Backup-Tunnel

This scenario shows how to configure two VPN IPsec tunnels in a OSDx device. One of them acts as the main tunnel and the other one as a backup tunnel. As soon as the device detects the main tunnel is not reachable, it starts sending traffic trough the backup one.

Test Site-To-Site With Backup Tunnel

Description

VPN site-to-site configuration to create a backup tunnel that is activated when the main one is not reachable.

Scenario

Attention

This scenario uses the packet mark to select the VPN tunnel. The packet mark is assigned using a traffic policy that depends on an advisor status.

Step 1: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX1953dHG7pOHTZ3o0JrAFvPfEyYewMknGs0=
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 2: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX1+MiCCIVRsgFJ+DO9N7DlWpJ1ABb015LcM=
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces dummy dum0 traffic policy local-out PBR
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 0.0.0.0/0 interface dum0
set service nsm operation BACKUP_PROBE alarm MAIN_OFF activate loss 80
set service nsm operation BACKUP_PROBE destination-address 80.0.0.2
set service nsm operation BACKUP_PROBE interval 3
set service nsm operation BACKUP_PROBE type icmp
set system advisor MAIN_NOT_REACHABLE test MAIN_OFF
set system alarm MAIN_OFF
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy PBR rule 1 advisor MAIN_NOT_REACHABLE
set traffic policy PBR rule 1 set mark 4321
set traffic policy PBR rule 2 set mark 1234
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX1/HVXFV8l3F1hYvvZ2Lt9EEz/XGJ+gPBQc=
set vpn ipsec esp-group CHILD-BACKUP mark-in 4321
set vpn ipsec esp-group CHILD-BACKUP mark-out 4321
set vpn ipsec esp-group CHILD-BACKUP proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-BACKUP proposal 1 pfs dh-group19
set vpn ipsec esp-group CHILD-MAIN mark-in 1234
set vpn ipsec esp-group CHILD-MAIN mark-out 1234
set vpn ipsec esp-group CHILD-MAIN proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-MAIN proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer BACKUP auth-profile AUTH-SA
set vpn ipsec site-to-site peer BACKUP connection-type initiate
set vpn ipsec site-to-site peer BACKUP default-esp-group CHILD-BACKUP
set vpn ipsec site-to-site peer BACKUP ike-group IKE-SA
set vpn ipsec site-to-site peer BACKUP remote-address 80.0.0.3
set vpn ipsec site-to-site peer BACKUP tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer BACKUP tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer BACKUP tunnel 1 remote prefix 0.0.0.0/0
set vpn ipsec site-to-site peer MAIN auth-profile AUTH-SA
set vpn ipsec site-to-site peer MAIN connection-type initiate
set vpn ipsec site-to-site peer MAIN default-esp-group CHILD-MAIN
set vpn ipsec site-to-site peer MAIN ike-group IKE-SA
set vpn ipsec site-to-site peer MAIN remote-address 80.0.0.2
set vpn ipsec site-to-site peer MAIN tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer MAIN tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer MAIN tunnel 1 remote prefix 0.0.0.0/0

Step 4: Ping IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1

Step 5: Ping IP address 80.0.0.3 from DUT0:

admin@DUT0$ ping 80.0.0.3 count 1 size 56 timeout 1

Step 6: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:

80.0.0.2
80.0.0.3

Step 7: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1

Step 8: Run command vpn ipsec show sa remote 80.0.0.2 at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets

Step 9: Run command vpn ipsec show sa remote 80.0.0.3 at DUT0 and check if output does not match the following regular expressions:

[1-9]\d? packets

Step 10: Modify the following configuration lines in DUT1 :

set interfaces ethernet eth0 disable

Step 11: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1

Step 12: Run command vpn ipsec show sa remote 80.0.0.3 at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets