X509
These scenarios show how to establish a VPN IPsec site-to-site connection between two end-points using X.509 certificates.
Test Local And Remote Auth With X509 Files
Description
In this scenario, both devices use pre-installed X.509 certificate files for local and remote authentication.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut2.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut2.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.618 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.618/0.618/0.618/0.000 ms
Step 4: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut0.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut0.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 5: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.412 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.412/0.412/0.412/0.000 ms
Step 6: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.734 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.734/0.734/0.734/0.000 ms
Step 7: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.603 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.603/0.603/0.603/0.000 ms
Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, d9a18a11f062f55b_i* fe8f02f223f5336d_r local 'C=ES, O=Teldat, CN=DUT0' @ 8.0.0.2[500] remote 'C=ES, O=Teldat, CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 2s ago, rekeying in 16898s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 2s ago, rekeying in 18153s, expires in 28798s in c63cd6bc, 168 bytes, 2 packets, 0s ago out cc103079, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24
Test Local Auth With SCEP And Remote Auth With X509 Files
Description
In this scenario, DUT0 uses SCEP for local authentication, while the remote peer is authenticated using X.509 certificate files.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT2 set system certificate scep csr CSR encrypted-password U2FsdGVkX1+vJ7QXkeLU4P5d5k38GkXyuL+Buyojs1E= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut2.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut2.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.465 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.465/0.465/0.465/0.000 ms
Step 4: Run command pki scep show CSR at DUT2 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - Jan 27 10:26:46 2026 GMT Jan 27 10:26:46 2027 GMT
Step 5: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT0 set system certificate scep csr CSR encrypted-password U2FsdGVkX19iP/LSWoY9kT082WKGk/MpDySJHb8mCpA= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 6: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.524 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.524/0.524/0.524/0.000 ms
Step 7: Run command pki scep show CSR at DUT0 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - Jan 27 10:27:26 2026 GMT Jan 27 10:27:26 2027 GMT
Step 8: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.830 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.830/0.830/0.830/0.000 ms
Step 9: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.526 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.526/0.526/0.526/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 304283b33a1c9741_i* 2a4e27610f486e32_r local 'CN=DUT0' @ 8.0.0.2[500] remote 'C=ES, O=Teldat, CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 2s ago, rekeying in 21320s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 2s ago, rekeying in 22257s, expires in 28798s in cb526f3d, 168 bytes, 2 packets, 0s ago out c093f4ab, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24
Test Local Auth With X509 Files And Remote Auth With SCEP
Description
In this scenario, DUT0 uses SCEP for remote authentication, while local authentication relies on X.509 certificate files.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT2 set system certificate scep csr CSR encrypted-password U2FsdGVkX1+LDs3tI46UP5SnUCy6X/MR/9S+VWSGPmI= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.336 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.336/0.336/0.336/0.000 ms
Step 4: Run command pki scep show CSR at DUT2 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - Jan 27 10:28:14 2026 GMT Jan 27 10:28:14 2027 GMT
Step 5: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT0 set system certificate scep csr CSR encrypted-password U2FsdGVkX1+FP/ZNxOozvtxq1XcObHiN0xGJzgTDcZY= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut0.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut0.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 6: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.460 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.460/0.460/0.460/0.000 ms
Step 7: Run command pki scep show CSR at DUT0 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - Jan 27 10:28:55 2026 GMT Jan 27 10:28:55 2027 GMT
Step 8: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.511 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.511/0.511/0.511/0.000 ms
Step 9: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.481 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.481/0.481/0.481/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 9a2f594484738ad8_i* a5e532cf5b633620_r local 'C=ES, O=Teldat, CN=DUT0' @ 8.0.0.2[500] remote 'CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 2s ago, rekeying in 22222s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 2s ago, rekeying in 18357s, expires in 28798s in c6a11450, 168 bytes, 2 packets, 0s ago out c76a62f8, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24
Test Local And Remote Auth With SCEP
Description
In this scenario, both devices use SCEP for local and remote authentication.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT2 set system certificate scep csr CSR encrypted-password U2FsdGVkX1/vDRewc/Igoh3reZ5Dqv5JzhboMg7+YPw= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.392 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.392/0.392/0.392/0.000 ms
Step 4: Run command pki scep show CSR at DUT2 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - Jan 27 10:29:42 2026 GMT Jan 27 10:29:42 2027 GMT
Step 5: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT0 set system certificate scep csr CSR encrypted-password U2FsdGVkX198Q6wX+DfoXgEJWqB5m598pXisOLCJwVQ= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 6: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.430 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.430/0.430/0.430/0.000 ms
Step 7: Run command pki scep show CSR at DUT0 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - Jan 27 10:30:20 2026 GMT Jan 27 10:30:20 2027 GMT
Step 8: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.498 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.498/0.498/0.498/0.000 ms
Step 9: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.426 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.426/0.426/0.426/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 9f12fb4cddaca955_i* cfbb4639302f6bcb_r local 'CN=DUT0' @ 8.0.0.2[500] remote 'CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 2s ago, rekeying in 14503s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 2s ago, rekeying in 19255s, expires in 28798s in cc956147, 168 bytes, 2 packets, 0s ago out cc8915c3, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24