Ppk

This set of tests shows how to configure and connect more than two subnets with each other through a VPN tunnel using PPK authentication in different ways.

../../../../_images/ppk.svg

Test PPK Options

Description

In this test, we will check the different options for PPK authentication (i.e., when it is required or not, when it remains unmatched, etc.).

Scenario

Note

Set default configuration for both DUTs, where PPK is not required and the PPK is the same.

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX1+uKRzcxbr5EmNtDAKb4hWJbyLon+hHI/g=
set vpn ipsec auth-profile AUTH-SA global-secrets eap dave encrypted-secret U2FsdGVkX18umDZgwftukAaHYypOZ3MRibrAxESnhys=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth eap %any type ttls
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX1/7CT33jVT9dSYCR+6lTual6EkZ4xY7x9w=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth eap carol type ttls
set vpn ipsec auth-profile AUTH-SA local id carol
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.036 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.036/0.036/0.036/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.042 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.042/0.042/0.042/0.000 ms

Step 5: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, cc6cf247a3e57461_i d94613461703627f_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 21865s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3462s, expires in 3960s
    in  c5b5365f,      0 bytes,     0 packets
    out c9f9222a,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 6: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.320 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.320/0.320/0.320/0.000 ms

Step 7: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.299 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.299/0.299/0.299/0.000 ms

Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, cc6cf247a3e57461_i d94613461703627f_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 21864s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3461s, expires in 3959s
    in  c5b5365f,    168 bytes,     2 packets,     0s ago
    out c9f9222a,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Note

Delete the PPK from DUT0 and check that the SA falls back to standard authentication.

Step 9: Modify the following configuration lines in DUT0 :

delete vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org

Step 10: Run command vpn ipsec clear peer PEER at DUT0 and expect this output:

Show output
[IKE] deleting IKE_SA vpn-peer-PEER[1] between 80.0.0.1[CN=moon.teldat.org]...80.0.0.2[carol]
[IKE] sending DELETE for IKE_SA vpn-peer-PEER[1]
[ENC] generating INFORMATIONAL request 0 [ D ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (57 bytes)
[ENC] parsed INFORMATIONAL response 0 [ ]
[IKE] IKE_SA deleted
terminate completed successfully
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (120 bytes)
[ENC] parsed IKE_AUTH request 5 [ EAP/RES/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/RES/ID]
[IKE] received EAP identity 'carol'
[IKE] phase2 method EAP_MD5 selected
[IKE] sending tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[ENC] generating IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (132 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (132 bytes)
[ENC] parsed IKE_AUTH request 6 [ EAP/RES/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/RES/MD5]
[IKE] EAP_TTLS phase2 authentication of 'carol' with EAP_MD5 successful
[IKE] EAP method EAP_TTLS succeeded, MSK established
[ENC] generating IKE_AUTH response 6 [ EAP/SUCC ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (162 bytes)
[ENC] parsed IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[CFG] no PPK for 'carol@teldat.org' found, ignored because PPK is not required
[IKE] no PPK available, using NO_PPK_AUTH notify
[IKE] authentication of 'carol' with EAP successful
[IKE] authentication of 'CN=moon.teldat.org' (myself) with EAP
[IKE] IKE_SA vpn-peer-PEER[2] established between 80.0.0.1[CN=moon.teldat.org]...80.0.0.2[carol]
[IKE] scheduling rekeying in 22522s
[IKE] maximum IKE_SA lifetime 22522s
[CFG] selected proposal: ESP:AES_GCM_16_256/NO_EXT_SEQ
[IKE] CHILD_SA peer-PEER-tunnel-1{2} established with SPIs c7141ebe_i ccc8bf13_o and TS 10.1.0.0/24 === 10.2.0.0/24
initiate completed successfully

Step 11: Run command vpn ipsec clear peer PEER at DUT1 and expect this output:

Show output
[IKE] deleting IKE_SA vpn-peer-PEER[2] between 80.0.0.2[carol]...80.0.0.1[CN=moon.teldat.org]
[IKE] sending DELETE for IKE_SA vpn-peer-PEER[2]
[ENC] generating INFORMATIONAL request 8 [ D ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (65 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (57 bytes)
[ENC] parsed INFORMATIONAL response 8 [ ]
[IKE] IKE_SA deleted
terminate completed successfully
[IKE] initiating IKE_SA vpn-peer-PEER[3] to 80.0.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) N(USE_PPK) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (272 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (305 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(USE_PPK) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/ECP_256
[IKE] received cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] sending cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] establishing CHILD_SA peer-PEER-tunnel-1{3}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (247 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1252 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (246 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1433 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/TTLS ]
[IKE] received end entity cert "CN=moon.teldat.org"
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[IKE] authentication of 'CN=moon.teldat.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_TTLS authentication (id 0xDF)
[TLS] EAP_TTLS version is v0
[ENC] generating IKE_AUTH request 2 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (279 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1085 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/TTLS ]
[ENC] generating IKE_AUTH request 3 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (67 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (540 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/TTLS ]
[TLS] negotiated TLS 1.2 using suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[TLS] received TLS server certificate 'CN=moon.teldat.org'
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[ENC] generating IKE_AUTH request 4 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (229 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (122 bytes)
[ENC] parsed IKE_AUTH response 4 [ EAP/REQ/TTLS ]
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/ID]
[ENC] generating IKE_AUTH request 5 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (120 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (132 bytes)
[ENC] parsed IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[IKE] server requested EAP_MD5 authentication (id 0xBF)
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/MD5]
[ENC] generating IKE_AUTH request 6 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (132 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 6 [ EAP/SUCC ]
[IKE] EAP method EAP_TTLS succeeded, MSK established
[IKE] authentication of 'carol' (myself) with EAP
[ENC] generating IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (162 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (181 bytes)
[ENC] parsed IKE_AUTH response 7 [ AUTH SA TSi TSr ]
[IKE] authentication of 'CN=moon.teldat.org' with EAP successful
[CFG] peer didn't use PPK for PPK_ID 'carol@teldat.org'
[IKE] IKE_SA vpn-peer-PEER[3] established between 80.0.0.2[carol]...80.0.0.1[CN=moon.teldat.org]
[IKE] scheduling rekeying in 18822s
[IKE] maximum IKE_SA lifetime 18822s
[CFG] selected proposal: ESP:AES_GCM_16_256/NO_EXT_SEQ
[IKE] CHILD_SA peer-PEER-tunnel-1{3} established with SPIs cf6d4898_i c8a0f77e_o and TS 10.2.0.0/24 === 10.1.0.0/24
initiate completed successfully

Step 12: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #3, ESTABLISHED, IKEv2, 5c51bd16619541fc_i aa9beaeff590eefa_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 0s ago, rekeying in 21593s
  peer-PEER-tunnel-1: #3, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3303s, expires in 3960s
    in  c8a0f77e,      0 bytes,     0 packets
    out cf6d4898,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 13: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.277 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.277/0.277/0.277/0.000 ms

Step 14: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.289 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.289/0.289/0.289/0.000 ms

Step 15: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #3, ESTABLISHED, IKEv2, 5c51bd16619541fc_i aa9beaeff590eefa_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 0s ago, rekeying in 21593s
  peer-PEER-tunnel-1: #3, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3303s, expires in 3960s
    in  c8a0f77e,    168 bytes,     2 packets,     0s ago
    out cf6d4898,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Note

Set the PPK as required in DUT0 and, with DUT1’s corresponding PPK deleted, check that the connection fails.

Step 16: Modify the following configuration lines in DUT0 :

set vpn ipsec auth-profile AUTH-SA remote ppk required

Step 17: Run command vpn ipsec clear peer PEER at DUT0 and expect this output:

Show output
[IKE] deleting IKE_SA vpn-peer-PEER[3] between 80.0.0.1[CN=moon.teldat.org]...80.0.0.2[carol]
[IKE] sending DELETE for IKE_SA vpn-peer-PEER[3]
[ENC] generating INFORMATIONAL request 0 [ D ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (57 bytes)
[ENC] parsed INFORMATIONAL response 0 [ ]
[IKE] IKE_SA deleted
terminate completed successfully
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (132 bytes)
[ENC] parsed IKE_AUTH request 6 [ EAP/RES/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/RES/MD5]
[IKE] EAP_TTLS phase2 authentication of 'carol' with EAP_MD5 successful
[IKE] EAP method EAP_TTLS succeeded, MSK established
[ENC] generating IKE_AUTH response 6 [ EAP/SUCC ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (162 bytes)
[ENC] parsed IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[CFG] PPK required but no PPK found for 'carol@teldat.org'
[ENC] generating IKE_AUTH response 7 [ N(AUTH_FAILED) ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 18: Run command vpn ipsec clear peer PEER at DUT1 and expect this output:

Show output
terminate failed: no matching SAs to terminate found
[IKE] initiating IKE_SA vpn-peer-PEER[5] to 80.0.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) N(USE_PPK) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (272 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (305 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(USE_PPK) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/ECP_256
[IKE] received cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] sending cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] establishing CHILD_SA peer-PEER-tunnel-1{5}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (247 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1252 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (246 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1433 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/TTLS ]
[IKE] received end entity cert "CN=moon.teldat.org"
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[IKE] authentication of 'CN=moon.teldat.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_TTLS authentication (id 0x1D)
[TLS] EAP_TTLS version is v0
[ENC] generating IKE_AUTH request 2 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (279 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1085 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/TTLS ]
[ENC] generating IKE_AUTH request 3 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (67 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (540 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/TTLS ]
[TLS] negotiated TLS 1.2 using suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[TLS] received TLS server certificate 'CN=moon.teldat.org'
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[ENC] generating IKE_AUTH request 4 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (229 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (122 bytes)
[ENC] parsed IKE_AUTH response 4 [ EAP/REQ/TTLS ]
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/ID]
[ENC] generating IKE_AUTH request 5 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (120 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (132 bytes)
[ENC] parsed IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[IKE] server requested EAP_MD5 authentication (id 0x81)
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/MD5]
[ENC] generating IKE_AUTH request 6 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (132 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 6 [ EAP/SUCC ]
[IKE] EAP method EAP_TTLS succeeded, MSK established
[IKE] authentication of 'carol' (myself) with EAP
[ENC] generating IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (162 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 7 [ N(AUTH_FAILED) ]
[IKE] received AUTHENTICATION_FAILED notify error
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 19: Expect a failure in the following command: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Note

Set the PPK as required in DUT1 and change the PPK in DUT0 back to not required. Check that the connection is still failing.

Step 20: Modify the following configuration lines in DUT0 :

delete vpn ipsec auth-profile AUTH-SA remote ppk required

Step 21: Modify the following configuration lines in DUT1 :

set vpn ipsec auth-profile AUTH-SA local ppk required

Step 22: Run command vpn ipsec clear peer PEER at DUT0 and expect this output:

Show output
terminate failed: no matching SAs to terminate found
[IKE] unable to resolve %any, initiate aborted
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 23: Run command vpn ipsec clear peer PEER at DUT1 and expect this output:

Show output
terminate failed: no matching SAs to terminate found
[IKE] initiating IKE_SA vpn-peer-PEER[7] to 80.0.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) N(USE_PPK) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (272 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (305 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(USE_PPK) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/ECP_256
[IKE] received cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] sending cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] establishing CHILD_SA peer-PEER-tunnel-1{7}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (247 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1252 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (246 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1433 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/TTLS ]
[IKE] received end entity cert "CN=moon.teldat.org"
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[IKE] authentication of 'CN=moon.teldat.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_TTLS authentication (id 0x7F)
[TLS] EAP_TTLS version is v0
[ENC] generating IKE_AUTH request 2 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (279 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1085 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/TTLS ]
[ENC] generating IKE_AUTH request 3 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (67 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (540 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/TTLS ]
[TLS] negotiated TLS 1.2 using suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[TLS] received TLS server certificate 'CN=moon.teldat.org'
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[ENC] generating IKE_AUTH request 4 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (229 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (122 bytes)
[ENC] parsed IKE_AUTH response 4 [ EAP/REQ/TTLS ]
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/ID]
[ENC] generating IKE_AUTH request 5 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (120 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (132 bytes)
[ENC] parsed IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[IKE] server requested EAP_MD5 authentication (id 0xCF)
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/MD5]
[ENC] generating IKE_AUTH request 6 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (132 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 6 [ EAP/SUCC ]
[IKE] EAP method EAP_TTLS succeeded, MSK established
[IKE] authentication of 'carol' (myself) with EAP
[ENC] generating IKE_AUTH request 7 [ AUTH N(PPK_ID) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (122 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 7 [ N(AUTH_FAILED) ]
[IKE] received AUTHENTICATION_FAILED notify error
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 24: Expect a failure in the following command: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Test PPK EAP-TTLS STS

Description

Test the site-to-site VPN with PPK authentication and EAP-TTLS

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX18CKNNDWiOMtgclRJe8Rzg8drYK5sc75Yc=
set vpn ipsec auth-profile AUTH-SA global-secrets eap dave encrypted-secret U2FsdGVkX1/XD7MV5+nKCqZgFHNONuznX6zi160Fsbc=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth eap %any type ttls
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX18bUr8EuP4lSPbSMK6eHF/DV2cTMo/1W3Y=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth eap carol type ttls
set vpn ipsec auth-profile AUTH-SA local id carol
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.025 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.025/0.025/0.025/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.038 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.038/0.038/0.038/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap dave encrypted-secret U2FsdGVkX1+RBRxaEPRrxmJCCygwvKoQPzM70U3vcis=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth eap dave type ttls
set vpn ipsec auth-profile AUTH-SA local id dave
set vpn ipsec auth-profile AUTH-SA local ppk id dave@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.283 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.283/0.283/0.283/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7de53698fbc47e39_i 04c2c5ae4645ea0c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 19638s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3370s, expires in 3960s
    in  c8c3b6e9,     84 bytes,     1 packets,     0s ago
    out ce22ed5e,     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, a774383e33029b89_i 9dbf76918960ec9c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 4s ago, rekeying in 21138s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 4s ago, rekeying in 3396s, expires in 3956s
    in  cd789d3f,      0 bytes,     0 packets
    out ce3e10f2,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.293 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.293/0.293/0.293/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.262 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.262/0.262/0.262/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7de53698fbc47e39_i 04c2c5ae4645ea0c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 19630s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3362s, expires in 3952s
    in  c8c3b6e9,     84 bytes,     1 packets,     8s ago
    out ce22ed5e,     84 bytes,     1 packets,     8s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, a774383e33029b89_i 9dbf76918960ec9c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 21130s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 3388s, expires in 3948s
    in  cd789d3f,    168 bytes,     2 packets,     0s ago
    out ce3e10f2,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7de53698fbc47e39_i 04c2c5ae4645ea0c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 19630s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3362s, expires in 3952s
    in  c8c3b6e9,     84 bytes,     1 packets,     8s ago
    out ce22ed5e,     84 bytes,     1 packets,     8s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, a774383e33029b89_i 9dbf76918960ec9c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 21130s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 3388s, expires in 3948s
    in  cd789d3f,    168 bytes,     2 packets,     0s ago
    out ce3e10f2,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.302 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.302/0.302/0.302/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.535 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.535/0.535/0.535/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7de53698fbc47e39_i 04c2c5ae4645ea0c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 9s ago, rekeying in 19629s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 9s ago, rekeying in 3361s, expires in 3951s
    in  c8c3b6e9,    252 bytes,     3 packets,     0s ago
    out ce22ed5e,    252 bytes,     3 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, a774383e33029b89_i 9dbf76918960ec9c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 21129s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 3387s, expires in 3947s
    in  cd789d3f,    168 bytes,     2 packets,     1s ago
    out ce3e10f2,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Test PPK PSK STS

Description

Test the site-to-site VPN with PPK authentication and PSK

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1/fat5Ep6yXgQldjKPVcKhHjOIhUg6o+SE=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX19O+0xXx6gHWXtpQuLpHqk8BGW8TQhIv88=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.336 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.336/0.336/0.336/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.028 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.028/0.028/0.028/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1/uyCeyp4c63wDbhYft2hMJzde8BKsrIho=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA local ppk id dave@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.544 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.544/0.544/0.544/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7b15a79a4c021ce3_i de991e23a816e5c0_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 22624s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3278s, expires in 3960s
    in  cb237268,     84 bytes,     1 packets,     0s ago
    out c7bf38f8,     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 268ee28ea6d45e73_i 6f0fd859b85e68d1_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 4s ago, rekeying in 18158s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 4s ago, rekeying in 3247s, expires in 3956s
    in  c7211e81,      0 bytes,     0 packets
    out c8ae7aa5,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.281 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.281/0.281/0.281/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.319 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.319/0.319/0.319/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7b15a79a4c021ce3_i de991e23a816e5c0_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 22616s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3270s, expires in 3952s
    in  cb237268,     84 bytes,     1 packets,     8s ago
    out c7bf38f8,     84 bytes,     1 packets,     8s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 268ee28ea6d45e73_i 6f0fd859b85e68d1_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 18150s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 3239s, expires in 3948s
    in  c7211e81,    168 bytes,     2 packets,     0s ago
    out c8ae7aa5,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7b15a79a4c021ce3_i de991e23a816e5c0_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 22616s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3270s, expires in 3952s
    in  cb237268,     84 bytes,     1 packets,     8s ago
    out c7bf38f8,     84 bytes,     1 packets,     8s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 268ee28ea6d45e73_i 6f0fd859b85e68d1_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 18150s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 3239s, expires in 3948s
    in  c7211e81,    168 bytes,     2 packets,     0s ago
    out c8ae7aa5,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=8.61 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 8.605/8.605/8.605/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.330 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.330/0.330/0.330/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 7b15a79a4c021ce3_i de991e23a816e5c0_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 9s ago, rekeying in 22615s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 9s ago, rekeying in 3269s, expires in 3951s
    in  cb237268,    252 bytes,     3 packets,     0s ago
    out c7bf38f8,    252 bytes,     3 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 268ee28ea6d45e73_i 6f0fd859b85e68d1_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 18149s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 3238s, expires in 3947s
    in  c7211e81,    168 bytes,     2 packets,     1s ago
    out c8ae7aa5,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Test PPK RSA STS

