Roadwarrior
This scenario shows different ways to setup a roadwarrior VPN connection; in which, instead of using a N2N (network to network) connection, a single machine (e.g., a host) is able to connect to a remote private network.
On the one hand, DUT2 and DUT0 represent a remote branch
office. On the other hand, DUT1 is a roadwarrior that can
establish a connection to DUT2 using different virtual IPs.
Note that security associations (SAs) have to be manually
flushed with the command clear vpn ipsec sa. Depending on
the configuration parameter connection-type, the new tunnel
connections will be created or not.
Test VPN Roadwarrior Connection With VTI
Description
In this scenario, DUT0 uses a VTI
interface to encapsulate the VPN traffic.
Scenario
Step 1: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.1.0.2/24 set protocols static route 0.0.0.0/0 next-hop 10.1.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 80.0.0.1/24 set interfaces ethernet eth1 address 10.1.0.1/24 set interfaces vti vti0 ipsec PEER set interfaces vti vti0 local-address 80.0.0.1 set interfaces vti vti0 remote-address 0.0.0.0 set protocols static route 10.3.0.0/24 interface vti0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX19HfX6Nfg9jkpQaVtLhAKx2RNKQa5ewkBI= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER local-address 80.0.0.1 set vpn ipsec site-to-site peer PEER vti local prefix 10.1.0.0/24
Step 3: Set the following configuration in DUT1 :
set interfaces dummy dum0 address 10.3.0.1/24 set interfaces ethernet eth0 address 80.0.0.2/24 set protocols static route 10.1.0.0/24 interface eth0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1+onopZ9yW9rplel4czIxlgjdAttnnWBEQ= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24
Step 4: Ping IP address 80.0.0.1 from DUT1:
admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data. 64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.257 ms --- 80.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.257/0.257/0.257/0.000 ms
Step 5: Ping IP address 80.0.0.2 from DUT0:
admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data. 64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.259 ms --- 80.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.259/0.259/0.259/0.000 ms
Step 6: Ping IP address 10.1.0.2 from DUT0:
admin@DUT0$ ping 10.1.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.514 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.514/0.514/0.514/0.000 ms
Step 7: Run command interfaces dummy dum0 show at DUT1 and expect this output:
Show output
----------------------------------------------------------------- Name IP Address Admin Oper Vrf Description ----------------------------------------------------------------- dum0 10.3.0.1/24 up up fe80::90a2:31ff:fea3:cc4b/64
Step 8: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.346 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.346/0.346/0.346/0.000 ms
Step 9: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.569 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.569/0.569/0.569/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 4247893e48392aea_i 3ecb3143f67c9b16_r* local '80.0.0.1' @ 80.0.0.1[4500] remote '80.0.0.2' @ 80.0.0.2[4500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 28547s peer-PEER-tunnel-VTI: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3307s, expires in 3959s in c55dca54 (0x90000000), 168 bytes, 2 packets, 0s ago out cbbaedb5 (0x90000000), 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 0.0.0.0/0
Step 11: Run command vpn ipsec clear sa at DUT1 and expect this output:
Show output
Deleting IPSec SAs... 100.0% Closed tunnels: 1
Step 12: Modify the following configuration lines in DUT1 :
delete interfaces dummy dum0 address 10.3.0.1/24 set interfaces dummy dum0 address 10.3.0.2/24
Step 13: Run command vpn ipsec initiate peer PEER at DUT1 and expect this output:
Show output
Initiating IPSec SAs... 0.0% Initiated tunnels: 1
Step 14: Run command interfaces dummy dum0 show at DUT1 and expect this output:
Show output
----------------------------------------------------------------- Name IP Address Admin Oper Vrf Description ----------------------------------------------------------------- dum0 10.3.0.2/24 up up fe80::90a2:31ff:fea3:cc4b/64
Step 15: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.349 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.349/0.349/0.349/0.000 ms
Step 16: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.524 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.524/0.524/0.524/0.000 ms
Step 17: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, e589f0b22f2eaf3b_i ae06ec7d36cb53f1_r* local '80.0.0.1' @ 80.0.0.1[4500] remote '80.0.0.2' @ 80.0.0.2[4500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 20298s peer-PEER-tunnel-VTI: #2, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3413s, expires in 3960s in c6ef6d83 (0x90000000), 168 bytes, 2 packets, 0s ago out c6b59cb6 (0x90000000), 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 0.0.0.0/0
Test VPN Roadwarrior Connection With Global Policies
Description
In this scenario, DUT0 uses global VPN
policies (or selectors) to encapsulate traffic.
Scenario
Step 1: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.1.0.2/24 set protocols static route 0.0.0.0/0 next-hop 10.1.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 80.0.0.1/24 set interfaces ethernet eth1 address 10.1.0.1/24 set protocols static route 10.3.0.0/24 interface eth0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX18jv97OERZ5+sOWcbg5E/df/6TZryA1WEk= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER local-address 80.0.0.1 set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.3.0.0/24
Step 3: Set the following configuration in DUT1 :
set interfaces dummy dum0 address 10.3.0.1/24 set interfaces ethernet eth0 address 80.0.0.2/24 set protocols static route 10.1.0.0/24 interface eth0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX18vJLV/szD8aOIIOJZ3Tf3WIQpimnGWZPM= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24
Step 4: Ping IP address 80.0.0.1 from DUT1:
admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data. 64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.233 ms --- 80.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.233/0.233/0.233/0.000 ms
Step 5: Ping IP address 80.0.0.2 from DUT0:
admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data. 64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.216 ms --- 80.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.216/0.216/0.216/0.000 ms
Step 6: Ping IP address 10.1.0.2 from DUT0:
admin@DUT0$ ping 10.1.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.340 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.340/0.340/0.340/0.000 ms
Step 7: Run command interfaces dummy dum0 show at DUT1 and expect this output:
Show output
----------------------------------------------------------------- Name IP Address Admin Oper Vrf Description ----------------------------------------------------------------- dum0 10.3.0.1/24 up up fe80::d069:3eff:fecb:575b/64
Step 8: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.303 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.303/0.303/0.303/0.000 ms
Step 9: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.471 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.471/0.471/0.471/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, df849b714a9ffb28_i e6f6feafa03923a0_r* local '80.0.0.1' @ 80.0.0.1[4500] remote '80.0.0.2' @ 80.0.0.2[4500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 15905s peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3537s, expires in 3960s in cb0c18fc, 168 bytes, 2 packets, 0s ago out c7706f09, 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 10.3.0.0/24
Step 11: Run command vpn ipsec clear sa at DUT1 and expect this output:
Show output
Deleting IPSec SAs... 100.0% Closed tunnels: 1
Step 12: Modify the following configuration lines in DUT1 :
delete interfaces dummy dum0 address 10.3.0.1/24 set interfaces dummy dum0 address 10.3.0.2/24
Step 13: Run command vpn ipsec initiate peer PEER at DUT1 and expect this output:
Show output
Initiating IPSec SAs... 0.0% Initiated tunnels: 1
Step 14: Run command interfaces dummy dum0 show at DUT1 and expect this output:
Show output
----------------------------------------------------------------- Name IP Address Admin Oper Vrf Description ----------------------------------------------------------------- dum0 10.3.0.2/24 up up fe80::d069:3eff:fecb:575b/64
Step 15: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.313 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.313/0.313/0.313/0.000 ms
Step 16: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.2 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.510 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.510/0.510/0.510/0.000 ms
Step 17: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 9152f3281cfc0f75_i f5c814e1d234e9f5_r* local '80.0.0.1' @ 80.0.0.1[4500] remote '80.0.0.2' @ 80.0.0.2[4500] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 16092s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3312s, expires in 3959s in c8eaecc1, 168 bytes, 2 packets, 0s ago out c25fbf4d, 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 10.3.0.0/24
Test VPN Roadwarrior Connection With VTI And VIPs Pool
Description
In this scenario, DUT0 uses a VTI
interface to encapsulate the VPN traffic.
DUT1 requests a virtual IP address from
DUT0 and it installed in dum0. Routes are
also automatically installed taking into
account the negotiated selectors.
Scenario
Step 1: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.1.0.2/24 set protocols static route 0.0.0.0/0 next-hop 10.1.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 80.0.0.1/24 set interfaces ethernet eth1 address 10.1.0.1/24 set interfaces vti vti0 ipsec PEER set interfaces vti vti0 local-address 80.0.0.1 set interfaces vti vti0 remote-address 0.0.0.0 set protocols static route 10.3.0.0/24 interface vti0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX19Aaa2rNa4L4MDiwNXLJZMUezCOxFd4f3s= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec pool POOL prefix 10.3.0.0/24 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER local-address 80.0.0.1 set vpn ipsec site-to-site peer PEER pool POOL set vpn ipsec site-to-site peer PEER vti local prefix 10.1.0.0/24
Step 3: Set the following configuration in DUT1 :
set interfaces dummy dum0 set interfaces ethernet eth0 address 80.0.0.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf main set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1/eeXEE3TjUG1Gl+LYy4px2Y1i1xQloGy4= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER install-vips interface dum0 set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1 set vpn ipsec site-to-site peer PEER tunnel 1 install-routes main set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24
Step 4: Ping IP address 80.0.0.1 from DUT1:
admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data. 64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.278 ms --- 80.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.278/0.278/0.278/0.000 ms
Step 5: Ping IP address 80.0.0.2 from DUT0:
admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data. 64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.294 ms --- 80.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.294/0.294/0.294/0.000 ms
Step 6: Ping IP address 10.1.0.2 from DUT0:
admin@DUT0$ ping 10.1.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.346 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.346/0.346/0.346/0.000 ms
Step 7: Run command interfaces dummy dum0 show at DUT1 and expect this output:
Show output
----------------------------------------------------------------- Name IP Address Admin Oper Vrf Description ----------------------------------------------------------------- dum0 10.3.0.1/32 up up fe80::ec0f:f0ff:fe2c:8914/64
Step 8: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.322 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.322/0.322/0.322/0.000 ms
Step 9: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.460 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.460/0.460/0.460/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 2556aa01b65b1dad_i 1482a142a2b3ae9a_r* local '80.0.0.1' @ 80.0.0.1[4500] remote '80.0.0.2' @ 80.0.0.2[4500] [10.3.0.1] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 1s ago, rekeying in 23936s peer-PEER-tunnel-VTI: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-256 installed 1s ago, rekeying in 3349s, expires in 3959s in cf9bafaf (0x90000000), 168 bytes, 2 packets, 0s ago out c76e9bec (0x90000000), 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 10.3.0.1/32
Test VPN Roadwarrior Connection With Global Policies And VIPs Pool
Description
In this scenario, DUT0 uses global VPN
policies (or selectors) to encapsulate traffic.
DUT1 requests a virtual IP address from
DUT0 and it installed in dum0. Routes are
also automatically installed taking into
account the negotiated selectors.
Scenario
Step 1: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 10.1.0.2/24 set protocols static route 0.0.0.0/0 next-hop 10.1.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 80.0.0.1/24 set interfaces ethernet eth1 address 10.1.0.1/24 set interfaces vti vti0 ipsec PEER set interfaces vti vti0 local-address 80.0.0.1 set interfaces vti vti0 remote-address 0.0.0.0 set protocols static route 10.3.0.0/24 interface vti0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1+VdCGbed3lOpMGvZ1+1qnBzIC8L+/qpcY= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec pool POOL prefix 10.3.0.0/24 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER local-address 80.0.0.1 set vpn ipsec site-to-site peer PEER pool POOL set vpn ipsec site-to-site peer PEER vti local prefix 10.1.0.0/24
Step 3: Set the following configuration in DUT1 :
set interfaces dummy dum0 set interfaces ethernet eth0 address 80.0.0.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf main set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1/WWDw6sL5rNEnQGOCDkbJzf7h1LYf90ec= set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any set vpn ipsec esp-group CHILD-SA mode tunnel set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128 set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19 set vpn ipsec ike-group IKE-SA key-exchange ikev2 set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19 set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128 set vpn ipsec ike-group IKE-SA proposal 1 hash sha256 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA set vpn ipsec site-to-site peer PEER connection-type initiate set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA set vpn ipsec site-to-site peer PEER ike-group IKE-SA set vpn ipsec site-to-site peer PEER install-vips interface dum0 set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1 set vpn ipsec site-to-site peer PEER tunnel 1 install-routes main set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24
Step 4: Ping IP address 80.0.0.1 from DUT1:
admin@DUT1$ ping 80.0.0.1 count 1 size 56 timeout 1Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data. 64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.265 ms --- 80.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.265/0.265/0.265/0.000 ms
Step 5: Ping IP address 80.0.0.2 from DUT0:
admin@DUT0$ ping 80.0.0.2 count 1 size 56 timeout 1Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data. 64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.242 ms --- 80.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.242/0.242/0.242/0.000 ms
Step 6: Ping IP address 10.1.0.2 from DUT0:
admin@DUT0$ ping 10.1.0.2 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=64 time=0.362 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.362/0.362/0.362/0.000 ms
Step 7: Run command interfaces dummy dum0 show at DUT1 and expect this output:
Show output
----------------------------------------------------------------- Name IP Address Admin Oper Vrf Description ----------------------------------------------------------------- dum0 10.3.0.1/32 up up fe80::8ccf:6eff:fe4e:98ae/64
Step 8: Ping IP address 10.1.0.1 from DUT1:
admin@DUT1$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.310 ms --- 10.1.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.310/0.310/0.310/0.000 ms
Step 9: Ping IP address 10.1.0.2 from DUT1:
admin@DUT1$ ping 10.1.0.2 local-address 10.3.0.1 count 1 size 56 timeout 1Show output
PING 10.1.0.2 (10.1.0.2) from 10.3.0.1 : 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=63 time=0.483 ms --- 10.1.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.483/0.483/0.483/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
[1-9]\d? packetsShow output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, d3942ec643adf571_i e8a7a32f6422dbec_r* local '80.0.0.1' @ 80.0.0.1[4500] remote '80.0.0.2' @ 80.0.0.2[4500] [10.3.0.1] AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256 established 0s ago, rekeying in 19478s peer-PEER-tunnel-VTI: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_GCM_16-256 installed 0s ago, rekeying in 3295s, expires in 3960s in cb460888 (0x90000000), 168 bytes, 2 packets, 0s ago out c50b89fb (0x90000000), 168 bytes, 2 packets, 0s ago local 10.1.0.0/24 remote 10.3.0.1/32