Howto: Easy route-based VPN configuration


  • administrators

    I work for a Juniper reseller and spend a lot of time going to client sites to configure VPN’s, and it’s pretty amazing how many people haven’t figured out how to set up a VPN with a Netscreen using a preshared key. So, here’s a walkthrough (using the web interface) of a route-based VPN solution between two Netscreens:

    Scenario:
    Firewall A -> Internet -> Firewall B
    1. Log into Firewall A through the web interface
    2. Configure your tunnel interface
    a. Click Network -> Interfaces
    b. Make sure the dropdown in the top left says Tunnel IF, and click New
    c. I put mine in the Untrust zone because I want all of my VPN traffic to run throug my Untrust->Trust policy
    d. Click unnumbered and select the untrust interface
    e. click OK
    3. Configure your VPN Gateway
    a. Click VPNs -> AutoKey Advanced -> Gateway
    b. click New
    c. Name the gateway "FirewallB-gw"
    d. I always select the custom security level, you’ll see why in a following step
    e. Enter the public IP address of Firewall B
    f. Carefully enter your preshared key
    g. select untrust for your outgoing interface
    h. click advanced
    i. select User defined (custom)
    j. in the first dropdown select pre-g2-aes128-sha
    k. click return at the bottom
    l. click OK at the bottom
    4. Create the VPN
    a. on the menu on the left select VPNs -> Autokey Advanced
    b. click New
    c. name it FirewallB-vpn
    d. select Custom
    e. leave predefined checked and select your FirewallB-GW in the dropdown
    f. click Advanced
    g. select custom
    h. in the first dropdown, select g2-esp-aes128-sha
    i. turn on replay protection
    j. Bind to tunnel interface, and select your tunnel interface you created in step 2
    k. turn on VPN monitor (this will bring up the VPN right away and keep it up even when there’s no traffic on it)
    l. click Return
    m. click OK
    5. You need to add routes to the remote network. You can configure the tunnel interfaces to run OSPF, or you can add a static. I will tell you how to add a static.
    a. on the menu click Network -> Routing -> Destination
    b. click new
    c. type in the network address behind Firewall B
    d. Select Gateway
    e. Select your tunnel interface in the dropdown
    f. click ok
    6. Add your policy to allow access to/from the remote network. If you are not in NAT mode on your trust interface, make sure you check position at top when creating a Trust->Untrust rule, or it will NAT the traffic to your untrust IP or DIP pool and then send it across the tunnel, which you probably don’t want. Create an Untrust->Trust policy which allows access from the Network behind FirewallB to hosts or the network behind FirewallB. You probably want to allow Ping at a minimum.
    7. Repeat steps 1-6 on Firewall B. Substituting Firewall A’s data.

    The VPN should pop up and everything should work. You can also use the little wizard thing, but I haven’t tried it. If you use it, I don’t think it picks the most secure cipher for P1 and P2, this is why we set this up manually. If one or both of your Netscreens is behind something that does NAT, you will also have to turn on NAT traversal on both ends.

    If you don’t want static routes and want to use OSPF instead, you can create an OSPF instance under the trust VR. Make sure you add the tunnel interfaces and your internal interfaces to it, and tell it to advertise your private networks. You will then have to go under each interface that you added, and turn on OSPF. On tunnel interfaces, you can enable demand circuit and add it to the area, apply the changes, and then Enable OSPF on it.



  • Hi, I am very new in using Juniper and we have SSG 20 in our office.

    Do you have the procedure in setting up a dial-up VPN using Windows XP and Windows 7 native VPN client (no NetScreen-Remote) without using Certificates?

    Thanks a lot.



  • I found that if I bind the VPN to the tunnel interface, the VPN tunnel won’t go up.
    Does the other side need to create tunnel interface and bind vpn to tunnel interface also?
    What happen if the other side is not using Juniper firewall.

    If I remove binding of the tunnel interface, VPN tunnel will go up but I can’t do MIP or destination NAT.

    Any help will be much appreciated.



  • heheheeeeeeeee noting


  • administrators

    @bensonlei:

    Hi,
    I am a Cisco guy, and now new to Juniper SSG5 and SSG140; want to know if the following situations work:

    1. Two sites :
        One site with Juniper SSG5 connecting to two ISP links, so WAN link failover is configured.
        The other site with Juniper SSG140 connecting also two other ISP links, so WAN link failover is configured.
    2. Want to set up two VPN links ( they can back up each other ), that is totally four VPN configurations (2 WAN Links x 2 WAN links = 4 VPN links )

    Are the VPN links are working ( failover architecture only ) ?

    This should work.  The way I would set it up would be to have both VPN links (set them up as route-based) active at one time, but then use route metrics to make one the primary.


  • administrators

    @jmcgrady:

    Thanks Signal. Ive put some debugging on and am still getting an issue. On A, eth0/1 is 10.1.24.215 and the tunnel endpoint. On B, eth0/2.7 is 167.22.92.113 and is the other end of the tunnel. I have bound tunnel.1 on B to eth0/0 and set eth0/0 as outgoing-interface. When the first IKE packet reaches B, it complains:

    2011-09-09 13:36:35 : IKE<10.1.24.215> ****** Recv packet if <ethernet0 2.7="">of vsys <root>******

    2011-09-09 13:36:35 : IKE<10.1.24.215> Catcher: get 160 bytes. src port 500

    2011-09-09 13:36:35 : IKE<0.0.0.0        >  ISAKMP msg: len 160, nxp 1[SA], exch 2[MM], flag 00

    2011-09-09 13:36:35 : IKE<10.1.24.215    > Recv : [SA] [VID] [VID] [VID]

    2011-09-09 13:36:35 : IKE<0.0.0.0        >  Not found: 1st peer_ent that is used, with no peer IP, and right local IP.

    2011-09-09 13:36:35 : IKE<10.1.24.215> Rejected an initial Phase 1 packet from an unrecognized peer gateway.

    11998648.0: ethernet0/0(i) len=202:0016c8268d43->0010dbff2000/0800
                  10.1.24.215 -> 167.22.92.113/17

    Why would it be complaining that its an ‘unrecognized peer gateway’ when the gateway on B is defined as:
    set ike gateway “test-gw” address 10.1.24.215 Main outgoing-interface “ethernet0/0” preshare “blahblah” proposal “pre-g2-aes128-sha”</root></ethernet0>

    Your IKE ID is not being set or is incorrect on the remote end.  You are doing Main mode.  Is your remote side a dynamic IP?  If so, you need to switch to aggressive mode.  You may also need to use an email style IKE ID if it’s dynamic.



  • Hi,
    I am a Cisco guy, and now new to Juniper SSG5 and SSG140; want to know if the following situations work:

    1. Two sites :
        One site with Juniper SSG5 connecting to two ISP links, so WAN link failover is configured.
        The other site with Juniper SSG140 connecting also two other ISP links, so WAN link failover is configured.
    2. Want to set up two VPN links ( they can back up each other ), that is totally four VPN configurations (2 WAN Links x 2 WAN links = 4 VPN links )

    Are the VPN links are working ( failover architecture only ) ?



  • Thanks Signal. Ive put some debugging on and am still getting an issue. On A, eth0/1 is 10.1.24.215 and the tunnel endpoint. On B, eth0/2.7 is 167.22.92.113 and is the other end of the tunnel. I have bound tunnel.1 on B to eth0/0 and set eth0/0 as outgoing-interface. When the first IKE packet reaches B, it complains:

    2011-09-09 13:36:35 : IKE<10.1.24.215> ****** Recv packet if <ethernet0 2.7="">of vsys <root>******

    2011-09-09 13:36:35 : IKE<10.1.24.215> Catcher: get 160 bytes. src port 500

    2011-09-09 13:36:35 : IKE<0.0.0.0        >  ISAKMP msg: len 160, nxp 1[SA], exch 2[MM], flag 00

    2011-09-09 13:36:35 : IKE<10.1.24.215    > Recv : [SA] [VID] [VID] [VID]

    2011-09-09 13:36:35 : IKE<0.0.0.0        >  Not found: 1st peer_ent that is used, with no peer IP, and right local IP.

