Check Vti To Vti
This scenario shows how to configure and route traffic via VTI (Virtual Tunnel Interface) devices.
Test VTI To VTI
Description
A VTI device is configured in each end-point.
Scenario
Step 1: Set the following configuration in DUT0
:
set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER vti local-prefix 10.0.0.1/32 set vpn ipsec site-to-site peer PEER vti remote-prefix 20.0.0.1/32 set vpn ipsec site-to-site peer PEER local-address 192.168.100.10 set vpn ipsec site-to-site peer PEER remote-address 192.168.100.20 set interfaces ethernet eth0 address 192.168.100.10/24 set interfaces vti vti0 address 10.0.0.1/32 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set interfaces vti vti0 ipsec PEER set protocols static route 0.0.0.0/0 interface vti0
Step 2: Set the following configuration in DUT1
:
set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER vti local-prefix 20.0.0.1/32 set vpn ipsec site-to-site peer PEER vti remote-prefix 10.0.0.1/32 set vpn ipsec site-to-site peer PEER local-address 192.168.100.20 set vpn ipsec site-to-site peer PEER remote-address 192.168.100.10 set interfaces ethernet eth0 address 192.168.100.20/24 set interfaces vti vti0 address 20.0.0.1/32 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set interfaces vti vti0 ipsec PEER set protocols static route 0.0.0.0/0 interface vti0
Step 3: Run command vpn ipsec show sa
at DUT0
and check if output contains the following tokens:
ESTABLISHED
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 338ee7fa569b2c60_i be9c7b290e9d96d2_r* local '192.168.100.10' @ 192.168.100.10[500] remote '192.168.100.20' @ 192.168.100.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 24709s peer-PEER-tunnel-VTI: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3316s, expires in 3960s in c203dfc3 (0x90000000), 0 bytes, 0 packets out cb8b9443 (0x90000000), 0 bytes, 0 packets local 10.0.0.1/32 remote 20.0.0.1/32
Step 4: Ping IP address 20.0.0.1
from DUT0
:
admin@DUT0$ ping 20.0.0.1 count 1 size 56 timeout 1Show output
PING 20.0.0.1 (20.0.0.1) 56(84) bytes of data. 64 bytes from 20.0.0.1: icmp_seq=1 ttl=64 time=0.387 ms --- 20.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.387/0.387/0.387/0.000 ms
Step 5: Run command vpn ipsec show sa
at DUT0
and check if output matches the following regular expressions:
,\s+[^0] packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 338ee7fa569b2c60_i be9c7b290e9d96d2_r* local '192.168.100.10' @ 192.168.100.10[500] remote '192.168.100.20' @ 192.168.100.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 24708s peer-PEER-tunnel-VTI: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3315s, expires in 3959s in c203dfc3 (0x90000000), 84 bytes, 1 packets, 0s ago out cb8b9443 (0x90000000), 84 bytes, 1 packets, 0s ago local 10.0.0.1/32 remote 20.0.0.1/32