Site-To-Site

This scenario shows how to configure and connect two subnets with each other through a VPN tunnel and automatically configure the negotiated remote prefixes as routes. DUT0 acts as a responder and DUT1 as a initiator.

../../../../../../../_images/sitetosite3.svg

Test Site-To-Site With Basic Route Installation

Description

In this scenario, both devices install routes for the VPN traffic in the main table.

Scenario

Step 1: Run the command protocols ip show route on DUT0 and check whether the output does not contain the following tokens:

K>* 10.3.0.0/24

Step 2: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf main
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1/9XEjGIml9YdAvnj7KRZMM7OnglQqOkco=
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2
set vpn ipsec site-to-site peer PEER tunnel 1 install-routes main
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.3.0.0/24

Step 3: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf main
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX18PIH+ibAoqxaIOLDJVjm9NeYGIdc5d5IM=
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 install-routes main
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 4: Ping the IP address 80.0.0.1 from DUT1:

admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.510 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.510/0.510/0.510/0.000 ms

Step 5: Ping the IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.300 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.300/0.300/0.300/0.000 ms

Step 6: Run the command vpn ipsec show sa on DUT0 and check whether the output matches the following regular expressions:

peer-PEER-tunnel-\d+.+INSTALLED
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, df79de0fedc97be7_i 849a7aa24cd260a3_r*
local  '80.0.0.1' @ 80.0.0.1[500]
remote '80.0.0.2' @ 80.0.0.2[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 1s ago, rekeying in 25915s
peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 1s ago, rekeying in 3243s, expires in 3959s
in  c88a8e9a,      0 bytes,     0 packets
out cf8554cb,      0 bytes,     0 packets
local  10.1.0.0/24
remote 10.3.0.0/24

Step 7: Run the command protocols ip show route on DUT0 and check whether the output contains the following tokens:

K>* 10.3.0.0/24
Show output
Codes: K - kernel route, C - connected, L - local, S - static,
R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric, t - Table-Direct,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

IPv4 unicast VRF default:
C>* 10.1.0.0/24 is directly connected, dum0, weight 1, 00:00:06
L>* 10.1.0.1/32 is directly connected, dum0, weight 1, 00:00:06
K>* 10.3.0.0/24 [0/0] via 80.0.0.2, eth0, weight 1, 00:00:01
C>* 80.0.0.0/24 is directly connected, eth0, weight 1, 00:00:05
L>* 80.0.0.1/32 is directly connected, eth0, weight 1, 00:00:05

Step 8: Run the command vpn ipsec clear sa on DUT1 and expect the following output:

Show output
Deleting IPSec SAs... 100.00%
Closed tunnels: 1

Step 9: Run the command vpn ipsec initiate peer PEER on DUT1 and expect the following output:

Show output
Initiating IPSec SAs... 100.00%
Initiated tunnels: 1

Step 10: Ping the IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.435 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.435/0.435/0.435/0.000 ms

Step 11: Initiate a tcp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 8080 tcp
admin@DUT1$ monitor test connection client 10.1.0.1 8080 tcp local-address 10.3.0.1

Step 12: Run the command vpn ipsec show sa on DUT0 and check whether the output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 91c2898b0af82b8a_i ce526425dfb21150_r*
local  '80.0.0.1' @ 80.0.0.1[500]
remote '80.0.0.2' @ 80.0.0.2[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 3s ago, rekeying in 15668s
peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 3s ago, rekeying in 3307s, expires in 3957s
in  c2e6fc6f,    712 bytes,    11 packets,     0s ago
out c9d7b5d9,    660 bytes,    10 packets,     0s ago
local  10.1.0.0/24
remote 10.3.0.0/24

Test Site-To-Site With VRF Route Installation

Description

In this scenario, DUT0 install reoutes in a separate VRF called LAN.

Scenario

Step 1: Run the command protocols vrf LAN ip show route on DUT0 and check whether the output does not contain the following tokens:

K>* 10.3.0.0/24
Show output
% VRF LAN not found

Step 2: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces dummy dum0 vrf LAN
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces ethernet eth0 vrf WAN
set protocols vrf WAN static route 10.1.0.0/24 next-hop-vrf LAN
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf LAN
set system vrf WAN
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX19AtDt/g1L9IbZkPBtyVIqRB1u99Hiot/w=
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2
set vpn ipsec site-to-site peer PEER tunnel 1 install-routes LAN
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.3.0.0/24

Step 3: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf main
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1+WdfFIaP+V0CvblB6F19wu8cUD0WUTDg4=
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 install-routes main
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 4: Ping the IP address 80.0.0.1 from DUT1:

admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.604 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.604/0.604/0.604/0.000 ms

Step 5: Ping the IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 vrf WAN count 1 size 56 timeout 1
Show output
ping: Warning: source address might be selected on device other than: WAN
PING 80.0.0.2 (80.0.0.2) from 80.0.0.1 WAN: 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=1.37 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.370/1.370/1.370/0.000 ms

Step 6: Run the command vpn ipsec show sa on DUT0 and check whether the output matches the following regular expressions:

peer-PEER-tunnel-\d+.+INSTALLED
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, a41fb0f43aac8cc5_i 6dbad2a8f009f82d_r*
local  '80.0.0.1' @ 80.0.0.1[500]
remote '80.0.0.2' @ 80.0.0.2[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 1s ago, rekeying in 19960s
peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 1s ago, rekeying in 3380s, expires in 3959s
in  cc248487,      0 bytes,     0 packets
out c638cb28,      0 bytes,     0 packets
local  10.1.0.0/24
remote 10.3.0.0/24

Step 7: Run the command protocols vrf LAN ip show route on DUT0 and check whether the output contains the following tokens:

K>* 10.3.0.0/24
Show output
Codes: K - kernel route, C - connected, L - local, S - static,
R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric, t - Table-Direct,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

IPv4 unicast VRF LAN:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), weight 1, 00:00:07
C>* 10.1.0.0/24 is directly connected, dum0, weight 1, 00:00:07
L>* 10.1.0.1/32 is directly connected, dum0, weight 1, 00:00:07
K>* 10.3.0.0/24 [0/0] via 80.0.0.2, eth0 (vrf WAN), weight 1, 00:00:01
K>* 127.0.0.0/8 [0/0] is directly connected, LAN, weight 1, 00:00:07

Step 8: Run the command vpn ipsec clear sa on DUT1 and expect the following output:

Show output
Deleting IPSec SAs... 100.00%
Closed tunnels: 1

Step 9: Run the command vpn ipsec initiate peer PEER on DUT1 and expect the following output:

Show output
Initiating IPSec SAs... 100.00%
Initiated tunnels: 1

Step 10: Ping the IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.745 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.745/0.745/0.745/0.000 ms

Step 11: Initiate a tcp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 8080 tcp vrf LAN
admin@DUT1$ monitor test connection client 10.1.0.1 8080 tcp local-address 10.3.0.1

Step 12: Run the command vpn ipsec show sa on DUT0 and check whether the output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 62ef08a117dcc3a7_i b34dd2bb6216e44f_r*
local  '80.0.0.1' @ 80.0.0.1[500]
remote '80.0.0.2' @ 80.0.0.2[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 3s ago, rekeying in 21418s
peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 3s ago, rekeying in 3396s, expires in 3957s
in  cf463af4,    920 bytes,    15 packets,     0s ago
out cc77a678,    868 bytes,    14 packets,     0s ago
local  10.1.0.0/24
remote 10.3.0.0/24

Test Site-To-Site With Route Installation And Metrics

Description

In this scenario, DUT0 installs routes with differents metrics for both IPsec peers. The point is to check if the routes are installed correctly and most importantly, whenever the prioritized route is down, the backup route is used.

Scenario

Step 1: Run the command protocols ip show route on DUT0 and check whether the output does not contain the following tokens:

K>* 10.3.0.0/24

Step 2: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces ethernet eth1 address 90.0.0.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf main
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1+AcCdpqeHfD3LPGQ4J7LEAk+2rFeMCuAA=
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 2
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.2
set vpn ipsec site-to-site peer PEER tunnel 1 install-routes main
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 route-priority 10
set vpn ipsec site-to-site peer PEER1 auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER1 connection-type respond
set vpn ipsec site-to-site peer PEER1 default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER1 ike-group IKE-SA
set vpn ipsec site-to-site peer PEER1 local-address 90.0.0.1
set vpn ipsec site-to-site peer PEER1 remote-address 90.0.0.3
set vpn ipsec site-to-site peer PEER1 tunnel 1 install-routes main
set vpn ipsec site-to-site peer PEER1 tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER1 tunnel 1 remote prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER1 tunnel 1 route-priority 100

Step 3: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system vrf main
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX19JqTL9CZuN2NHtffwCMC02mpc4EaYeGVI=
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 install-routes main
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 4: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth1 address 90.0.0.3/24
set protocols static route 0.0.0.0/0 next-hop 90.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1/3vuaaTcy7QJpqRgWHiTBuZwb1hfFSibg=
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 90.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 90.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 5: Ping the IP address 80.0.0.1 from DUT1:

admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.438 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.438/0.438/0.438/0.000 ms

Step 6: Ping the IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.463 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.463/0.463/0.463/0.000 ms

Step 7: Ping the IP address 90.0.0.3 from DUT2:

admin@DUT2$ ping 90.0.0.3 count 1 size 56 timeout 1
Show output
PING 90.0.0.3 (90.0.0.3) 56(84) bytes of data.
64 bytes from 90.0.0.3: icmp_seq=1 ttl=64 time=0.039 ms

--- 90.0.0.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.039/0.039/0.039/0.000 ms

Step 8: Run the command vpn ipsec show sa on DUT0 and check whether the output matches the following regular expressions:

peer-PEER-tunnel-\d+.+INSTALLED
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, f6866c35a8341f9b_i 51e6b53ccbf3cd8d_r*
local  '80.0.0.1' @ 80.0.0.1[500]
remote '80.0.0.2' @ 80.0.0.2[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 6s ago, rekeying in 24175s
peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 6s ago, rekeying in 3534s, expires in 3954s
in  c399ea95,      0 bytes,     0 packets
out c6d19e4e,      0 bytes,     0 packets
local  10.1.0.0/24
remote 10.3.0.0/24
vpn-peer-PEER1: #2, ESTABLISHED, IKEv2, bbad8c421072f068_i 0c03258b4241828d_r*
local  '90.0.0.1' @ 90.0.0.1[500]
remote '90.0.0.3' @ 90.0.0.3[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 1s ago, rekeying in 24636s
peer-PEER1-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 1s ago, rekeying in 3426s, expires in 3959s
in  cc116acb,      0 bytes,     0 packets
out ca94f056,      0 bytes,     0 packets
local  10.1.0.0/24
remote 10.3.0.0/24

Step 9: Run the command protocols ip show route on DUT0 and check whether the output contains the following tokens:

K>* 10.3.0.0/24
Show output
Codes: K - kernel route, C - connected, L - local, S - static,
R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric, t - Table-Direct,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

IPv4 unicast VRF default:
C>* 10.1.0.0/24 is directly connected, dum0, weight 1, 00:00:11
L>* 10.1.0.1/32 is directly connected, dum0, weight 1, 00:00:11
K * 10.3.0.0/24 [0/100] via 90.0.0.3, eth1, weight 1, 00:00:01
K>* 10.3.0.0/24 [0/10] via 80.0.0.2, eth0, weight 1, 00:00:06
C>* 80.0.0.0/24 is directly connected, eth0, weight 1, 00:00:11
L>* 80.0.0.1/32 is directly connected, eth0, weight 1, 00:00:11
C>* 90.0.0.0/24 is directly connected, eth1, weight 1, 00:00:11
L>* 90.0.0.1/32 is directly connected, eth1, weight 1, 00:00:11

Step 10: Run the command show system route ip on DUT0 and check whether the output contains the following tokens:

10.3.0.0/24 via 90.0.0.3 dev eth1 proto static metric 100
10.3.0.0/24 via 80.0.0.2 dev eth0 proto static metric 10
Show output
10.1.0.0/24 dev dum0 proto kernel scope link src 10.1.0.1
10.3.0.0/24 via 80.0.0.2 dev eth0 proto static metric 10
10.3.0.0/24 via 90.0.0.3 dev eth1 proto static metric 100
80.0.0.0/24 dev eth0 proto kernel scope link src 80.0.0.1
90.0.0.0/24 dev eth1 proto kernel scope link src 90.0.0.1

Note

The tunnel with the lowest metric configured in the route-priority parameter should be the one used to route the traffic.

Step 11: Run the command vpn ipsec clear sa on DUT1 and expect the following output:

Show output
Deleting IPSec SAs... 100.00%
Closed tunnels: 1

Step 12: Run the command vpn ipsec initiate peer PEER on DUT1 and expect the following output:

Show output
Initiating IPSec SAs... 100.00%
Initiated tunnels: 1

Step 13: Ping the IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.665 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.665/0.665/0.665/0.000 ms

Step 14: Initiate a tcp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 8080 tcp
admin@DUT1$ monitor test connection client 10.1.0.1 8080 tcp local-address 10.3.0.1

Step 15: Run the command vpn ipsec show sa on DUT0 and check whether the output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER1: #2, ESTABLISHED, IKEv2, bbad8c421072f068_i 0c03258b4241828d_r*
local  '90.0.0.1' @ 90.0.0.1[500]
remote '90.0.0.3' @ 90.0.0.3[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 5s ago, rekeying in 24632s
peer-PEER1-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 5s ago, rekeying in 3422s, expires in 3955s
in  cc116acb,      0 bytes,     0 packets
out ca94f056,      0 bytes,     0 packets
local  10.1.0.0/24
remote 10.3.0.0/24
vpn-peer-PEER: #3, ESTABLISHED, IKEv2, 2dca869ed3ad36ec_i dc333686e87d3ca9_r*
local  '80.0.0.1' @ 80.0.0.1[500]
remote '80.0.0.2' @ 80.0.0.2[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 3s ago, rekeying in 19636s
peer-PEER-tunnel-1: #3, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 3s ago, rekeying in 3357s, expires in 3957s
in  c5483175,    868 bytes,    14 packets,     0s ago
out cf83d58f,    868 bytes,    14 packets,     0s ago
local  10.1.0.0/24
remote 10.3.0.0/24

Note

Now we will shutdown the tunnel with the lowest metric from DUT1 and check if the traffic is routed through the backup tunnel.

Step 16: Run the command vpn ipsec clear sa on DUT1 and expect the following output:

Show output
Deleting IPSec SAs... 100.00%
Closed tunnels: 1

Step 17: Run the command vpn ipsec clear sa on DUT2 and expect the following output:

Show output
Deleting IPSec SAs... 100.00%
Closed tunnels: 1

Step 18: Run the command vpn ipsec initiate peer PEER on DUT2 and expect the following output:

Show output
Initiating IPSec SAs... 100.00%
Initiated tunnels: 1

Step 19: Ping the IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.326 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.326/0.326/0.326/0.000 ms

Step 20: Initiate a tcp connection from DUT2 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 8080 tcp
admin@DUT2$ monitor test connection client 10.1.0.1 8080 tcp local-address 10.3.0.1

Step 21: Run the command vpn ipsec show sa on DUT0 and check whether the output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER1: #4, ESTABLISHED, IKEv2, 3f7e24edc5db4ffe_i 989112df34605903_r*
local  '90.0.0.1' @ 90.0.0.1[500]
remote '90.0.0.3' @ 90.0.0.3[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
established 3s ago, rekeying in 16166s
peer-PEER1-tunnel-1: #4, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 3s ago, rekeying in 3246s, expires in 3957s
in  c7c85e5c,    764 bytes,    12 packets,     0s ago
out c777d062,    712 bytes,    11 packets,     0s ago
local  10.1.0.0/24
remote 10.3.0.0/24

Step 22: Run the command show system route ip on DUT0 and check whether the output contains the following tokens:

10.3.0.0/24 via 90.0.0.3 dev eth1 proto static metric 100
Show output
10.1.0.0/24 dev dum0 proto kernel scope link src 10.1.0.1
10.3.0.0/24 via 90.0.0.3 dev eth1 proto static metric 100
80.0.0.0/24 dev eth0 proto kernel scope link src 80.0.0.1
90.0.0.0/24 dev eth1 proto kernel scope link src 90.0.0.1

Step 23: Run the command show system route ip on DUT0 and check whether the output does not contain the following tokens:

10.3.0.0/24 via 80.0.0.2 dev eth0 proto static metric 10
Show output
10.1.0.0/24 dev dum0 proto kernel scope link src 10.1.0.1
10.3.0.0/24 via 90.0.0.3 dev eth1 proto static metric 100
80.0.0.0/24 dev eth0 proto kernel scope link src 80.0.0.1
90.0.0.0/24 dev eth1 proto kernel scope link src 90.0.0.1