Description

Test the site-to-site VPN with PPK authentication and RSA

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=carol@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.032 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.032/0.032/0.032/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.033 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.033/0.033/0.033/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=dave@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id dave@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.344 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.344/0.344/0.344/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ea99775bac519fe8_i 642f6f688bc6db9d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 19652s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3308s, expires in 3960s
    in  c880daaa,     84 bytes,     1 packets,     0s ago
    out c5e88329,     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 4502fe2c81d263ff_i 0a012f0079177723_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 4s ago, rekeying in 20877s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 4s ago, rekeying in 3251s, expires in 3956s
    in  c7a02b2f,      0 bytes,     0 packets
    out c04e60c1,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.383 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.383/0.383/0.383/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.826 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.826/0.826/0.826/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ea99775bac519fe8_i 642f6f688bc6db9d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 9s ago, rekeying in 19643s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 9s ago, rekeying in 3299s, expires in 3951s
    in  c880daaa,     84 bytes,     1 packets,     9s ago
    out c5e88329,     84 bytes,     1 packets,     9s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 4502fe2c81d263ff_i 0a012f0079177723_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 20868s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 3242s, expires in 3947s
    in  c7a02b2f,    168 bytes,     2 packets,     0s ago
    out c04e60c1,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ea99775bac519fe8_i 642f6f688bc6db9d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 9s ago, rekeying in 19643s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 9s ago, rekeying in 3299s, expires in 3951s
    in  c880daaa,     84 bytes,     1 packets,     9s ago
    out c5e88329,     84 bytes,     1 packets,     9s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 4502fe2c81d263ff_i 0a012f0079177723_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 20868s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 3242s, expires in 3947s
    in  c7a02b2f,    168 bytes,     2 packets,     0s ago
    out c04e60c1,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.339 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.339/0.339/0.339/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.434 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.434/0.434/0.434/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ea99775bac519fe8_i 642f6f688bc6db9d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 10s ago, rekeying in 19642s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 10s ago, rekeying in 3298s, expires in 3950s
    in  c880daaa,    252 bytes,     3 packets,     1s ago
    out c5e88329,    252 bytes,     3 packets,     1s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 4502fe2c81d263ff_i 0a012f0079177723_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 14s ago, rekeying in 20867s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 14s ago, rekeying in 3241s, expires in 3946s
    in  c7a02b2f,    168 bytes,     2 packets,     1s ago
    out c04e60c1,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Test PPK PSK DMVPN

Description

Test the DMVPN scenario with PPK authentication and PSK

Scenario

Step 1: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set interfaces tunnel tun0 address 10.0.0.2/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.2
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX184pbZcpZe1Dalmg4RlNnI01HwWG5tugNo=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 2: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces tunnel tun0 address 10.0.0.1/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.1
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 60
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp transport-nat-support
set protocols static route 10.2.0.0/24 next-hop 10.0.0.2
set protocols static route 10.3.0.0/24 next-hop 10.0.0.3
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX18KjlOLNxMoZ0MR/j5Njj7tLD4m4tpNmKo=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 3: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.484 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.484/0.484/0.484/0.000 ms

Step 4: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.352 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.352/0.352/0.352/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set interfaces tunnel tun0 address 10.0.0.3/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.3
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk %any encrypted-secret U2FsdGVkX1+aZhlGwYXsrOAfoL4x/oyk+ix9jEJolE4=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.459 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.459/0.459/0.459/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, b9e22831032382e4_i 7572c113b9506034_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 82917s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 24454s, expires in 28800s
    in  c51c0825,    184 bytes,     2 packets,     0s ago
    out cada07a2,    204 bytes,     2 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 6fefd4b623686b8e_i b08f284a98455e3b_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 69350s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 25011s, expires in 28789s
    in  cde75017,    272 bytes,     3 packets,    11s ago
    out c7c8c5a1,    292 bytes,     3 packets,    11s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.328 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.328/0.328/0.328/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.344 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.344/0.344/0.344/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.2
Show output
IPSEC: #2, ESTABLISHED, IKEv2, b9e22831032382e4_i 7572c113b9506034_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 82917s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 24454s, expires in 28800s
    in  c51c0825,    184 bytes,     2 packets,     0s ago
    out cada07a2,    204 bytes,     2 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 6fefd4b623686b8e_i b08f284a98455e3b_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 69350s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 25011s, expires in 28789s
    in  cde75017,    448 bytes,     5 packets,     0s ago
    out c7c8c5a1,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, b9e22831032382e4_i 7572c113b9506034_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 82916s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 24453s, expires in 28799s
    in  c51c0825,    184 bytes,     2 packets,     1s ago
    out cada07a2,    204 bytes,     2 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 6fefd4b623686b8e_i b08f284a98455e3b_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 69349s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 25010s, expires in 28788s
    in  cde75017,    448 bytes,     5 packets,     1s ago
    out c7c8c5a1,    468 bytes,     5 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.300 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.300/0.300/0.300/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.308 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.308/0.308/0.308/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.3.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, b9e22831032382e4_i 7572c113b9506034_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.3' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 82916s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 24453s, expires in 28799s
    in  c51c0825,    360 bytes,     4 packets,     0s ago
    out cada07a2,    380 bytes,     4 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 6fefd4b623686b8e_i b08f284a98455e3b_r*
  local  '80.0.0.1' @ 80.0.0.1[500]
  remote '80.0.0.2' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 69349s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 25010s, expires in 28788s
    in  cde75017,    448 bytes,     5 packets,     1s ago
    out c7c8c5a1,    468 bytes,     5 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 15: Run command protocols ip show nhrp at DUT0 and expect this output:

