80.0.0.3 from DUT0:

admin@DUT0$ ping 80.0.0.3 count 1 size 56 timeout 1

Step 6: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:

80.0.0.2
80.0.0.3

Step 7: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1

Step 8: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1

Step 9: Run command vpn ipsec show sa remote 80.0.0.2 at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets

Step 10: Run command vpn ipsec show sa remote 80.0.0.3 at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets

Attention

The command vpn show ipsec policy can be used to debug the IPSec selectors that have been installed in OSDx devices. Example for device DUT0: