Roadwarrior

This scenario shows different ways to setup a roadwarrior VPN connection; in which, instead of using a N2N (network to network) connection, a single machine (e.g., a host) is able to connect to a remote private network.

On the one hand, DUT2 and DUT0 represent a remote branch office. On the other hand, DUT1 is a roadwarrior that can establish a connection to DUT2 using different virtual IPs.

Note that security associations (SAs) have to be manually flushed with the command clear vpn ipsec sa. Depending on the configuration parameter connection-type, the new tunnel connections will be created or not. In this case, on-demand was configured in the roadwarrior to establish the VPN connection as soon as the first plain IP payload attempts to traverse the tunnel.

../../../../_images/roadwarrior.svg

Test VPN Roadwarrior Connection With VTI

Description

In this scenario, DUT0 uses a VTI interface to encapsulate the VPN traffic.

Scenario

Step 1: Set the following configuration in DUT2:

set interfaces eth0 address 10.1.0.2/24
set protocols static route 0.0.0.0/0 next-hop 10.1.0.1

Step 2: Set the following configuration in DUT1:

set interfaces eth0 address 80.0.0.2/24
set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set interfaces dum0 address 10.3.0.1/24
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER vti remote-prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER connection-type on-demand
set interfaces vti0 ipsec PEER
set protocols static route 0.0.0.0/0 interface vti0
set vpn ipsec esp-group CHILD-SA mode tunnel

Step 3: Set the following configuration in DUT0:

set interfaces eth0 address 80.0.0.1/24
set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set interfaces eth1 address 10.1.0.1/24
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2
set vpn ipsec site-to-site peer PEER vti local-prefix 10.1.0.0/24
set interfaces vti vti0 ipsec PEER
set interfaces vti vti0 local-address 80.0.0.1
set interfaces vti vti0 remote-address 0.0.0.0
set protocols static route 10.3.0.0/24 interface vti0
set vpn ipsec esp-group CHILD-SA mode tunnel

Step 4: Ping IP address 80.0.0.1 from DUT1:

admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.723 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.723/0.723/0.723/0.000 ms

Step 5: Ping IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.373 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.373/0.373/0.373/0.000 ms

Step 6: Ping IP address 10.1.0.2 from DUT0:

admin@DUT0$ ping 10.1.0.2 count 1 size 56 timeout 1
Show output
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data.
64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.484 ms

--- 10.1.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.484/0.484/0.484/0.000 ms

Step 7: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.436 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.436/0.436/0.436/0.000 ms

Step 8: Ping IP address 10.1.0.2 from DUT1:

admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.774 ms

--- 10.1.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.774/0.774/0.774/0.000 ms

Step 9: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, e61953bca29eab7c_i 7b58869d9ec48f18_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 1s ago, rekeying in 21210s
  peer-PEER-tunnel-VTI: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3267s, expires in 3959s
    in  c83b67c3 (0x90000000),    168 bytes,     2 packets,     0s ago
    out c124091a (0x90000000),    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 0.0.0.0/0

Step 10: Run command vpn ipsec clear sa at DUT1 and expect this output:

Show output
Deleting IPSec SAs... 100%
Closed tunnels: 1

Step 11: Set the following configuration in DUT1:

del interfaces dum0
set interfaces dum0 address 10.3.0.2/24

Step 12: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.2 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.2 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.420 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.420/0.420/0.420/0.000 ms

Step 13: Ping IP address 10.1.0.2 from DUT1:

admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.2 count 1 size 56 timeout 1
Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.2 : 56(84) bytes of data.
64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.735 ms

--- 10.1.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.735/0.735/0.735/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, c4739b3516c84d49_i b1e32177a71f9a2c_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 1s ago, rekeying in 16803s
  peer-PEER-tunnel-VTI: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3311s, expires in 3959s
    in  c3ba111d (0x90000000),    168 bytes,     2 packets,     1s ago
    out cb4bc6c2 (0x90000000),    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 0.0.0.0/0

Attention

The command vpn show ipsec policy can be used to debug the IPSec selectors that have been installed in OSDx devices. Example for device DUT0:

Show output
src 10.1.0.0/24 dst 0.0.0.0/0 dev vti0
        dir out priority 387709
        mark 0x90000000/0xffffffff
        tmpl src 80.0.0.1 dst 80.0.0.2
                proto esp spi 0xcb4bc6c2 reqid 2 mode tunnel
src 0.0.0.0/0 dst 10.1.0.0/24
        dir fwd priority 387711
        mark 0x90000000/0xffffffff
        tmpl src 80.0.0.2 dst 80.0.0.1
                proto esp reqid 2 mode tunnel
src 0.0.0.0/0 dst 10.1.0.0/24
        dir in priority 387711
        mark 0x90000000/0xffffffff
        tmpl src 80.0.0.2 dst 80.0.0.1
                proto esp reqid 2 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0

Test VPN Roadwarrior Connection With Global Policies

Description

In this scenario, DUT0 uses global VPN policies (or selectors) to encapsulate traffic.

Scenario

Step 1: Set the following configuration in DUT2:

set interfaces eth0 address 10.1.0.2/24
set protocols static route 0.0.0.0/0 next-hop 10.1.0.1

Step 2: Set the following configuration in DUT1:

set interfaces eth0 address 80.0.0.2/24
set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set interfaces dum0 address 10.3.0.1/24
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER vti remote-prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER connection-type on-demand
set interfaces vti0 ipsec PEER
set protocols static route 0.0.0.0/0 interface vti0
set vpn ipsec esp-group CHILD-SA mode tunnel

Step 3: Set the following configuration in DUT0:

set interfaces eth0 address 80.0.0.1/24
set vpn ipsec auth-profile AUTH-SA local auth pre-shared-secret test
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set interfaces eth1 address 10.1.0.1/24
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.3.0.0/24
set protocols static route 10.3.0.0/24 interface eth0
set vpn ipsec esp-group CHILD-SA mode tunnel

Step 4: Ping IP address 80.0.0.1 from DUT1:

admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.627 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.627/0.627/0.627/0.000 ms

Step 5: Ping IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.317 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.317/0.317/0.317/0.000 ms

Step 6: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.424 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.424/0.424/0.424/0.000 ms

Step 7: Ping IP address 10.1.0.2 from DUT1:

admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=1.12 ms

--- 10.1.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.124/1.124/1.124/0.000 ms

Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 6c29dc2db20da4cf_i 5695fba7fb443e72_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 1s ago, rekeying in 15381s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3376s, expires in 3959s
    in  c15718f7,    168 bytes,     2 packets,     1s ago
    out c91fb3ae,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Step 9: Run command vpn ipsec clear sa at DUT1 and expect this output:

Show output
Deleting IPSec SAs... 100%
Closed tunnels: 1

Step 10: Set the following configuration in DUT1:

del interfaces dum0
set interfaces dum0 address 10.3.0.2/24

Step 11: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.2 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.2 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.421 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.421/0.421/0.421/0.000 ms

Step 12: Ping IP address 10.1.0.2 from DUT1:

admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.2 count 1 size 56 timeout 1
Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.2 : 56(84) bytes of data.
64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.614 ms

--- 10.1.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.614/0.614/0.614/0.000 ms

Step 13: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, d8b1f5ca9163982e_i b0f1a0f3b466583e_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 1s ago, rekeying in 14834s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3415s, expires in 3959s
    in  c1cdf160,    168 bytes,     2 packets,     1s ago
    out cff663a0,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Attention

The command vpn show ipsec policy can be used to debug the IPSec selectors that have been installed in OSDx devices. Example for device DUT0:

Show output
src 10.1.0.0/24 dst 10.3.0.0/24 dev eth0
        dir out priority 375423
        tmpl src 80.0.0.1 dst 80.0.0.2
                proto esp spi 0xcff663a0 reqid 2 mode tunnel
src 10.3.0.0/24 dst 10.1.0.0/24
        dir fwd priority 375423
        tmpl src 80.0.0.2 dst 80.0.0.1
                proto esp reqid 2 mode tunnel
src 10.3.0.0/24 dst 10.1.0.0/24
        dir in priority 375423
        tmpl src 80.0.0.2 dst 80.0.0.1
                proto esp reqid 2 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0