Site-To-Site

These scenarios show how to configure VPN site-to-site connections.

../../../../_images/topology18.svg

Test One P2P Tunnel

Description

Simple VPN site-to-site configuration with a single tunnel in the main VRF.

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY

Step 3: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1
Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.441 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.441/0.441/0.441/0.000 ms

Step 4: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.427 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.427/0.427/0.427/0.000 ms

Step 5: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #1, ESTABLISHED, IKEv2, da74eddb32b074e7_i* 043471af563bc190_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 0s ago, rekeying in 16682s
  peer-SITE1-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 0s ago, rekeying in 3293s, expires in 3960s
    in  cc4f8db0,    168 bytes,     2 packets,     0s ago
    out c2a07381,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32

Test One P2P Tunnel with VRFs

Description

Single-VRF VPN site-to-site configuration-.

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY
set system vrf A
set interfaces eth0.10 vrf A
set vpn ipsec site-to-site peer SITE1 local-vrf A
set vpn ipsec site-to-site peer SITE1 tunnel 1 local-interface eth0.10

Step 3: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf A count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than A.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 A: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.466 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.466/0.466/0.466/0.000 ms

Step 4: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.399 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.399/0.399/0.399/0.000 ms

Step 5: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #1, ESTABLISHED, IKEv2, c2edf0de4e48e468_i* e008255cbf00b3de_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 0s ago, rekeying in 25124s
  peer-SITE1-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 0s ago, rekeying in 3476s, expires in 3960s
    in  c02cd838,    168 bytes,     2 packets,     0s ago
    out c0e75768,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32

Test Two P2P Tunnels With VRFs

Description

Multiple VPN site-to-site connections using different VRFs (no overlapped IP addresses).

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT2:

set interfaces eth0.20 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.3
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 3: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY
set system vrf A
set interfaces eth0.10 vrf A
set vpn ipsec site-to-site peer SITE1 local-vrf A
set vpn ipsec site-to-site peer SITE1 tunnel 1 local-interface eth0.10
set system vrf B
set interfaces eth1.20 address 10.0.0.3/24
set interfaces eth1.20 vrf B
set vpn ipsec site-to-site peer SITE2 local-vrf B
set vpn ipsec site-to-site peer SITE2 tunnel 1 local-interface eth1.20
set vpn ipsec site-to-site peer SITE2 local-address 10.0.0.3
set vpn ipsec site-to-site peer SITE2 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE2 tunnel 1 local prefix 10.0.0.3/32
set vpn ipsec site-to-site peer SITE2 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE2 auth-profile AUTH
set vpn ipsec site-to-site peer SITE2 connection-type initiate
set vpn ipsec site-to-site peer SITE2 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE2 tunnel 1 esp-group ESP-POLICY

Step 4: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf A count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than A.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 A: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.625 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.625/0.625/0.625/0.000 ms

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.540 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.540/0.540/0.540/0.000 ms

Step 6: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf B count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than B.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.3 B: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.578 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.578/0.578/0.578/0.000 ms

Step 7: Ping IP address 10.0.0.3 from DUT2:

admin@DUT2$ ping 10.0.0.3 count 1 size 56 timeout 1
Show output
PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.
64 bytes from 10.0.0.3: icmp_seq=1 ttl=64 time=0.588 ms

--- 10.0.0.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.588/0.588/0.588/0.000 ms

Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #2, ESTABLISHED, IKEv2, 46ef9588616b7137_i* 54076513e8d47196_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 1s ago, rekeying in 23084s
  peer-SITE1-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 1s ago, rekeying in 3272s, expires in 3959s
    in  c6bb89eb,    168 bytes,     2 packets,     0s ago
    out c55f8a87,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32
vpn-peer-SITE2: #1, ESTABLISHED, IKEv2, 133fa13e8b908123_i* d05cd1204ccb2d4b_r
  local  '10.0.0.3' @ 10.0.0.3[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 1s ago, rekeying in 16378s
  peer-SITE2-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 1s ago, rekeying in 3303s, expires in 3959s
    in  cabf2b27,    168 bytes,     2 packets,     0s ago
    out c0b8cad2,    168 bytes,     2 packets,     0s ago
    local  10.0.0.3/32
    remote 10.0.0.2/32

Test Two P2P Tunnels With VRFs And Overlapped IP Addresses

Description

Multiple VPN site-to-site connections using different VRFs (overlapped IP addresses).

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces eth0.10 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY

Step 2: Set the following configuration in DUT2:

set interfaces eth0.20 address 10.0.0.2/24
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.3
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE local-address 10.0.0.2
set vpn ipsec site-to-site peer SITE tunnel 1 local prefix 10.0.0.2/32
set vpn ipsec site-to-site peer SITE tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE auth-profile AUTH
set vpn ipsec site-to-site peer SITE connection-type respond
set vpn ipsec site-to-site peer SITE ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE tunnel 1 esp-group ESP-POLICY
del vpn ipsec site-to-site peer SITE remote-address
set vpn ipsec site-to-site peer SITE remote-address 10.0.0.1

Step 3: Set the following configuration in DUT0:

set interfaces eth0.10 address 10.0.0.1/24
set vpn ipsec auth-profile AUTH local auth pre-shared-secret test
set vpn ipsec esp-group ESP-POLICY lifetime 8 MB
set vpn ipsec esp-group ESP-POLICY proposal 1 encryption aes128gmac
set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1
set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15
set vpn ipsec ike-group IKE-POLICY dead-peer-detection interval 60
set vpn ipsec ike-group IKE-POLICY key-exchange ikev2
set vpn ipsec ike-group IKE-POLICY lifetime 28800
set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null
set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1
set vpn ipsec ike-group IKE-POLICY proposal 2 dh-group 15
set vpn ipsec ike-group IKE-POLICY proposal 2 encryption aes128
set vpn ipsec ike-group IKE-POLICY proposal 2 hash sha1
set vpn ipsec site-to-site peer SITE1 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE1 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE1 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE1 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE1 auth-profile AUTH
set vpn ipsec site-to-site peer SITE1 connection-type initiate
set vpn ipsec site-to-site peer SITE1 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE1 tunnel 1 esp-group ESP-POLICY
set system vrf A
set interfaces eth0.10 vrf A
set vpn ipsec site-to-site peer SITE1 local-vrf A
set vpn ipsec site-to-site peer SITE1 tunnel 1 local-interface eth0.10
set system vrf B
set interfaces eth1.20 address 10.0.0.3/24
set interfaces eth1.20 vrf B
set vpn ipsec site-to-site peer SITE2 local-vrf B
set vpn ipsec site-to-site peer SITE2 tunnel 1 local-interface eth1.20
del interfaces eth1.20 address
set interfaces eth1.20 address 10.0.0.1/24
set vpn ipsec site-to-site peer SITE2 local-address 10.0.0.1
set vpn ipsec site-to-site peer SITE2 remote-address 10.0.0.2
set vpn ipsec site-to-site peer SITE2 tunnel 1 local prefix 10.0.0.1/32
set vpn ipsec site-to-site peer SITE2 tunnel 1 remote prefix 10.0.0.0/24
set vpn ipsec site-to-site peer SITE2 auth-profile AUTH
set vpn ipsec site-to-site peer SITE2 connection-type initiate
set vpn ipsec site-to-site peer SITE2 ike-group IKE-POLICY
set vpn ipsec site-to-site peer SITE2 tunnel 1 esp-group ESP-POLICY

Step 4: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf A count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than A.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 A: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.649 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.649/0.649/0.649/0.000 ms

Step 5: Ping IP address 10.0.0.1 from DUT1:

admin@DUT1$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.531 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.531/0.531/0.531/0.000 ms

Step 6: Ping IP address 10.0.0.2 from DUT0:

admin@DUT0$ ping 10.0.0.2 vrf B count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than B.
PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 B: 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.457 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.457/0.457/0.457/0.000 ms

Step 7: Ping IP address 10.0.0.1 from DUT2:

admin@DUT2$ ping 10.0.0.1 count 1 size 56 timeout 1
Show output
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.405 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.405/0.405/0.405/0.000 ms

Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

ESTABLISHED, IKEv2
\d+ bytes,\s+\d+ packets
local\s+(\d+\.){3}[13]\/32\s+remote\s+(\d+\.){3}2\/32
Show output
vpn-peer-SITE1: #2, ESTABLISHED, IKEv2, d9e935b7e3d625d6_i* 6cccdde44c327f91_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 0s ago, rekeying in 26933s
  peer-SITE1-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 0s ago, rekeying in 3315s, expires in 3960s
    in  c48d19ed,    168 bytes,     2 packets,     1s ago
    out ca1ed6f9,    168 bytes,     2 packets,     1s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32
vpn-peer-SITE2: #1, ESTABLISHED, IKEv2, 2d89a26063816709_i* fc95ec0c48944893_r
  local  '10.0.0.1' @ 10.0.0.1[500]
  remote '10.0.0.2' @ 10.0.0.2[500]
  NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
  established 0s ago, rekeying in 26038s
  peer-SITE2-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:NULL_AES_GMAC-128
    installed 0s ago, rekeying in 3248s, expires in 3960s
    in  c1d2b90a,    168 bytes,     2 packets,     0s ago
    out cb19637b,    168 bytes,     2 packets,     0s ago
    local  10.0.0.1/32
    remote 10.0.0.2/32