P2P
These scenarios show how to configure an OpenVPN tunnel using a P2P topology
Basic Tunnel
Description
A simple P2P tunnel is created between two devices
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.191 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.191/0.191/0.191/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.613 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.613/0.613/0.613/0.000 ms
TCP Protocol
Description
A simple P2P tunnel through TCP is created between two devices
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 protocol tcp-client set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 protocol tcp-server set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.240 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.240/0.240/0.240/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.453 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.453/0.453/0.453/0.000 ms
VRF
Description
A simple P2P tunnel using a custom VRF is created between two devices
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set interfaces openvpn ovpn1 vrf VRF1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf VRF1
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set interfaces openvpn ovpn1 vrf VRF1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf VRF1
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=377 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 377.263/377.263/377.263/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 vrf VRF1 count 1 size 56 timeout 1Show output
ping: Warning: source address might be selected on device other than: VRF1 PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 VRF1: 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=1.03 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.025/1.025/1.025/0.000 ms
Step 6: Expect a failure in the following command:
Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 7: Expect a failure in the following command:
Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 8: Expect a failure in the following command:
Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 9: Expect a failure in the following command:
Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 10: Expect a failure in the following command:
Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 11: Expect a failure in the following command:
Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 12: Expect a failure in the following command:
Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Lzo Compression
Description
A simple P2P tunnel with lzo compression is created between two devices
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p tunnel-profile TNL set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn tunnel-profile TNL compression lzo
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p tunnel-profile TNL set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn tunnel-profile TNL compression lzo
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=454 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 453.680/453.680/453.680/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.598 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.598/0.598/0.598/0.000 ms
Secret
Description
A simple encrypted tunnel using a shared static key is created between two devices
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=361 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 361.349/361.349/361.349/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.494 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.494/0.494/0.494/0.000 ms
Secret With Direction
Description
A simple encrypted tunnel using a shared static key is created between two devices using key directions
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret direction 0 set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret direction 1 set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=311 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 310.502/310.502/310.502/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.515 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.515/0.515/0.515/0.000 ms
Cipher
Description
A simple encrypted tunnel using a shared static key is created between two devices using a custom cipher
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC cipher 1 algorithm CAMELLIA-128-CBC set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC cipher 1 algorithm CAMELLIA-128-CBC set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=305 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 305.304/305.304/305.304/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.696 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.696/0.696/0.696/0.000 ms
Auth
Description
A simple encrypted tunnel using a shared static key is created between two devices using a custom digest algorithm
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC auth 1 algorithm SHA256
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC auth 1 algorithm SHA256
Step 3: Ping the IP address 192.168.100.2 from DUT0:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=416 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 415.619/415.619/415.619/0.000 ms
Step 4: Run the command interfaces openvpn ovpn1 status on DUT0 and check whether the output contains the following tokens:
CONNECTEDShow output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping the IP address 10.0.0.2 from DUT0:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.718 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.718/0.718/0.718/0.000 ms