P2P
These scenarios show how to configure an OpenVPN tunnel using a P2P topology
Basic Tunnel
Description
A simple P2P tunnel is created between two devices
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.210 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.210/0.210/0.210/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.371 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.371/0.371/0.371/0.000 ms
TCP Protocol
Description
A simple P2P tunnel through TCP is created between two devices
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 protocol tcp-client set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 protocol tcp-server set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.214 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.214/0.214/0.214/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.382 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.382/0.382/0.382/0.000 ms
VRF
Description
A simple P2P tunnel using a custom VRF is created between two devices
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set interfaces openvpn ovpn1 vrf VRF1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf VRF1
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set interfaces openvpn ovpn1 vrf VRF1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf VRF1
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=619 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 619.003/619.003/619.003/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 vrf VRF1 count 1 size 56 timeout 1Show output
ping: Warning: source address might be selected on device other than: VRF1 PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 VRF1: 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.354 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.354/0.354/0.354/0.000 ms
Step 6: Expect a failure in the following command:
Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 7: Expect a failure in the following command:
Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 8: Expect a failure in the following command:
Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 9: Expect a failure in the following command:
Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 10: Expect a failure in the following command:
Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 11: Expect a failure in the following command:
Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Step 12: Expect a failure in the following command:
Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
ping: connect: Network is unreachable
Lzo Compression
Description
A simple P2P tunnel with lzo compression is created between two devices
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p tunnel-profile TNL set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn tunnel-profile TNL compression lzo
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p tunnel-profile TNL set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn tunnel-profile TNL compression lzo
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=562 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 562.304/562.304/562.304/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.303 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.303/0.303/0.303/0.000 ms
Secret
Description
A simple encrypted tunnel using a shared static key is created between two devices
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.181 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.181/0.181/0.181/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.609 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.609/0.609/0.609/0.000 ms
Secret With Direction
Description
A simple encrypted tunnel using a shared static key is created between two devices using key directions
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret direction 0 set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC secret direction 1 set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=572 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 572.077/572.077/572.077/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.451 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.451/0.451/0.451/0.000 ms
Cipher
Description
A simple encrypted tunnel using a shared static key is created between two devices using a custom cipher
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC cipher 1 algorithm CAMELLIA-128-CBC set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC cipher 1 algorithm CAMELLIA-128-CBC set vpn openvpn encryption-profile ENC secret static-key 'running://static.key'
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=516 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 516.372/516.372/516.372/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.455 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.455/0.455/0.455/0.000 ms
Auth
Description
A simple encrypted tunnel using a shared static key is created between two devices using a custom digest algorithm
Scenario
Step 1: Set the following configuration in DUT0
:
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.1 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.2 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.2 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC auth 1 algorithm SHA256
Step 2: Set the following configuration in DUT1
:
set interfaces ethernet eth0 address 192.168.100.2/24 set interfaces openvpn ovpn1 local-endpoint 10.0.0.2 set interfaces openvpn ovpn1 mode p2p encryption-profile ENC set interfaces openvpn ovpn1 peer 1 address 192.168.100.1 set interfaces openvpn ovpn1 remote-endpoint 10.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn openvpn encryption-profile ENC auth 1 algorithm SHA256
Step 3: Ping IP address 192.168.100.2
from DUT0
:
admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1Show output
PING 192.168.100.2 (192.168.100.2) 56(84) bytes of data. 64 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=0.231 ms --- 192.168.100.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.231/0.231/0.231/0.000 ms
Step 4: Run command interfaces openvpn ovpn1 status
at DUT0
and check if output contains the following tokens:
CONNECTED
Show output
OpenVPN interface ovpn1 State: CONNECTED (SUCCESS) Local endpoint: 10.0.0.1:1194 Remote: 192.168.100.2
Step 5: Ping IP address 10.0.0.2
from DUT0
:
admin@DUT0$ ping 10.0.0.2 count 1 size 56 timeout 1Show output
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.322 ms --- 10.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.322/0.322/0.322/0.000 ms