Same-Remote

This scenario shows how to configure a VPN responder that can receive incoming connections from the same virtual IP address.

../../../../../../../_images/same-remote.svg

Test Site-To-Site With Same Remote Address

Description

VPN site-to-site configuration to connect two subnets to an end-point using the same virtual IP address.

Scenario

Attention

In order to make this scenario work, the device needs a way to respond and reinject traffic through the appropriate VPN tunnel. This can be achieved by copying the packet mark into the conntrack mark and restoring it later. Therefore, the following configuration lines are needed:

Show output
set vpn ipsec esp-group CHILD-SA mark-in unique
set vpn ipsec esp-group CHILD-SA mark-out unique
set traffic policy IN_MARK_TO_FLOW rule 1 copy mark connmark
set traffic policy OUT_FLOW_TO_MARK rule 1 copy connmark mark
set interfaces eth0 traffic policy in IN_MARK_TO_FLOW
set interfaces dum0 traffic policy local-out OUT_FLOW_TO_MARK

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces dummy dum0 traffic policy local-out OUT_FLOW_TO_MARK
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces ethernet eth0 traffic policy in IN_MARK_TO_FLOW
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy IN_MARK_TO_FLOW rule 1 copy mark connmark
set traffic policy OUT_FLOW_TO_MARK rule 1 copy connmark mark
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX196B2WneY08tfrkcaA7+9SgPcMZq1YXf2w=
set vpn ipsec esp-group CHILD-SA mark-in unique
set vpn ipsec esp-group CHILD-SA mark-out unique
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 0.0.0.0/0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX18eI60NcgyUqA+iVAOvQTBaKUUk5c9jm4g=
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 next-hop 80.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA local auth encrypted-pre-shared-secret U2FsdGVkX1+2ulQbspLFcYnwa/Ie/cZ1Uiz5Ugr7o/c=
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 4: Ping IP address 80.0.0.2 from DUT0:

admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.236 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.236/0.236/0.236/0.000 ms

Step 5: Ping IP address 80.0.0.3 from DUT0:

admin@DUT0$ ping 80.0.0.3 count 1 size 56 timeout 1
Show output
PING 80.0.0.3 (80.0.0.3) 56(84) bytes of data.
64 bytes from 80.0.0.3: icmp_seq=1 ttl=64 time=0.235 ms

--- 80.0.0.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.235/0.235/0.235/0.000 ms

Step 6: Run command vpn ipsec show sa at DUT0 and check if output contains the following tokens:

80.0.0.2
80.0.0.3
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 4ea7136aa04812ab_i 6fd971fd1a7aa0d1_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 1s ago, rekeying in 21970s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3300s, expires in 3959s
    in  c6f0abae (0x00000002),      0 bytes,     0 packets
    out cf7cbe4c (0x00000002),      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, c335be2773090f9f_i 7859bb74b1e5083b_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 3s ago, rekeying in 21710s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 3s ago, rekeying in 3267s, expires in 3957s
    in  c0f7f39e (0x00000001),      0 bytes,     0 packets
    out cc090813 (0x00000001),      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.3.0.0/24

Step 7: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.280 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.280/0.280/0.280/0.000 ms

Step 8: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.323 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.323/0.323/0.323/0.000 ms

Step 9: Run command vpn ipsec show sa remote 80.0.0.2 at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, c335be2773090f9f_i 7859bb74b1e5083b_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 3s ago, rekeying in 21710s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 3s ago, rekeying in 3267s, expires in 3957s
    in  c0f7f39e (0x00000001),     84 bytes,     1 packets,     0s ago
    out cc090813 (0x00000001),     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Step 10: Run command vpn ipsec show sa remote 80.0.0.3 at DUT0 and check if output matches the following regular expressions:

[1-9]\d? packets
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 4ea7136aa04812ab_i 6fd971fd1a7aa0d1_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 1s ago, rekeying in 21970s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3300s, expires in 3959s
    in  c6f0abae (0x00000002),     84 bytes,     1 packets,     0s ago
    out cf7cbe4c (0x00000002),     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Attention

The command vpn show ipsec policy can be used to debug the IPSec selectors that have been installed in OSDx devices. Example for device DUT0:

Show output
src 10.1.0.0/24 dst 10.3.0.0/24 dev dum0
        dir out priority 375421
        mark 0x2/0xffffffff
        tmpl src 80.0.0.1 dst 80.0.0.3
                proto esp spi 0xcf7cbe4c reqid 2 mode tunnel
src 10.3.0.0/24 dst 10.1.0.0/24
        dir fwd priority 375423
        mark 0x2/0xffffffff
        tmpl src 80.0.0.3 dst 80.0.0.1
                proto esp reqid 2 mode tunnel
src 10.3.0.0/24 dst 10.1.0.0/24
        dir in priority 375423
        mark 0x2/0xffffffff
        tmpl src 80.0.0.3 dst 80.0.0.1
                proto esp reqid 2 mode tunnel
src 10.1.0.0/24 dst 10.3.0.0/24 dev dum0
        dir out priority 375421
        mark 0x1/0xffffffff
        tmpl src 80.0.0.1 dst 80.0.0.2
                proto esp spi 0xcc090813 reqid 1 mode tunnel
src 10.3.0.0/24 dst 10.1.0.0/24
        dir fwd priority 375423
        mark 0x1/0xffffffff
        tmpl src 80.0.0.2 dst 80.0.0.1
                proto esp reqid 1 mode tunnel
src 10.3.0.0/24 dst 10.1.0.0/24
        dir in priority 375423
        mark 0x1/0xffffffff
        tmpl src 80.0.0.2 dst 80.0.0.1
                proto esp reqid 1 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0