Xfrm Offload
This scenario shows how to configure IPSec policies and offload encryption/decryption processes.
Test XFRM Offload With VTI
Description
In this scenario, the tunnel is established by using a site-to-site peer through VTI interfaces.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 60.0.0.10/24 set interfaces ethernet eth1 address 192.168.10.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER vti local-prefix 0.0.0.0/0 set vpn ipsec site-to-site peer PEER vti remote-prefix 0.0.0.0/0 set interfaces vti vti0 ipsec PEER set protocols static route 0.0.0.0/0 interface vti0 set interfaces vti vti0 address 10.0.0.1/32 set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER local-address 60.0.0.10 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.20
Step 2: Set the following configuration in DUT1:
set interfaces ethernet eth0 address 60.0.0.20/24 set interfaces ethernet eth1 address 192.168.20.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER vti local-prefix 0.0.0.0/0 set vpn ipsec site-to-site peer PEER vti remote-prefix 0.0.0.0/0 set interfaces vti vti0 ipsec PEER set protocols static route 0.0.0.0/0 interface vti0 set interfaces vti vti0 address 20.0.0.1/32 set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER local-address 60.0.0.20 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.10
Step 3: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:
INSTALLEDShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 06955786cb1d2a0c_i 2daea3de4f8b1881_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 26821s peer-PEER-tunnel-VTI: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3338s, expires in 3960s in c0b462aa (0x90000000), 0 bytes, 0 packets out c37c0896 (0x90000000), 0 bytes, 0 packets local 0.0.0.0/0 remote 0.0.0.0/0
Step 4: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 5: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 6: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 7: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
unknown 50 src=60.0.0.10 dst=60.0.0.20 packets=3 bytes=300 src=60.0.0.20 dst=60.0.0.10 packets=3 bytes=300 [OFFLOAD, packets=1 bytes=100 packets=1 bytes=100] mark=0 use=2 udp 17 23 src=127.0.0.1 dst=127.0.0.1 sport=33359 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=33359 packets=0 bytes=0 mark=0 use=1 udp 17 19 src=127.0.0.1 dst=127.0.0.1 sport=43309 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=43309 packets=0 bytes=0 mark=0 use=1 udp 17 19 src=127.0.0.1 dst=127.0.0.1 sport=54972 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=54972 packets=0 bytes=0 mark=0 use=1 udp 17 22 src=60.0.0.20 dst=60.0.0.10 sport=500 dport=500 packets=2 bytes=537 src=60.0.0.10 dst=60.0.0.20 sport=500 dport=500 packets=2 bytes=513 mark=0 use=1 udp 17 179 src=10.0.0.1 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=10.0.0.1 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] mark=0 use=1 udp 17 23 src=127.0.0.1 dst=127.0.0.1 sport=43977 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=43977 packets=0 bytes=0 mark=0 use=1 conntrack v1.4.5 (conntrack-tools): 7 flow entries have been shown.
Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
in.*\s+[^0]\d+ packets out.*\s+[^0]\d+ packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 06955786cb1d2a0c_i 2daea3de4f8b1881_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 8s ago, rekeying in 26813s peer-PEER-tunnel-VTI: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 8s ago, rekeying in 3330s, expires in 3952s in c0b462aa (0x90000000), 138 bytes, 3 packets, 0s ago out c37c0896 (0x90000000), 138 bytes, 3 packets, 0s ago local 0.0.0.0/0 remote 0.0.0.0/0
Test XFRM Offload With DMVPN Tunnel Mode
Description
In this scenario, the tunnel is established by using NHRP. Tunnel mode is used for IPSec policies.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 60.0.0.10/24 set interfaces ethernet eth1 address 192.168.10.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set interfaces tunnel tun1 encapsulation gre set vpn ipsec dmvpn-profile NHRP auth-profile AUTH-SA set vpn ipsec dmvpn-profile NHRP esp-group CHILD-SA set vpn ipsec dmvpn-profile NHRP ike-group IKE-SA set interfaces tunnel tun1 nhrp ipsec NHRP set interfaces tunnel tun1 address 10.0.0.1/32 set interfaces tunnel tun1 local-interface eth0 set interfaces tunnel tun1 local-address 60.0.0.10 set protocols static route 192.168.20.0/24 next-hop 20.0.0.1
Step 2: Set the following configuration in DUT1:
set interfaces ethernet eth0 address 60.0.0.20/24 set interfaces ethernet eth1 address 192.168.20.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set interfaces tunnel tun1 encapsulation gre set vpn ipsec dmvpn-profile NHRP auth-profile AUTH-SA set vpn ipsec dmvpn-profile NHRP esp-group CHILD-SA set vpn ipsec dmvpn-profile NHRP ike-group IKE-SA set interfaces tunnel tun1 nhrp ipsec NHRP set interfaces tunnel tun1 address 20.0.0.1/32 set interfaces tunnel tun1 local-interface eth0 set interfaces tunnel tun1 local-address 60.0.0.20 set interfaces tunnel tun1 nhrp nhs 10.0.0.1 nbma 60.0.0.10 set protocols static route 192.168.10.0/24 next-hop 10.0.0.1
Step 3: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:
INSTALLEDShow output
vpnprof-dmvpn-NHRP: #1, ESTABLISHED, IKEv2, cad4108c66f983b2_i fb411e7c581b74fc_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 28369s NHRP: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3445s, expires in 3959s in c9d35c1a, 116 bytes, 1 packets, 1s ago out c763679d, 136 bytes, 1 packets, 1s ago local 60.0.0.10/32[gre] remote 60.0.0.20/32[gre]
Step 4: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 5: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 6: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 7: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
udp 17 25 src=127.0.0.1 dst=127.0.0.1 sport=52269 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=52269 packets=0 bytes=0 mark=0 use=1 unknown 50 src=60.0.0.20 dst=60.0.0.10 packets=4 bytes=544 src=60.0.0.10 dst=60.0.0.20 packets=4 bytes=564 [OFFLOAD, packets=2 bytes=248 packets=2 bytes=248] mark=0 use=2 gre 47 179 src=60.0.0.20 dst=60.0.0.10 srckey=0x0 dstkey=0x0 packets=4 bytes=326 src=60.0.0.10 dst=60.0.0.20 srckey=0x0 dstkey=0x0 packets=4 bytes=346 [ASSURED] mark=0 use=1 udp 17 21 src=60.0.0.20 dst=60.0.0.10 sport=500 dport=500 packets=2 bytes=537 src=60.0.0.10 dst=60.0.0.20 sport=500 dport=500 packets=2 bytes=513 mark=0 use=1 udp 17 179 src=10.0.0.1 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=10.0.0.1 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] mark=0 use=1 udp 17 25 src=127.0.0.1 dst=127.0.0.1 sport=54047 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=54047 packets=0 bytes=0 mark=0 use=1 udp 17 21 src=127.0.0.1 dst=127.0.0.1 sport=59195 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=59195 packets=0 bytes=0 mark=0 use=1 udp 17 21 src=127.0.0.1 dst=127.0.0.1 sport=51276 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=51276 packets=0 bytes=0 mark=0 use=1 conntrack v1.4.5 (conntrack-tools): 8 flow entries have been shown.
Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
in.*\s+[^0]\d+ packets out.*\s+[^0]\d+ packetsShow output
vpnprof-dmvpn-NHRP: #1, ESTABLISHED, IKEv2, cad4108c66f983b2_i fb411e7c581b74fc_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 9s ago, rekeying in 28361s NHRP: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 9s ago, rekeying in 3437s, expires in 3951s in c9d35c1a, 326 bytes, 4 packets, 0s ago out c763679d, 346 bytes, 4 packets, 0s ago local 60.0.0.10/32[gre] remote 60.0.0.20/32[gre]
Step 9: Set the following configuration in DUT2:
set interfaces ethernet eth0 address 192.168.10.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.10.1
Step 10: Ping IP address 192.168.20.1 from DUT2:
admin@DUT2$ ping 192.168.20.1 count 1 size 56 timeout 1Show output
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data. 64 bytes from 192.168.20.1: icmp_seq=1 ttl=63 time=0.835 ms --- 192.168.20.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.835/0.835/0.835/0.000 ms
Step 11: Run command system conntrack clear at DUT0 and expect this output:
Show output
Connection tracking table has been emptied
Step 12: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 13: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 14: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*] udp\s+17.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
unknown 50 src=60.0.0.10 dst=60.0.0.20 packets=3 bytes=372 src=60.0.0.20 dst=60.0.0.10 packets=3 bytes=372 [OFFLOAD, packets=1 bytes=124 packets=1 bytes=124] mark=0 use=2 udp 17 27 src=127.0.0.1 dst=127.0.0.1 sport=35931 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=35931 packets=0 bytes=0 mark=0 use=1 gre 47 179 src=60.0.0.10 dst=60.0.0.20 srckey=0x0 dstkey=0x0 packets=3 bytes=210 src=60.0.0.20 dst=60.0.0.10 srckey=0x0 dstkey=0x0 packets=3 bytes=210 [ASSURED] mark=0 use=1 udp 17 27 src=127.0.0.1 dst=127.0.0.1 sport=45148 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=45148 packets=0 bytes=0 mark=0 use=1 udp 17 src=192.168.10.2 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=192.168.10.2 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] [OFFLOAD, packets=1 bytes=46 packets=2 bytes=92] mark=0 use=2 conntrack v1.4.5 (conntrack-tools): 5 flow entries have been shown.
Test XFRM Offload With DMVPN Transport Mode
Description
In this scenario, the tunnel is established by using NHRP. Transport mode is used for IPSec policies.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 60.0.0.10/24 set interfaces ethernet eth1 address 192.168.10.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set interfaces tunnel tun1 encapsulation gre set vpn ipsec dmvpn-profile NHRP auth-profile AUTH-SA set vpn ipsec dmvpn-profile NHRP esp-group CHILD-SA set vpn ipsec dmvpn-profile NHRP ike-group IKE-SA set interfaces tunnel tun1 nhrp ipsec NHRP set interfaces tunnel tun1 address 10.0.0.1/32 set interfaces tunnel tun1 local-interface eth0 set interfaces tunnel tun1 local-address 60.0.0.10 set protocols static route 192.168.20.0/24 next-hop 20.0.0.1 set vpn ipsec esp-group CHILD-SA mode transport
Step 2: Set the following configuration in DUT1:
set interfaces ethernet eth0 address 60.0.0.20/24 set interfaces ethernet eth1 address 192.168.20.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set interfaces tunnel tun1 encapsulation gre set vpn ipsec dmvpn-profile NHRP auth-profile AUTH-SA set vpn ipsec dmvpn-profile NHRP esp-group CHILD-SA set vpn ipsec dmvpn-profile NHRP ike-group IKE-SA set interfaces tunnel tun1 nhrp ipsec NHRP set interfaces tunnel tun1 address 20.0.0.1/32 set interfaces tunnel tun1 local-interface eth0 set interfaces tunnel tun1 local-address 60.0.0.20 set interfaces tunnel tun1 nhrp nhs 10.0.0.1 nbma 60.0.0.10 set protocols static route 192.168.10.0/24 next-hop 10.0.0.1 set vpn ipsec esp-group CHILD-SA mode transport
Step 3: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:
INSTALLEDShow output
vpnprof-dmvpn-NHRP: #1, ESTABLISHED, IKEv2, ec40f9a0851b0107_i 43ce8960526f3b97_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 25607s NHRP: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3435s, expires in 3959s in cd03ac59, 96 bytes, 1 packets, 1s ago out ca11e547, 116 bytes, 1 packets, 1s ago local 60.0.0.10/32[gre] remote 60.0.0.20/32[gre]
Step 4: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 5: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 6: Initiate a udp connection from DUT0 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT0$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 7: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
udp 17 17 src=127.0.0.1 dst=127.0.0.1 sport=40712 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=40712 packets=0 bytes=0 mark=0 use=1 udp 17 28 src=127.0.0.1 dst=127.0.0.1 sport=37715 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=37715 packets=0 bytes=0 mark=0 use=1 unknown 50 src=60.0.0.20 dst=60.0.0.10 packets=4 bytes=464 src=60.0.0.10 dst=60.0.0.20 packets=4 bytes=484 [OFFLOAD, packets=2 bytes=208 packets=2 bytes=208] mark=0 use=2 gre 47 179 src=60.0.0.20 dst=60.0.0.10 srckey=0x0 dstkey=0x0 packets=4 bytes=326 src=60.0.0.10 dst=60.0.0.20 srckey=0x0 dstkey=0x0 packets=4 bytes=346 [ASSURED] mark=0 use=1 udp 17 17 src=127.0.0.1 dst=127.0.0.1 sport=40272 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=40272 packets=0 bytes=0 mark=0 use=1 udp 17 21 src=60.0.0.20 dst=60.0.0.10 sport=500 dport=500 packets=2 bytes=545 src=60.0.0.10 dst=60.0.0.20 sport=500 dport=500 packets=2 bytes=521 mark=0 use=1 udp 17 28 src=127.0.0.1 dst=127.0.0.1 sport=45850 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=45850 packets=0 bytes=0 mark=0 use=1 udp 17 179 src=10.0.0.1 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=10.0.0.1 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] mark=0 use=1 conntrack v1.4.5 (conntrack-tools): 8 flow entries have been shown.
Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
in.*\s+[^0]\d+ packets out.*\s+[^0]\d+ packetsShow output
vpnprof-dmvpn-NHRP: #1, ESTABLISHED, IKEv2, ec40f9a0851b0107_i 43ce8960526f3b97_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 9s ago, rekeying in 25599s NHRP: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256 installed 9s ago, rekeying in 3427s, expires in 3951s in cd03ac59, 246 bytes, 4 packets, 1s ago out ca11e547, 266 bytes, 4 packets, 1s ago local 60.0.0.10/32[gre] remote 60.0.0.20/32[gre]
Step 9: Set the following configuration in DUT2:
set interfaces ethernet eth0 address 192.168.10.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.10.1
Step 10: Ping IP address 192.168.20.1 from DUT2:
admin@DUT2$ ping 192.168.20.1 count 1 size 56 timeout 1Show output
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data. 64 bytes from 192.168.20.1: icmp_seq=1 ttl=63 time=0.875 ms --- 192.168.20.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.875/0.875/0.875/0.000 ms
Step 11: Run command system conntrack clear at DUT0 and expect this output:
Show output
Connection tracking table has been emptied
Step 12: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 13: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 14: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*] udp\s+17.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
udp 17 23 src=127.0.0.1 dst=127.0.0.1 sport=36850 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=36850 packets=0 bytes=0 mark=0 use=1 unknown 50 src=60.0.0.10 dst=60.0.0.20 packets=3 bytes=312 src=60.0.0.20 dst=60.0.0.10 packets=3 bytes=312 [OFFLOAD, packets=1 bytes=104 packets=1 bytes=104] mark=0 use=2 udp 17 23 src=127.0.0.1 dst=127.0.0.1 sport=48897 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=48897 packets=0 bytes=0 mark=0 use=1 gre 47 179 src=60.0.0.10 dst=60.0.0.20 srckey=0x0 dstkey=0x0 packets=3 bytes=210 src=60.0.0.20 dst=60.0.0.10 srckey=0x0 dstkey=0x0 packets=3 bytes=210 [ASSURED] mark=0 use=1 udp 17 src=192.168.10.2 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=192.168.10.2 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] [OFFLOAD, packets=1 bytes=46 packets=2 bytes=92] mark=0 use=2 conntrack v1.4.5 (conntrack-tools): 5 flow entries have been shown.
Test XFRM Offload With Site To Site
Description
In this scenario, the tunnel is established by using a site-to-site peer.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 60.0.0.10/24 set interfaces ethernet eth1 address 192.168.10.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER local-address 60.0.0.10 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.20 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.10.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.20.0/24 set protocols static route 0.0.0.0/0 next-hop 60.0.0.20
Step 2: Set the following configuration in DUT1:
set interfaces ethernet eth0 address 60.0.0.20/24 set interfaces ethernet eth1 address 192.168.20.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER local-address 60.0.0.20 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.10 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.20.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.10.0/24 set protocols static route 0.0.0.0/0 next-hop 60.0.0.10
Step 3: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:
INSTALLEDShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, cdea2cd0be073dc3_i 1a956e9aca30394b_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 24150s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3323s, expires in 3960s in cbfb6a3e, 0 bytes, 0 packets out ccd8c231, 0 bytes, 0 packets local 192.168.10.0/24 remote 192.168.20.0/24
Step 4: Set the following configuration in DUT2:
set interfaces ethernet eth0 address 192.168.10.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.10.1
Step 5: Ping IP address 192.168.20.1 from DUT2:
admin@DUT2$ ping 192.168.20.1 count 1 size 56 timeout 1Show output
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data. 64 bytes from 192.168.20.1: icmp_seq=1 ttl=63 time=1.04 ms --- 192.168.20.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.039/1.039/1.039/0.000 ms
Step 6: Run command system conntrack clear at DUT0 and expect this output:
Show output
Connection tracking table has been emptied
Step 7: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 8: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 9: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 10: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*] udp\s+17.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
unknown 50 src=60.0.0.10 dst=60.0.0.20 packets=3 bytes=300 src=60.0.0.20 dst=60.0.0.10 packets=3 bytes=300 [OFFLOAD, packets=1 bytes=100 packets=1 bytes=100] mark=0 use=2 udp 17 26 src=127.0.0.1 dst=127.0.0.1 sport=58084 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=58084 packets=0 bytes=0 mark=0 use=1 udp 17 src=192.168.10.2 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=192.168.10.2 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] [OFFLOAD, packets=1 bytes=46 packets=1 bytes=46] mark=0 use=2 udp 17 26 src=127.0.0.1 dst=127.0.0.1 sport=52778 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=52778 packets=0 bytes=0 mark=0 use=1 conntrack v1.4.5 (conntrack-tools): 4 flow entries have been shown.
Test XFRM Offload With Bridge and Site To Site
Description
In this scenario, the tunnel is established by using a site-to-site peer, and the LAN interface is included in a bridge.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 60.0.0.10/24 set interfaces ethernet eth1 address 192.168.10.1/24 set system offload timeout 30 del interfaces ethernet eth1 set interfaces bridge br0 address 192.168.10.1/24 set interfaces ethernet eth1 bridge-group bridge br0 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER local-address 60.0.0.10 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.20 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.10.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.20.0/24 set protocols static route 0.0.0.0/0 next-hop 60.0.0.20
Step 2: Set the following configuration in DUT1:
set interfaces ethernet eth0 address 60.0.0.20/24 set interfaces ethernet eth1 address 192.168.20.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER local-address 60.0.0.20 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.10 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.20.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.10.0/24 set protocols static route 0.0.0.0/0 next-hop 60.0.0.10
Step 3: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:
INSTALLEDShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 8a18d6c0b9fa9372_i fbe1d6d91c0e041c_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 15082s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3411s, expires in 3960s in c2037dde, 0 bytes, 0 packets out c545d93a, 0 bytes, 0 packets local 192.168.10.0/24 remote 192.168.20.0/24
Step 4: Set the following configuration in DUT2:
set interfaces ethernet eth0 address 192.168.10.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.10.1
Step 5: Ping IP address 192.168.20.1 from DUT2:
admin@DUT2$ ping 192.168.20.1 count 1 size 56 timeout 1Show output
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data. 64 bytes from 192.168.20.1: icmp_seq=1 ttl=63 time=1.08 ms --- 192.168.20.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.083/1.083/1.083/0.000 ms
Step 6: Run command system conntrack clear at DUT0 and expect this output:
Show output
Connection tracking table has been emptied
Step 7: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 8: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 9: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 10: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*] udp\s+17.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
udp 17 29 src=127.0.0.1 dst=127.0.0.1 sport=35562 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=35562 packets=0 bytes=0 mark=0 use=1 udp 17 26 src=127.0.0.1 dst=127.0.0.1 sport=53243 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=53243 packets=0 bytes=0 mark=0 use=1 udp 17 26 src=127.0.0.1 dst=127.0.0.1 sport=56764 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=56764 packets=0 bytes=0 mark=0 use=1 unknown 50 src=60.0.0.10 dst=60.0.0.20 packets=3 bytes=300 src=60.0.0.20 dst=60.0.0.10 packets=3 bytes=300 [OFFLOAD, packets=1 bytes=100 packets=1 bytes=100] mark=0 use=2 udp 17 29 src=127.0.0.1 dst=127.0.0.1 sport=51210 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=51210 packets=0 bytes=0 mark=0 use=1 udp 17 src=192.168.10.2 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=192.168.10.2 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] [OFFLOAD, packets=1 bytes=46 packets=1 bytes=46] mark=0 use=2 conntrack v1.4.5 (conntrack-tools): 6 flow entries have been shown.
Test XFRM Offload With Bridge VLAN and Site To Site
Description
In this scenario, the tunnel is established by using a site-to-site peer, and the LAN interface is included in a bridge with a VLAN.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 60.0.0.10/24 set interfaces ethernet eth1 address 192.168.10.1/24 set system offload timeout 30 del interfaces ethernet eth1 set interfaces bridge br0 vif 100 address 192.168.10.1/24 set interfaces bridge br0 vlan 100 pvid set interfaces ethernet eth1 bridge-group bridge br0 set interfaces ethernet eth1 bridge-group vlan 100 pvid set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER local-address 60.0.0.10 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.20 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.10.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.20.0/24 set protocols static route 0.0.0.0/0 next-hop 60.0.0.20
Step 2: Set the following configuration in DUT1:
set interfaces ethernet eth0 address 60.0.0.20/24 set interfaces ethernet eth1 address 192.168.20.1/24 set system offload timeout 30 set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER local-address 60.0.0.20 set vpn ipsec site-to-site peer PEER remote-address 60.0.0.10 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.20.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.10.0/24 set protocols static route 0.0.0.0/0 next-hop 60.0.0.10
Step 3: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:
INSTALLEDShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 554771f8d62213a9_i b0ada0a8d1b42b45_r* local '60.0.0.10' @ 60.0.0.10[500] remote '60.0.0.20' @ 60.0.0.20[500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 18803s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3299s, expires in 3959s in ca9531f1, 0 bytes, 0 packets out cfbd5c88, 0 bytes, 0 packets local 192.168.10.0/24 remote 192.168.20.0/24
Step 4: Set the following configuration in DUT2:
set interfaces ethernet eth0 vif 100 address 192.168.10.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.10.1
Step 5: Ping IP address 192.168.20.1 from DUT2:
admin@DUT2$ ping 192.168.20.1 count 1 size 56 timeout 1Show output
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data. 64 bytes from 192.168.20.1: icmp_seq=1 ttl=63 time=0.906 ms --- 192.168.20.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.906/0.906/0.906/0.000 ms
Step 6: Run command system conntrack clear at DUT0 and expect this output:
Show output
Connection tracking table has been emptied
Step 7: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 8: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 9: Initiate a udp connection from DUT2 to DUT1 and try to send some messages between both endpoints
admin@DUT1$ monitor test connection server 5050 udp local-address 192.168.20.1 admin@DUT2$ monitor test connection client 192.168.20.1 5050 udp source-port 6060
Step 10: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
unknown\s+50.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*] udp\s+17.*[OFFLOAD, packets=[^0]\d* bytes=[^0]\d* packets=[^0]\d* bytes=[^0]\d*]Show output
unknown 50 src=60.0.0.10 dst=60.0.0.20 packets=3 bytes=300 src=60.0.0.20 dst=60.0.0.10 packets=3 bytes=300 [OFFLOAD, packets=1 bytes=100 packets=1 bytes=100] mark=0 use=2 udp 17 29 src=127.0.0.1 dst=127.0.0.1 sport=38111 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=38111 packets=0 bytes=0 mark=0 use=1 udp 17 29 src=127.0.0.1 dst=127.0.0.1 sport=38870 dport=53 packets=1 bytes=62 [UNREPLIED] src=127.0.0.1 dst=127.0.0.1 sport=53 dport=38870 packets=0 bytes=0 mark=0 use=1 udp 17 src=192.168.10.2 dst=192.168.20.1 sport=6060 dport=5050 packets=3 bytes=138 src=192.168.20.1 dst=192.168.10.2 sport=5050 dport=6060 packets=3 bytes=138 [ASSURED] [OFFLOAD, packets=1 bytes=46 packets=1 bytes=46] mark=0 use=2 conntrack v1.4.5 (conntrack-tools): 4 flow entries have been shown.