X509
These scenarios show how to establish a VPN IPsec site-to-site connection between two end-points using X.509 certificates.
Test Local And Remote Auth With X509 Files
Description
In this scenario, both devices use pre-installed X.509 certificate files for local and remote authentication.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut2.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut2.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.337 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.337/0.337/0.337/0.000 ms
Step 4: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut0.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut0.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 5: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.528 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.528/0.528/0.528/0.000 ms
Step 6: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.473 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.473/0.473/0.473/0.000 ms
Step 7: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.391 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.391/0.391/0.391/0.000 ms
Step 8: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, d6f6207970ed18b2_i* 45a6a4c44813a806_r local 'C=ES, O=Teldat, CN=DUT0' @ 8.0.0.2[500] remote 'C=ES, O=Teldat, CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 2s ago, rekeying in 13345s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 2s ago, rekeying in 16148s, expires in 28798s in c5f73d40, 168 bytes, 2 packets, 0s ago out c8e7d508, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24
Test Local Auth With SCEP And Remote Auth With X509 Files
Description
In this scenario, DUT0 uses SCEP for local authentication, while the remote peer is authenticated using X.509 certificate files.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT2 set system certificate scep csr CSR encrypted-password U2FsdGVkX19y443LhctduqVd7Iv7tqMYIB0z8SzyEXc= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut2.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut2.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.251 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.251/0.251/0.251/0.000 ms
Step 4: Run command pki scep show CSR at DUT2 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - May 5 01:03:32 2026 GMT May 5 01:03:32 2027 GMT
Step 5: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT0 set system certificate scep csr CSR encrypted-password U2FsdGVkX19dAgsivxrcfpMxQDxTbhwyYJnC/zoa2R0= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 6: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.515 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.515/0.515/0.515/0.000 ms
Step 7: Run command pki scep show CSR at DUT0 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - May 5 01:04:11 2026 GMT May 5 01:04:11 2027 GMT
Step 8: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.595 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.595/0.595/0.595/0.000 ms
Step 9: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.806 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.806/0.806/0.806/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 3f7210440601b9d7_i* f348b4bab7e00f60_r local 'CN=DUT0' @ 8.0.0.2[500] remote 'C=ES, O=Teldat, CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 1s ago, rekeying in 13230s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 1s ago, rekeying in 14704s, expires in 28799s in c4aa7773, 168 bytes, 2 packets, 0s ago out c799888c, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24
Test Local Auth With X509 Files And Remote Auth With SCEP
Description
In this scenario, DUT0 uses SCEP for remote authentication, while local authentication relies on X.509 certificate files.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT2 set system certificate scep csr CSR encrypted-password U2FsdGVkX19K/zJHNYzm8Hx/eVwnrVNCX+VxNDL+9Ao= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH remote ca-cert-file 'running://root.pem' set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.224 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.224/0.224/0.224/0.000 ms
Step 4: Run command pki scep show CSR at DUT2 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - May 5 01:04:57 2026 GMT May 5 01:04:57 2027 GMT
Step 5: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT0 set system certificate scep csr CSR encrypted-password U2FsdGVkX19T4F+ZTAzRoscJ15y4r4BXV32CLcuf7+g= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://ca.pem' set vpn ipsec auth-profile AUTH local ca-cert-file 'running://root.pem' set vpn ipsec auth-profile AUTH local cert-file 'running://dut0.pem' set vpn ipsec auth-profile AUTH local key file 'running://dut0.key' set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 6: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.408 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.408/0.408/0.408/0.000 ms
Step 7: Run command pki scep show CSR at DUT0 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - May 5 01:05:36 2026 GMT May 5 01:05:36 2027 GMT
Step 8: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.821 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.821/0.821/0.821/0.000 ms
Step 9: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.764 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.764/0.764/0.764/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 169ddcc449f6e7ce_i* 3bb6a2c7c52adbf0_r local 'C=ES, O=Teldat, CN=DUT0' @ 8.0.0.2[500] remote 'CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 1s ago, rekeying in 21549s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 1s ago, rekeying in 14856s, expires in 28799s in cd5c4153, 168 bytes, 2 packets, 0s ago out ce8d00b7, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24
Test Local And Remote Auth With SCEP
Description
In this scenario, both devices use SCEP for local and remote authentication.
