Local-Vrf

This scenario shows how to configure a VPN initiator with multiple VRFs and Policy-Based Routing (PBR).

Test Site-To-Site With VRFs And Marks

Description

Three different VRFs are configured in the VPN initiator: WAN, AP and SEG. Local traffic is generated in the VRF SEG, marked and leaked to the application VRF, where traffic is routed WAN VRF. Incoming packets are also leaked to SEG VRF if connmark matches.

Scenario

Step 1: Set the following configuration in DUT1:

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX18tWjLe4QRM5Izscfu3hHtuovKjhNBxZOY=
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 2: Set the following configuration in DUT0:

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces dummy dum0 traffic policy local-out PBR_SEG_AP
set interfaces dummy dum0 vrf SEG
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces ethernet eth0 traffic policy in PBR_WAN_SEG
set interfaces ethernet eth0 vrf WAN
set protocols vrf AP static route 0.0.0.0/0 next-hop-vrf WAN
set protocols vrf SEG static route 0.0.0.0/0 interface dum0
set protocols vrf WAN static route 0.0.0.0/0 next-hop 80.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf AP
set system vrf SEG
set system vrf WAN
set traffic policy PBR_SEG_AP rule 1 set vrf AP connmark-cache
set traffic policy PBR_WAN_SEG rule 1 selector AP_SEL
set traffic policy PBR_WAN_SEG rule 1 set vrf SEG
set traffic selector AP_SEL rule 1 vrf-connmark AP
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX182Eyg4G0NUJeuBC4tWajh/ggqtIosV5pQ=
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec esp-group CHILD-SA vrf-mark-in SEG
set vpn ipsec esp-group CHILD-SA vrf-mark-out AP
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER local-vrf WAN
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 0.0.0.0/0

Step 3: Ping IP address 80.0.0.1 from DUT1:

admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1

Step 4: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

peer-PEER-tunnel-\d+.+INSTALLED

Step 5: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 vrf SEG count 1 size 56 timeout 1

Step 6: Run command vpn ipsec show sa remote 80.0.0.2 at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets

Attention

The command vpn show ipsec policy can be used to debug the IPSec selectors that have been installed in OSDx devices. Example for device DUT0: