Ppk

This set of tests shows how to configure and connect more than two subnets with each other through a VPN tunnel using PPK authentication in different ways.

../../../../_images/ppk.svg

Test PPK Options

Description

In this test, we will check the different options for PPK authentication (i.e., when it is required or not, when it remains unmatched, etc.).

Scenario

Note

Set default configuration for both DUTs, where PPK is not required and the PPK is the same.

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX180CnYWLkkWJFNqRrQ014GZIBkz8sy8+38=
set vpn ipsec auth-profile AUTH-SA global-secrets eap dave encrypted-secret U2FsdGVkX1/PKzTH1BxT/eBH7onA474tHrWUbmS9WwI=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth eap %any type ttls
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX1/doGyu1AmxOqO45bMZbruKlQFA9fPxMkE=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth eap carol type ttls
set vpn ipsec auth-profile AUTH-SA local id carol
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.022 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.022/0.022/0.022/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.029 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.029/0.029/0.029/0.000 ms

Step 5: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, fe970531e6f5402b_i 88a749d20218c6af_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 27375s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3524s, expires in 3960s
    in  c521cac3,      0 bytes,     0 packets
    out c82af47b,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 6: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.326 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.326/0.326/0.326/0.000 ms

Step 7: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.676 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.676/0.676/0.676/0.000 ms

Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, fe970531e6f5402b_i 88a749d20218c6af_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 27374s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3523s, expires in 3959s
    in  c521cac3,    168 bytes,     2 packets,     0s ago
    out c82af47b,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Note

Delete the PPK from DUT0 and check that the SA falls back to standard authentication.

Step 9: Modify the following configuration lines in DUT0 :

delete vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org

Step 10: Run command vpn ipsec clear peer PEER at DUT0 and expect this output:

Show output
[IKE] deleting IKE_SA vpn-peer-PEER[1] between 80.0.0.1[CN=moon.teldat.org]...80.0.0.2[carol]
[IKE] sending DELETE for IKE_SA vpn-peer-PEER[1]
[ENC] generating INFORMATIONAL request 0 [ D ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (57 bytes)
[ENC] parsed INFORMATIONAL response 0 [ ]
[IKE] IKE_SA deleted
terminate completed successfully
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (120 bytes)
[ENC] parsed IKE_AUTH request 5 [ EAP/RES/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/RES/ID]
[IKE] received EAP identity 'carol'
[IKE] phase2 method EAP_MD5 selected
[IKE] sending tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[ENC] generating IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (132 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (132 bytes)
[ENC] parsed IKE_AUTH request 6 [ EAP/RES/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/RES/MD5]
[IKE] EAP_TTLS phase2 authentication of 'carol' with EAP_MD5 successful
[IKE] EAP method EAP_TTLS succeeded, MSK established
[ENC] generating IKE_AUTH response 6 [ EAP/SUCC ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (162 bytes)
[ENC] parsed IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[CFG] no PPK for 'carol@teldat.org' found, ignored because PPK is not required
[IKE] no PPK available, using NO_PPK_AUTH notify
[IKE] authentication of 'carol' with EAP successful
[IKE] authentication of 'CN=moon.teldat.org' (myself) with EAP
[IKE] IKE_SA vpn-peer-PEER[2] established between 80.0.0.1[CN=moon.teldat.org]...80.0.0.2[carol]
[IKE] scheduling rekeying in 25589s
[IKE] maximum IKE_SA lifetime 25589s
[CFG] selected proposal: ESP:AES_GCM_16_256/NO_EXT_SEQ
[IKE] CHILD_SA peer-PEER-tunnel-1{2} established with SPIs cecb90a2_i c41782e7_o and TS 10.1.0.0/24 === 10.2.0.0/24
initiate completed successfully

Step 11: Run command vpn ipsec clear peer PEER at DUT1 and expect this output:

Show output
[IKE] deleting IKE_SA vpn-peer-PEER[2] between 80.0.0.2[carol]...80.0.0.1[CN=moon.teldat.org]
[IKE] sending DELETE for IKE_SA vpn-peer-PEER[2]
[ENC] generating INFORMATIONAL request 8 [ D ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (65 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (57 bytes)
[ENC] parsed INFORMATIONAL response 8 [ ]
[IKE] IKE_SA deleted
terminate completed successfully
[IKE] initiating IKE_SA vpn-peer-PEER[3] to 80.0.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) N(USE_PPK) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (272 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (305 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(USE_PPK) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/ECP_256
[IKE] received cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] sending cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] establishing CHILD_SA peer-PEER-tunnel-1{3}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (247 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1252 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (246 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1433 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/TTLS ]
[IKE] received end entity cert "CN=moon.teldat.org"
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[IKE] authentication of 'CN=moon.teldat.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_TTLS authentication (id 0x18)
[TLS] EAP_TTLS version is v0
[ENC] generating IKE_AUTH request 2 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (279 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1085 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/TTLS ]
[ENC] generating IKE_AUTH request 3 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (67 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (540 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/TTLS ]
[TLS] negotiated TLS 1.2 using suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[TLS] received TLS server certificate 'CN=moon.teldat.org'
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[ENC] generating IKE_AUTH request 4 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (229 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (122 bytes)
[ENC] parsed IKE_AUTH response 4 [ EAP/REQ/TTLS ]
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/ID]
[ENC] generating IKE_AUTH request 5 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (120 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (132 bytes)
[ENC] parsed IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[IKE] server requested EAP_MD5 authentication (id 0xE7)
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/MD5]
[ENC] generating IKE_AUTH request 6 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (132 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 6 [ EAP/SUCC ]
[IKE] EAP method EAP_TTLS succeeded, MSK established
[IKE] authentication of 'carol' (myself) with EAP
[ENC] generating IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (162 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (181 bytes)
[ENC] parsed IKE_AUTH response 7 [ AUTH SA TSi TSr ]
[IKE] authentication of 'CN=moon.teldat.org' with EAP successful
[CFG] peer didn't use PPK for PPK_ID 'carol@teldat.org'
[IKE] IKE_SA vpn-peer-PEER[3] established between 80.0.0.2[carol]...80.0.0.1[CN=moon.teldat.org]
[IKE] scheduling rekeying in 21952s
[IKE] maximum IKE_SA lifetime 21952s
[CFG] selected proposal: ESP:AES_GCM_16_256/NO_EXT_SEQ
[IKE] CHILD_SA peer-PEER-tunnel-1{3} established with SPIs c376f1b6_i cf004264_o and TS 10.2.0.0/24 === 10.1.0.0/24
initiate completed successfully

Step 12: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #3, ESTABLISHED, IKEv2, 014a7728f4cbb580_i abde8a8f4d06290e_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 0s ago, rekeying in 18901s
  peer-PEER-tunnel-1: #3, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3403s, expires in 3960s
    in  cf004264,      0 bytes,     0 packets
    out c376f1b6,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 13: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.333 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.333/0.333/0.333/0.000 ms

Step 14: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.757 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.757/0.757/0.757/0.000 ms

Step 15: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #3, ESTABLISHED, IKEv2, 014a7728f4cbb580_i abde8a8f4d06290e_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256
  established 0s ago, rekeying in 18901s
  peer-PEER-tunnel-1: #3, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3403s, expires in 3960s
    in  cf004264,    168 bytes,     2 packets,     0s ago
    out c376f1b6,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Note

Set the PPK as required in DUT0 and, with DUT1’s corresponding PPK deleted, check that the connection fails.

Step 16: Modify the following configuration lines in DUT0 :

set vpn ipsec auth-profile AUTH-SA remote ppk required

Step 17: Run command vpn ipsec clear peer PEER at DUT0 and expect this output:

Show output
[IKE] deleting IKE_SA vpn-peer-PEER[3] between 80.0.0.1[CN=moon.teldat.org]...80.0.0.2[carol]
[IKE] sending DELETE for IKE_SA vpn-peer-PEER[3]
[ENC] generating INFORMATIONAL request 0 [ D ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (57 bytes)
[ENC] parsed INFORMATIONAL response 0 [ ]
[IKE] IKE_SA deleted
terminate completed successfully
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (120 bytes)
[ENC] parsed IKE_AUTH request 5 [ EAP/RES/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/RES/ID]
[IKE] received EAP identity 'carol'
[IKE] phase2 method EAP_MD5 selected
[IKE] sending tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[ENC] generating IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (132 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (132 bytes)
[ENC] parsed IKE_AUTH request 6 [ EAP/RES/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/RES/MD5]
[IKE] EAP_TTLS phase2 authentication of 'carol' with EAP_MD5 successful
[IKE] EAP method EAP_TTLS succeeded, MSK established
[ENC] generating IKE_AUTH response 6 [ EAP/SUCC ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
[NET] received packet: from 80.0.0.2[500](0) to 80.0.0.1[500](2) (162 bytes)
[ENC] parsed IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[CFG] PPK required but no PPK found for 'carol@teldat.org'
[ENC] generating IKE_AUTH response 7 [ N(AUTH_FAILED) ]
[NET] sending packet: from 80.0.0.1[500](2) to 80.0.0.2[500](0) (65 bytes)
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 18: Run command vpn ipsec clear peer PEER at DUT1 and expect this output:

Show output
terminate failed: no matching SAs to terminate found
[IKE] initiating IKE_SA vpn-peer-PEER[5] to 80.0.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) N(USE_PPK) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (272 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (305 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(USE_PPK) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/ECP_256
[IKE] received cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] sending cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] establishing CHILD_SA peer-PEER-tunnel-1{5}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (247 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1252 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (246 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1433 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/TTLS ]
[IKE] received end entity cert "CN=moon.teldat.org"
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[IKE] authentication of 'CN=moon.teldat.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_TTLS authentication (id 0xF0)
[TLS] EAP_TTLS version is v0
[ENC] generating IKE_AUTH request 2 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (279 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1085 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/TTLS ]
[ENC] generating IKE_AUTH request 3 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (67 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (540 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/TTLS ]
[TLS] negotiated TLS 1.2 using suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[TLS] received TLS server certificate 'CN=moon.teldat.org'
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[ENC] generating IKE_AUTH request 4 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (229 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (122 bytes)
[ENC] parsed IKE_AUTH response 4 [ EAP/REQ/TTLS ]
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/ID]
[ENC] generating IKE_AUTH request 5 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (120 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (132 bytes)
[ENC] parsed IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[IKE] server requested EAP_MD5 authentication (id 0x79)
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/MD5]
[ENC] generating IKE_AUTH request 6 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (132 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 6 [ EAP/SUCC ]
[IKE] EAP method EAP_TTLS succeeded, MSK established
[IKE] authentication of 'carol' (myself) with EAP
[ENC] generating IKE_AUTH request 7 [ AUTH N(NO_PPK) N(PPK_ID) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (162 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 7 [ N(AUTH_FAILED) ]
[IKE] received AUTHENTICATION_FAILED notify error
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 19: Expect a failure in the following command: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Note

Set the PPK as required in DUT1 and change the PPK in DUT0 back to not required. Check that the connection is still failing.

Step 20: Modify the following configuration lines in DUT0 :

delete vpn ipsec auth-profile AUTH-SA remote ppk required

Step 21: Modify the following configuration lines in DUT1 :

set vpn ipsec auth-profile AUTH-SA local ppk required

Step 22: Run command vpn ipsec clear peer PEER at DUT0 and expect this output:

Show output
terminate failed: no matching SAs to terminate found
[IKE] unable to resolve %any, initiate aborted
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 23: Run command vpn ipsec clear peer PEER at DUT1 and expect this output:

Show output
terminate failed: no matching SAs to terminate found
[IKE] initiating IKE_SA vpn-peer-PEER[7] to 80.0.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) N(USE_PPK) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (272 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (305 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(USE_PPK) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_GCM_16_256/PRF_HMAC_SHA2_256/ECP_256
[IKE] received cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] sending cert request for "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[IKE] establishing CHILD_SA peer-PEER-tunnel-1{7}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (247 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1252 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (246 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1433 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/TTLS ]
[IKE] received end entity cert "CN=moon.teldat.org"
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[IKE] authentication of 'CN=moon.teldat.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_TTLS authentication (id 0x73)
[TLS] EAP_TTLS version is v0
[ENC] generating IKE_AUTH request 2 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (279 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (1085 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/TTLS ]
[ENC] generating IKE_AUTH request 3 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (67 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (540 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/TTLS ]
[TLS] negotiated TLS 1.2 using suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
[TLS] received TLS server certificate 'CN=moon.teldat.org'
[CFG]   using certificate "CN=moon.teldat.org"
[CFG]   using trusted ca certificate "C=ES, ST=Madrid, L=Tres Cantos, O=Teldat S.A., OU=RD, CN=Teldat Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "CN=moon.teldat.org"
[CFG] certificate status is not available
[ENC] generating IKE_AUTH request 4 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (229 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (122 bytes)
[ENC] parsed IKE_AUTH response 4 [ EAP/REQ/TTLS ]
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/ID]
[ENC] generating IKE_AUTH request 5 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (120 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (132 bytes)
[ENC] parsed IKE_AUTH response 5 [ EAP/REQ/TTLS ]
[IKE] received tunneled EAP-TTLS AVP [EAP/REQ/MD5]
[IKE] server requested EAP_MD5 authentication (id 0x02)
[IKE] sending tunneled EAP-TTLS AVP [EAP/RES/MD5]
[ENC] generating IKE_AUTH request 6 [ EAP/RES/TTLS ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (132 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 6 [ EAP/SUCC ]
[IKE] EAP method EAP_TTLS succeeded, MSK established
[IKE] authentication of 'carol' (myself) with EAP
[ENC] generating IKE_AUTH request 7 [ AUTH N(PPK_ID) ]
[NET] sending packet: from 80.0.0.2[500](0) to 80.0.0.1[500](0) (122 bytes)
[NET] received packet: from 80.0.0.1[500](0) to 80.0.0.2[500](2) (65 bytes)
[ENC] parsed IKE_AUTH response 7 [ N(AUTH_FAILED) ]
[IKE] received AUTHENTICATION_FAILED notify error
initiate failed: establishing CHILD_SA 'peer-PEER-tunnel-1' failed

Step 24: Expect a failure in the following command: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Test PPK EAP-TTLS STS

Description

Test the site-to-site VPN with PPK authentication and EAP-TTLS

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX1+4rtSRWTkFyItiCSIdfhcEBb7T+lAxtJw=
set vpn ipsec auth-profile AUTH-SA global-secrets eap dave encrypted-secret U2FsdGVkX19D/udXBkxn2mQ+uOxkojhJKUNI+5YnW7I=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth eap %any type ttls
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap carol encrypted-secret U2FsdGVkX180W4CNqeblGnYH7Pdr58l3A9XKYemndng=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth eap carol type ttls
set vpn ipsec auth-profile AUTH-SA local id carol
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.023 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.023/0.023/0.023/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.028 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.028/0.028/0.028/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets eap dave encrypted-secret U2FsdGVkX195sScyb9HrGasEw+vjMDtgoZeunhw9mGQ=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth eap dave type ttls
set vpn ipsec auth-profile AUTH-SA local id dave
set vpn ipsec auth-profile AUTH-SA local ppk id dave@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.301 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.301/0.301/0.301/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, b23bf6d468d41f09_i d75b5e60faaccafd_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 3s ago, rekeying in 26832s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 3s ago, rekeying in 3307s, expires in 3957s
    in  c2874426,      0 bytes,     0 packets
    out cb54b936,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 52b3c1a28ac1eca9_i 0a0ff855b812c960_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 23514s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3395s, expires in 3960s
    in  c534225c,     84 bytes,     1 packets,     0s ago
    out c1cd34b8,     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.383 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.383/0.383/0.383/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.318 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.318/0.318/0.318/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, b23bf6d468d41f09_i d75b5e60faaccafd_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 4s ago, rekeying in 26831s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 4s ago, rekeying in 3306s, expires in 3956s
    in  c2874426,    168 bytes,     2 packets,     0s ago
    out cb54b936,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 52b3c1a28ac1eca9_i 0a0ff855b812c960_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 23513s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3394s, expires in 3959s
    in  c534225c,     84 bytes,     1 packets,     1s ago
    out c1cd34b8,     84 bytes,     1 packets,     1s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, b23bf6d468d41f09_i d75b5e60faaccafd_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 4s ago, rekeying in 26831s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 4s ago, rekeying in 3306s, expires in 3956s
    in  c2874426,    168 bytes,     2 packets,     0s ago
    out cb54b936,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 52b3c1a28ac1eca9_i 0a0ff855b812c960_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 23513s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 3394s, expires in 3959s
    in  c534225c,     84 bytes,     1 packets,     1s ago
    out c1cd34b8,     84 bytes,     1 packets,     1s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.400 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.400/0.400/0.400/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.593 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.593/0.593/0.593/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, b23bf6d468d41f09_i d75b5e60faaccafd_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'carol' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 10s ago, rekeying in 26825s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 10s ago, rekeying in 3300s, expires in 3950s
    in  c2874426,    168 bytes,     2 packets,     6s ago
    out cb54b936,    168 bytes,     2 packets,     6s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 52b3c1a28ac1eca9_i 0a0ff855b812c960_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'dave' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 7s ago, rekeying in 23507s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 7s ago, rekeying in 3388s, expires in 3953s
    in  c534225c,    252 bytes,     3 packets,     1s ago
    out c1cd34b8,    252 bytes,     3 packets,     1s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24

Test PPK PSK STS

Description

Test the site-to-site VPN with PPK authentication and PSK

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk test encrypted-secret U2FsdGVkX19wHvpQXSDmWMBB0QDXc+DwTJBYqp6MQ5M=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id test
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk test encrypted-secret U2FsdGVkX18a+Z7ZpMqVz09oQ6aPMYXfgMbP3L69rQI=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id test
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.023 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.023/0.023/0.023/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.026 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.026/0.026/0.026/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk test encrypted-secret U2FsdGVkX19II52bZmb6ufE9bhtETWNti8jfj6CX5Mo=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id test
set vpn ipsec auth-profile AUTH-SA local ppk id dave@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.349 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.349/0.349/0.349/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 62b75beda41057e7_i d7b43f6e3be6040a_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 28205s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3310s, expires in 3960s
    in  c987b5df,     84 bytes,     1 packets,     0s ago
    out ca3210c0,     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, ff61c5df13820dd4_i 4d3ffa5c78f138bd_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 3s ago, rekeying in 19163s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 3s ago, rekeying in 3400s, expires in 3957s
    in  c98233d1,      0 bytes,     0 packets
    out c5173acf,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.283 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.283/0.283/0.283/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.302 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.302/0.302/0.302/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 62b75beda41057e7_i d7b43f6e3be6040a_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 28197s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3302s, expires in 3952s
    in  c987b5df,     84 bytes,     1 packets,     8s ago
    out ca3210c0,     84 bytes,     1 packets,     8s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, ff61c5df13820dd4_i 4d3ffa5c78f138bd_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 19155s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 3392s, expires in 3949s
    in  c98233d1,    168 bytes,     2 packets,     0s ago
    out c5173acf,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 62b75beda41057e7_i d7b43f6e3be6040a_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 28197s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3302s, expires in 3952s
    in  c987b5df,     84 bytes,     1 packets,     8s ago
    out ca3210c0,     84 bytes,     1 packets,     8s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, ff61c5df13820dd4_i 4d3ffa5c78f138bd_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 19155s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 3392s, expires in 3949s
    in  c98233d1,    168 bytes,     2 packets,     0s ago
    out c5173acf,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.295 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.295/0.295/0.295/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.343 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.343/0.343/0.343/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, 62b75beda41057e7_i d7b43f6e3be6040a_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 9s ago, rekeying in 28196s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 9s ago, rekeying in 3301s, expires in 3951s
    in  c987b5df,    252 bytes,     3 packets,     0s ago
    out ca3210c0,    252 bytes,     3 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, ff61c5df13820dd4_i 4d3ffa5c78f138bd_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 19154s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 3391s, expires in 3948s
    in  c98233d1,    168 bytes,     2 packets,     1s ago
    out c5173acf,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Test PPK RSA STS

Description

Test the site-to-site VPN with PPK authentication and RSA

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set protocols static route 10.2.0.0/24 interface dum0
set protocols static route 10.3.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type respond
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.1.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0

Step 2: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set protocols static route 10.1.0.0/24 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=carol@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.2
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.2.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 3: Ping IP address 80.0.0.2 from DUT1:

admin@DUT1$ ping 80.0.0.2 count 1 size 56 timeout 1
Show output
PING 80.0.0.2 (80.0.0.2) 56(84) bytes of data.
64 bytes from 80.0.0.2: icmp_seq=1 ttl=64 time=0.033 ms

--- 80.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.033/0.033/0.033/0.000 ms

Step 4: Ping IP address 80.0.0.1 from DUT0:

admin@DUT0$ ping 80.0.0.1 count 1 size 56 timeout 1
Show output
PING 80.0.0.1 (80.0.0.1) 56(84) bytes of data.
64 bytes from 80.0.0.1: icmp_seq=1 ttl=64 time=0.030 ms

--- 80.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.030/0.030/0.030/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set protocols static route 0.0.0.0/0 interface dum0
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=dave@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id dave@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec esp-group CHILD-SA mode tunnel
set vpn ipsec esp-group CHILD-SA proposal 1 encryption aes256gcm128
set vpn ipsec esp-group CHILD-SA proposal 1 pfs dh-group19
set vpn ipsec ike-group IKE-SA key-exchange ikev2
set vpn ipsec ike-group IKE-SA proposal 1 dh-group 19
set vpn ipsec ike-group IKE-SA proposal 1 encryption aes256gcm128
set vpn ipsec ike-group IKE-SA proposal 1 hash sha256
set vpn ipsec logging log-types any log-level 1
set vpn ipsec site-to-site peer PEER auth-profile AUTH-SA
set vpn ipsec site-to-site peer PEER connection-type initiate
set vpn ipsec site-to-site peer PEER default-esp-group CHILD-SA
set vpn ipsec site-to-site peer PEER ike-group IKE-SA
set vpn ipsec site-to-site peer PEER local-address 80.0.0.3
set vpn ipsec site-to-site peer PEER remote-address 80.0.0.1
set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 10.3.0.0/24
set vpn ipsec site-to-site peer PEER tunnel 1 local-interface dum0
set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 10.1.0.0/24

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.346 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.346/0.346/0.346/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ef8956becaa1b8de_i 0a64b577229666b1_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 0s ago, rekeying in 27701s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 0s ago, rekeying in 3313s, expires in 3960s
    in  c86dfa08,     84 bytes,     1 packets,     0s ago
    out c366307d,     84 bytes,     1 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 5439043b91437476_i 2e3f0de66c96c530_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 4s ago, rekeying in 15708s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 4s ago, rekeying in 3405s, expires in 3956s
    in  cc96a603,      0 bytes,     0 packets
    out c80a49b0,      0 bytes,     0 packets
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.284 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.284/0.284/0.284/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.271 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.271/0.271/0.271/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.2.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ef8956becaa1b8de_i 0a64b577229666b1_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 7s ago, rekeying in 27694s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 7s ago, rekeying in 3306s, expires in 3953s
    in  c86dfa08,     84 bytes,     1 packets,     7s ago
    out c366307d,     84 bytes,     1 packets,     7s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 5439043b91437476_i 2e3f0de66c96c530_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 15701s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 3398s, expires in 3949s
    in  cc96a603,    168 bytes,     2 packets,     0s ago
    out c80a49b0,    168 bytes,     2 packets,     0s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ef8956becaa1b8de_i 0a64b577229666b1_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 27693s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3305s, expires in 3952s
    in  c86dfa08,     84 bytes,     1 packets,     8s ago
    out c366307d,     84 bytes,     1 packets,     8s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 5439043b91437476_i 2e3f0de66c96c530_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 15700s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 3397s, expires in 3948s
    in  cc96a603,    168 bytes,     2 packets,     1s ago
    out c80a49b0,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.299 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.299/0.299/0.299/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.275 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.275/0.275/0.275/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+10.3.0.*
Show output
vpn-peer-PEER: #2, ESTABLISHED, IKEv2, ef8956becaa1b8de_i 0a64b577229666b1_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 8s ago, rekeying in 27693s
  peer-PEER-tunnel-1: #2, reqid 2, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 8s ago, rekeying in 3305s, expires in 3952s
    in  c86dfa08,    252 bytes,     3 packets,     0s ago
    out c366307d,    252 bytes,     3 packets,     0s ago
    local  10.1.0.0/24
    remote 10.3.0.0/24
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 5439043b91437476_i 2e3f0de66c96c530_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 15700s
  peer-PEER-tunnel-1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 3397s, expires in 3948s
    in  cc96a603,    168 bytes,     2 packets,     1s ago
    out c80a49b0,    168 bytes,     2 packets,     1s ago
    local  10.1.0.0/24
    remote 10.2.0.0/24

Test PPK PSK DMVPN

Description

Test the DMVPN scenario with PPK authentication and PSK

Scenario

Step 1: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set interfaces tunnel tun0 address 10.0.0.2/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.2
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk test encrypted-secret U2FsdGVkX1/izYPFQrJMqrcWdqDivN5Frk5/XfUw8LQ=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id test
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 2: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces tunnel tun0 address 10.0.0.1/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.1
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 60
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp transport-nat-support
set protocols static route 10.2.0.0/24 next-hop 10.0.0.2
set protocols static route 10.3.0.0/24 next-hop 10.0.0.3
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk test encrypted-secret U2FsdGVkX1926V3FFpRh9R8m5ejxg4uy04IpL3ITxA0=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id test
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 3: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.396 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.396/0.396/0.396/0.000 ms

Step 4: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.340 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.340/0.340/0.340/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set interfaces tunnel tun0 address 10.0.0.3/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.3
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ike-psk test encrypted-secret U2FsdGVkX18cHfNAKn3CpeliU/LuHrlq8eoni9WUWjc=
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local auth ike-psk id test
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote auth ike-psk id %any
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.299 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.299/0.299/0.299/0.000 ms

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 75871c834a3ecf0d_i 537957c19cc85f46_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 79678s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 21408s, expires in 28799s
    in  ce569a92,    184 bytes,     2 packets,     0s ago
    out c3b3f4c8,    204 bytes,     2 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 47e8e241297977ba_i 5850fd8e126faf76_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 80919s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 15046s, expires in 28789s
    in  c9392160,    272 bytes,     3 packets,    10s ago
    out c1acf5d3,    292 bytes,     3 packets,    10s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.371 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.371/0.371/0.371/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.400 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.400/0.400/0.400/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.2
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 75871c834a3ecf0d_i 537957c19cc85f46_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 79678s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 21408s, expires in 28799s
    in  ce569a92,    184 bytes,     2 packets,     0s ago
    out c3b3f4c8,    204 bytes,     2 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 47e8e241297977ba_i 5850fd8e126faf76_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 80919s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 15046s, expires in 28789s
    in  c9392160,    448 bytes,     5 packets,     0s ago
    out c1acf5d3,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 75871c834a3ecf0d_i 537957c19cc85f46_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 79678s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 21408s, expires in 28799s
    in  ce569a92,    184 bytes,     2 packets,     0s ago
    out c3b3f4c8,    204 bytes,     2 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 47e8e241297977ba_i 5850fd8e126faf76_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 80919s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 15046s, expires in 28789s
    in  c9392160,    448 bytes,     5 packets,     0s ago
    out c1acf5d3,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.338 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.338/0.338/0.338/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.645 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.645/0.645/0.645/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.3.*
Show output
IPSEC: #2, ESTABLISHED, IKEv2, 75871c834a3ecf0d_i 537957c19cc85f46_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 79678s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 21408s, expires in 28799s
    in  ce569a92,    360 bytes,     4 packets,     1s ago
    out c3b3f4c8,    380 bytes,     4 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #1, ESTABLISHED, IKEv2, 47e8e241297977ba_i 5850fd8e126faf76_r*
  local  'test' @ 80.0.0.1[500]
  remote 'test' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 11s ago, rekeying in 80919s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 11s ago, rekeying in 15046s, expires in 28789s
    in  c9392160,    448 bytes,     5 packets,     0s ago
    out c1acf5d3,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 15: Run command protocols ip show nhrp at DUT0 and expect this output:

Show output
Iface      Type     Protocol         NBMA             Claimed NBMA     Expires(s)   Flags  Identity
tun0       local    10.0.0.1         80.0.0.1         80.0.0.1         -                   -
tun0       dynamic  10.0.0.3         80.0.0.3         80.0.0.3         599          UTA    test
tun0       dynamic  10.0.0.2         80.0.0.2         80.0.0.2         589          UT     test

Test PPK RSA DMVPN

Description

Test the DMVPN scenario with PPK authentication and RSA, with same ppk on both remotes.

Scenario

Step 1: Set the following configuration in DUT1 :

set interfaces dummy dum0 address 10.2.0.1/24
set interfaces ethernet eth0 address 80.0.0.2/24
set interfaces tunnel tun0 address 10.0.0.2/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.2
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=carol@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 2: Set the following configuration in DUT0 :

set interfaces dummy dum0 address 10.1.0.1/24
set interfaces ethernet eth0 address 80.0.0.1/24
set interfaces tunnel tun0 address 10.0.0.1/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.1
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 60
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp transport-nat-support
set protocols static route 10.2.0.0/24 next-hop 10.0.0.2
set protocols static route 10.3.0.0/24 next-hop 10.0.0.3
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk dave@teldat.org file 'running://ppk_dave.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://server.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=moon.teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://server.priv.pem'
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote ppk id '*@teldat.org'
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 3: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.376 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.376/0.376/0.376/0.000 ms

Step 4: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.694 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.694/0.694/0.694/0.000 ms

Step 5: Set the following configuration in DUT2 :

set interfaces dummy dum0 address 10.3.0.1/24
set interfaces ethernet eth0 address 80.0.0.3/24
set interfaces tunnel tun0 address 10.0.0.3/32
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 local-address 80.0.0.3
set interfaces tunnel tun0 local-interface eth0
set interfaces tunnel tun0 mtu 1390
set interfaces tunnel tun0 nhrp holdtime 600
set interfaces tunnel tun0 nhrp ipsec IPSEC
set interfaces tunnel tun0 nhrp nhs 10.0.0.1 nbma 80.0.0.1
set protocols static route 10.1.0.0/24 next-hop 10.0.0.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set vpn ipsec auth-profile AUTH-SA global-secrets ppk carol@teldat.org file 'running://ppk_carol.key'
set vpn ipsec auth-profile AUTH-SA local ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA local cert-file 'running://client.crt'
set vpn ipsec auth-profile AUTH-SA local id CN=dave@teldat.org
set vpn ipsec auth-profile AUTH-SA local key file 'running://client.priv.pem'
set vpn ipsec auth-profile AUTH-SA local ppk id carol@teldat.org
set vpn ipsec auth-profile AUTH-SA mirror-config false
set vpn ipsec auth-profile AUTH-SA remote ca-cert-file 'running://ca.crt'
set vpn ipsec auth-profile AUTH-SA remote id CN=moon.teldat.org
set vpn ipsec dmvpn-profile IPSEC auth-profile AUTH-SA
set vpn ipsec dmvpn-profile IPSEC esp-group ESP-GROUP
set vpn ipsec dmvpn-profile IPSEC ike-group IKE-GROUP
set vpn ipsec esp-group ESP-GROUP lifetime 28800
set vpn ipsec esp-group ESP-GROUP mode transport
set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
set vpn ipsec esp-group ESP-GROUP proposal 10 pfs dh-group19
set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
set vpn ipsec ike-group IKE-GROUP lifetime 86400
set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 19
set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes256gcm128
set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha256
set vpn ipsec logging log-types any log-level 1

Step 6: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.294 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.294/0.294/0.294/0.000 ms

Warning

“Certificates must include the IP address in the SAN field, otherwise the connection will fail.”