Scenario
Step 1: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 8.0.0.1/24 set interfaces ethernet eth1 address 9.0.0.1/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT2 :
set interfaces dummy dum0 address 192.168.2.1/24 set interfaces ethernet eth0 address 9.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.66/24 set protocols static route 0.0.0.0/0 next-hop 9.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT2 set system certificate scep csr CSR encrypted-password U2FsdGVkX19IDGTTGKFXKSK3xzfPyUX7amlFkI+augE= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type respond set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 9.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 8.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.2.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.1.0/24
Step 3: Ping IP address 9.0.0.1 from DUT2:
admin@DUT2$ ping 9.0.0.1 count 1 size 56 timeout 1Show output
PING 9.0.0.1 (9.0.0.1) 56(84) bytes of data. 64 bytes from 9.0.0.1: icmp_seq=1 ttl=64 time=0.304 ms --- 9.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.304/0.304/0.304/0.000 ms
Step 4: Run command pki scep show CSR at DUT2 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - May 5 01:06:22 2026 GMT May 5 01:06:22 2027 GMT
Step 5: Set the following configuration in DUT0 :
set interfaces dummy dum0 address 192.168.1.1/24 set interfaces ethernet eth0 address 8.0.0.2/24 set interfaces ethernet eth1 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 8.0.0.1 set system certificate scep csr CSR cgi-path /scep set system certificate scep csr CSR cipher aes set system certificate scep csr CSR distinguished-names CN=DUT0 set system certificate scep csr CSR encrypted-password U2FsdGVkX1+HSOEBfZDBbnlxuLcYvP7Whm3w5NQ2SLo= set system certificate scep csr CSR port 8080 set system certificate scep csr CSR url 'http://10.215.168.1' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set vpn ipsec auth-profile AUTH local csr CSR set vpn ipsec auth-profile AUTH mirror-config false set vpn ipsec auth-profile AUTH mode x509 set vpn ipsec auth-profile AUTH remote csr CSR set vpn ipsec esp-group ESP-POLICY lifetime 28800 set vpn ipsec esp-group ESP-POLICY proposal 1 encryption null set vpn ipsec esp-group ESP-POLICY proposal 1 hash sha1 set vpn ipsec esp-group ESP-POLICY proposal 1 pfs dh-group15 set vpn ipsec ike-group IKE-POLICY key-exchange ikev2 set vpn ipsec ike-group IKE-POLICY lifetime 28800 set vpn ipsec ike-group IKE-POLICY proposal 1 dh-group 15 set vpn ipsec ike-group IKE-POLICY proposal 1 encryption null set vpn ipsec ike-group IKE-POLICY proposal 1 hash sha1 set vpn ipsec logging log-types any log-level 1 set vpn ipsec site-to-site peer PEER auth-profile AUTH set vpn ipsec site-to-site peer PEER connection-type on-demand set vpn ipsec site-to-site peer PEER ike-group IKE-POLICY set vpn ipsec site-to-site peer PEER local-address 8.0.0.2 set vpn ipsec site-to-site peer PEER remote-address 9.0.0.2 set vpn ipsec site-to-site peer PEER tunnel 1 esp-group ESP-POLICY set vpn ipsec site-to-site peer PEER tunnel 1 local prefix 192.168.1.0/24 set vpn ipsec site-to-site peer PEER tunnel 1 remote prefix 192.168.2.0/24
Step 6: Ping IP address 8.0.0.1 from DUT0:
admin@DUT0$ ping 8.0.0.1 count 1 size 56 timeout 1Show output
PING 8.0.0.1 (8.0.0.1) 56(84) bytes of data. 64 bytes from 8.0.0.1: icmp_seq=1 ttl=64 time=0.435 ms --- 8.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.435/0.435/0.435/0.000 ms
Step 7: Run command pki scep show CSR at DUT0 and check if output matches the following regular expressions:
ca\s+Valid usercert\s+ValidShow output
------------------------------------------------------------------------------------------------- Certificate Status Usage NotBefore NotAfter ------------------------------------------------------------------------------------------------- ca Valid Encipherment & Signature Apr 16 09:19:39 2025 GMT Apr 11 09:19:39 2045 GMT usercert Valid - May 5 01:07:01 2026 GMT May 5 01:07:01 2027 GMT
Step 8: Ping IP address 192.168.2.1 from DUT0:
admin@DUT0$ ping 192.168.2.1 local-address 192.168.1.1 count 1 size 56 timeout 1Show output
PING 192.168.2.1 (192.168.2.1) from 192.168.1.1 : 56(84) bytes of data. 64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.499 ms --- 192.168.2.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.499/0.499/0.499/0.000 ms
Step 9: Ping IP address 192.168.1.1 from DUT2:
admin@DUT2$ ping 192.168.1.1 local-address 192.168.2.1 count 1 size 56 timeout 1Show output
PING 192.168.1.1 (192.168.1.1) from 192.168.2.1 : 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.796 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.796/0.796/0.796/0.000 ms
Step 10: Run command vpn ipsec show sa at DUT0 and check if output matches the following regular expressions:
vpn-peer-PEER: \#\d, ESTABLISHED, IKEv2 [1-9]\d* packets,Show output
vpn-peer-PEER: #1, ESTABLISHED, IKEv2, 6d62bc62931c18ea_i* 91923377d731d85d_r local 'CN=DUT0' @ 8.0.0.2[500] remote 'CN=DUT2' @ 9.0.0.2[500] NULL/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072 established 2s ago, rekeying in 21052s peer-PEER-tunnel-1: #2, reqid 1, INSTALLED, TUNNEL, ESP:NULL/HMAC_SHA1_96 installed 2s ago, rekeying in 16159s, expires in 28798s in c0c009a1, 168 bytes, 2 packets, 0s ago out c9786b56, 168 bytes, 2 packets, 0s ago local 192.168.1.0/24 remote 192.168.2.0/24