Site-To-Site

These scenarios show how to configure VPN site-to-site connections.

../../../../_images/topology23.svg

Test One P2P Tunnel

Description

Simple VPN site-to-site configuration with a single tunnel in the main VRF.

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY

Step 3: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1
Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.492 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.492/0.492/0.492/0.000 ms

Step 4: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.354 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.354/0.354/0.354/0.000 ms

Step 5: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #1, ESTABLISHED, IKEv2, 9ae6da08a00bc3d2_i* 00029a39e17ef0cb_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 0s ago, rekeying in 19594s
  peer-SITE1-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 0s ago, rekeying in 3257s, expires in 3960s
    in  cea76b99,    168 bytes,     2 packets,     0s ago
    out c3019771,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32

Test One P2P Tunnel with VRFs

Description

Single-VRF VPN site-to-site configuration-.

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY
set system vrf A
set interfaces eth0.10 vrf A
set vpn ipsec site-to-site peer SITE1 local-vrf A
set vpn ipsec site-to-site peer SITE1 tunnel 1 local-interface eth0.10

Step 3: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf A count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than A.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 A: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.424 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.424/0.424/0.424/0.000 ms

Step 4: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.305 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.305/0.305/0.305/0.000 ms

Step 5: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #1, ESTABLISHED, IKEv2, 9e53bfc1c9f7e6d0_i* 23b692e5818c119a_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 1s ago, rekeying in 21884s
  peer-SITE1-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 1s ago, rekeying in 3260s, expires in 3959s
    in  c9010b59,    168 bytes,     2 packets,     0s ago
    out cbcb8bf1,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32

Test Two P2P Tunnels With VRFs

Description

Multiple VPN site-to-site connections using different VRFs (no overlapped IP addresses).

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT2:

set interfaces eth0.20 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.3
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 3: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY
set system vrf A
set interfaces eth0.10 vrf A
set vpn ipsec site-to-site peer SITE1 local-vrf A
set vpn ipsec site-to-site peer SITE1 tunnel 1 local-interface eth0.10
set system vrf B
set interfaces eth1.20 address 10.0.0.3/24
set interfaces eth1.20 vrf B
set vpn ipsec site-to-site peer SITE2 local-vrf B
set vpn ipsec site-to-site peer SITE2 tunnel 1 local-interface eth1.20
set vpn ipsec site-to-site peer SITE2 local-address 10.0.0.3
set vpn ipsec site-to-site peer SITE2 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE2 tunnel 1 local prefix 10.0.0.3/32
set vpn ipsec site-to-site peer SITE2 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE2 auth-profile AUTH
set vpn ipsec site-to-site peer SITE2 connection-type initiate
set vpn ipsec site-to-site peer SITE2 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE2 tunnel 1 esp-group ESP-POLICY

Step 4: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf A count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than A.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 A: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.337 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.337/0.337/0.337/0.000 ms

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.396 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.396/0.396/0.396/0.000 ms

Step 6: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf B count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than B.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.3 B: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.298 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.298/0.298/0.298/0.000 ms

Step 7: Ping IP address 10.0.0.3 from DUT2:

admin@DUT2$ ping 10.0.0.3 count 1 size 56 timeout 1
Show output
PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.
64 bytes from 10.0.0.3: icmp_seq=1 ttl=64 time=0.395 ms

--- 10.0.0.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.395/0.395/0.395/0.000 ms

Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #2, ESTABLISHED, IKEv2, e6420370c7c69a6b_i* e4e436ae84074cb8_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 1s ago, rekeying in 21216s
  peer-SITE1-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 1s ago, rekeying in 3386s, expires in 3959s
    in  c2eedb79,    168 bytes,     2 packets,     0s ago
    out c0587e6f,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32
vpn-peer-SITE2: #1, ESTABLISHED, IKEv2, a6d417ef06f1a5c4_i* c923134f30ad7b30_r
  local  '10.0.0.3' @ 10.0.0.3[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 1s ago, rekeying in 17570s
  peer-SITE2-tunnel-1: #1, reqid 2, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 1s ago, rekeying in 3335s, expires in 3959s
    in  c11135d2,    168 bytes,     2 packets,     0s ago
    out c92b5355,    168 bytes,     2 packets,     0s ago
    local  10.0.0.3/32
    remote 10.0.0.2/32

Test Two P2P Tunnels With VRFs And Overlapped IP Addresses

Description

Multiple VPN site-to-site connections using different VRFs (overlapped IP addresses).

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT2:

set interfaces eth0.20 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.3
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY
del vpn ipsec site-to-site peer SITE remote-address
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1

Step 3: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY
set system vrf A
set interfaces eth0.10 vrf A
set vpn ipsec site-to-site peer SITE1 local-vrf A
set vpn ipsec site-to-site peer SITE1 tunnel 1 local-interface eth0.10
set system vrf B
set interfaces eth1.20 address 10.0.0.3/24
set interfaces eth1.20 vrf B
set vpn ipsec site-to-site peer SITE2 local-vrf B
set vpn ipsec site-to-site peer SITE2 tunnel 1 local-interface eth1.20
del interfaces eth1.20 address
set interfaces eth1.20 address 10.0.0.1/24
set vpn ipsec site-to-site peer SITE2 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE2 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE2 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE2 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE2 auth-profile AUTH
set vpn ipsec site-to-site peer SITE2 connection-type initiate
set vpn ipsec site-to-site peer SITE2 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE2 tunnel 1 esp-group ESP-POLICY

Step 4: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf A count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than A.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 A: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.333 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.333/0.333/0.333/0.000 ms

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.361 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.361/0.361/0.361/0.000 ms

Step 6: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf B count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than B.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 B: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.521 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.521/0.521/0.521/0.000 ms

Step 7: Ping IP address 10.0.0.1 from DUT2:

admin@DUT2$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.318 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.318/0.318/0.318/0.000 ms

Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #2, ESTABLISHED, IKEv2, ad43f8793adb175f_i* 9de8f4d9bdfedf15_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 0s ago, rekeying in 19226s
  peer-SITE1-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 0s ago, rekeying in 3271s, expires in 3960s
    in  c8124c70,    168 bytes,     2 packets,     0s ago
    out ce28a288,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32
vpn-peer-SITE2: #1, ESTABLISHED, IKEv2, 957f96a6aa81ce5e_i* e6019d7b01ee1328_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 0s ago, rekeying in 23571s
  peer-SITE2-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 0s ago, rekeying in 3271s, expires in 3960s
    in  ccc8f467,    168 bytes,     2 packets,     0s ago
    out c864ae9e,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32