Show output
Iface      Type     Protocol         NBMA             Claimed NBMA     Expires(s)   Flags  Identity
tun0       local    10.0.0.1         80.0.0.1         80.0.0.1         -                   -
tun0       dynamic  10.0.0.3         80.0.0.3         80.0.0.3         599          UTA    80.0.0.3
tun0       dynamic  10.0.0.2         80.0.0.2         80.0.0.2         588          UT     80.0.0.2

Test PPK RSA DMVPN

Description

Test the DMVPN scenario with PPK authentication and RSA, with same ppk on both remotes.

Scenario

Step 1: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set interfaces tunnel tun0 address 10.0.0.2/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.2
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=carol@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 2: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces tunnel tun0 address 10.0.0.1/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.1
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 60
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp transport-nat-support
set protocols static route 10.2.0.0/24 next-hop 10.0.0.2
set protocols static route 10.3.0.0/24 next-hop 10.0.0.3
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 3: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.347 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.347/0.347/0.347/0.000 ms

Step 4: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.280 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.280/0.280/0.280/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set interfaces tunnel tun0 address 10.0.0.3/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.3
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=dave@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.330 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.330/0.330/0.330/0.000 ms

Warning

“Certificates must include the IP address in the SAN field, otherwise the connection will fail.”

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 7fca00445fee21e8_i 1f3f22d2868f8e39_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 64037s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 14471s, expires in 28800s
    in  cc809df2,    184 bytes,     2 packets,     0s ago
    out c0a68929,    204 bytes,     2 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 27b61e5bc14c623f_i c18586c7a3adc31c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 80574s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 25799s, expires in 28788s
    in  c7d28a63,    368 bytes,     4 packets,    11s ago
    out ce357a9c,    292 bytes,     3 packets,    11s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.309 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.309/0.309/0.309/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.321 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.321/0.321/0.321/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.2
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 7fca00445fee21e8_i 1f3f22d2868f8e39_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 64036s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 14470s, expires in 28799s
    in  cc809df2,    184 bytes,     2 packets,     1s ago
    out c0a68929,    204 bytes,     2 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 27b61e5bc14c623f_i c18586c7a3adc31c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 80573s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 25798s, expires in 28787s
    in  c7d28a63,    544 bytes,     6 packets,     0s ago
    out ce357a9c,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 7fca00445fee21e8_i 1f3f22d2868f8e39_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 64036s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 14470s, expires in 28799s
    in  cc809df2,    184 bytes,     2 packets,     1s ago
    out c0a68929,    204 bytes,     2 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 27b61e5bc14c623f_i c18586c7a3adc31c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 80573s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 25798s, expires in 28787s
    in  c7d28a63,    544 bytes,     6 packets,     0s ago
    out ce357a9c,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.320 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.320/0.320/0.320/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.584 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.584/0.584/0.584/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.3.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 7fca00445fee21e8_i 1f3f22d2868f8e39_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 64036s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 14470s, expires in 28799s
    in  cc809df2,    360 bytes,     4 packets,     0s ago
    out c0a68929,    380 bytes,     4 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 27b61e5bc14c623f_i c18586c7a3adc31c_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 80573s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 25798s, expires in 28787s
    in  c7d28a63,    544 bytes,     6 packets,     0s ago
    out ce357a9c,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]