Step 7: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #3, ESTABLISHED, IKEv2, b544cfbe77a4a912_i 456581b39d0ac469_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 80152s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 15661s, expires in 28799s
    in  c3f1a1a8,    184 bytes,     2 packets,     1s ago
    out c02b339e,    204 bytes,     2 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #2, ESTABLISHED, IKEv2, 7cf9d3d893e164b4_i a817474eb24f819d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 82158s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 15636s, expires in 28788s
    in  c95a926b,    272 bytes,     3 packets,    11s ago
    out c2ad16fe,    292 bytes,     3 packets,    11s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 8: Ping IP address 10.2.0.1 from DUT0:

admin@DUT0$ ping 10.2.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.2.0.1 (10.2.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=0.314 ms

--- 10.2.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.314/0.314/0.314/0.000 ms

Step 9: Ping IP address 10.1.0.1 from DUT1:

admin@DUT1$ ping 10.1.0.1 local-address 10.2.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.2.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.663 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.663/0.663/0.663/0.000 ms

Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.2
Show output
IPSEC: #3, ESTABLISHED, IKEv2, b544cfbe77a4a912_i 456581b39d0ac469_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 80152s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 15661s, expires in 28799s
    in  c3f1a1a8,    184 bytes,     2 packets,     1s ago
    out c02b339e,    204 bytes,     2 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #2, ESTABLISHED, IKEv2, 7cf9d3d893e164b4_i a817474eb24f819d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 82158s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 15636s, expires in 28788s
    in  c95a926b,    448 bytes,     5 packets,     0s ago
    out c2ad16fe,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 11: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*\s+.*remote\s+80.0.0.*
Show output
IPSEC: #3, ESTABLISHED, IKEv2, b544cfbe77a4a912_i 456581b39d0ac469_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 1s ago, rekeying in 80152s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 1s ago, rekeying in 15661s, expires in 28799s
    in  c3f1a1a8,    184 bytes,     2 packets,     1s ago
    out c02b339e,    204 bytes,     2 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #2, ESTABLISHED, IKEv2, 7cf9d3d893e164b4_i a817474eb24f819d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 12s ago, rekeying in 82158s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 12s ago, rekeying in 15636s, expires in 28788s
    in  c95a926b,    448 bytes,     5 packets,     0s ago
    out c2ad16fe,    468 bytes,     5 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]

Step 12: Ping IP address 10.3.0.1 from DUT0:

admin@DUT0$ ping 10.3.0.1 local-address 10.1.0.1 count 1 size 56 timeout 1
Show output
PING 10.3.0.1 (10.3.0.1) from 10.1.0.1 : 56(84) bytes of data.
64 bytes from 10.3.0.1: icmp_seq=1 ttl=64 time=0.315 ms

--- 10.3.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.315/0.315/0.315/0.000 ms

Step 13: Ping IP address 10.1.0.1 from DUT2:

admin@DUT2$ ping 10.1.0.1 local-address 10.3.0.1 count 1 size 56 timeout 1
Show output
PING 10.1.0.1 (10.1.0.1) from 10.3.0.1 : 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.327 ms

--- 10.1.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.327/0.327/0.327/0.000 ms

Step 14: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:

(?m)\s+.*AES_GCM_16-256\/PRF_HMAC_SHA2_256\/ECP_256\/PPK.*\s+.*\s+.*\s+.*\s+.*[1-9]\d? packets.*\s+.*[1-9]\d? packets.*\s+.*\s+.*remote\s+80.0.0\.3.*
Show output
IPSEC: #3, ESTABLISHED, IKEv2, b544cfbe77a4a912_i 456581b39d0ac469_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=dave@teldat.org' @ 80.0.0.3[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 2s ago, rekeying in 80151s
  IPSEC: #2, reqid 2, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 2s ago, rekeying in 15660s, expires in 28798s
    in  c3f1a1a8,    360 bytes,     4 packets,     0s ago
    out c02b339e,    380 bytes,     4 packets,     0s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.3/32[gre]
IPSEC: #2, ESTABLISHED, IKEv2, 7cf9d3d893e164b4_i a817474eb24f819d_r*
  local  'CN=moon.teldat.org' @ 80.0.0.1[500]
  remote 'CN=carol@teldat.org' @ 80.0.0.2[500]
  AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_256/PPK
  established 13s ago, rekeying in 82157s
  IPSEC: #1, reqid 1, INSTALLED, TRANSPORT, ESP:AES_GCM_16-256
    installed 13s ago, rekeying in 15635s, expires in 28787s
    in  c95a926b,    448 bytes,     5 packets,     1s ago
    out c2ad16fe,    468 bytes,     5 packets,     1s ago
    local  80.0.0.1/32[gre]
    remote 80.0.0.2/32[gre]