    2011-09-09 13:36:35 : IKE<10.1.24.215> Rejected an initial Phase 1 packet from an unrecognized peer gateway.

    11998648.0: ethernet0/0(i) len=202:0016c8268d43->0010dbff2000/0800
                  10.1.24.215 -> 167.22.92.113/17

    Why would it be complaining that its an ‘unrecognized peer gateway’ when the gateway on B is defined as:
    set ike gateway “test-gw” address 10.1.24.215 Main outgoing-interface “ethernet0/0” preshare “blahblah” proposal “pre-g2-aes128-sha”</root></ethernet0>


  • administrators

    @jmcgrady:

    I have a small variant to the original post that i’d like your advice on.  Our central gateway (call it “B”) connects to internet via ethernet0/0. eth0/0 is in the untrust zone. However, the ip address for the endpoint of the tunnel on B resides on interface ethernet0/2. eth0/2 is in the DMZ zone.

    So; when i’m selecting the physical interface to bind my unnumbered tunnel interface to; do i use eth0/0 or eth0/2? Furthermore, when i’m configuring the ike gateway on B; do i use eth0/0 or eth0/2 for “outgoing-interface”?

    Outgoing interface will be eth0/0.  As far as binding the tunnel interface to a physical one….  it doesn’t matter.  Because the tunnel interface zone will be specified for the tunnel interface.  So you can bind it to eth0/2, or you can bind it to eth0/0.  Or, you can bind it to any other interface.



  • I have a small variant to the original post that i’d like your advice on.  Our central gateway (call it “B”) connects to internet via ethernet0/0. eth0/0 is in the untrust zone. However, the ip address for the endpoint of the tunnel on B resides on interface ethernet0/2. eth0/2 is in the DMZ zone.

    So; when i’m selecting the physical interface to bind my unnumbered tunnel interface to; do i use eth0/0 or eth0/2? Furthermore, when i’m configuring the ike gateway on B; do i use eth0/0 or eth0/2 for “outgoing-interface”?



  • Would it be possible to NAT the traffic before it traverses the VPN tunnel?  I need the network translated to a non overlapping network on the other end.



  • definitely … thanks for that



  • ok, problem has been fixed and it was easyer than i imagined.
    anyway, i’ve used a fixed proxy id for both vpn ( not blank proxy id 😞

    exampre for B to A vpn ( local ip 10.10.1.0/16 , remote 1.1.1.0/24 )
    exampre for B to C vpn ( local ip 10.10.2.0/16 , remote 2.2.2.0/24 )

    than i’ve used Source and Destination NAT on the Security policy i’ve created.
    My luck was that connection towards A coming from a dedicated interface and connection towards C use a different interface. ( my interfaces are in routing mode ) so no need to add static route and all worked fine for me.

    I’m just wondering what happens if both connection comes from the same interface ( example: untrust ) ?!?…maybe I have to disble "block intra zone traffic " option

    anyway, hope this can help.
    thank you and bye


  • Global Moderator

    If only B is a juniper you’re in trouble. You need to match the proxy-ID to the source addresses in that case I think.



  • only B is a juniper, anyway i will try to use proxy id and past the resoult here.


  • Global Moderator

    No, that should be it. Only thing to remark is to leave the proxy id’s alone. On routebased juniper to routebased juniper you don’t fill thim in. When both sides are all zeros they match and phase II can party. Don’t know what happens when you do use proxy id’s and the source is not within the range of the proxy id. Interesting to find out!!



  • @screenie.:

    A needs set a route to reach C to B and C needs to set a rout to reach A to B. on B you you need a policy to allow the traffic. A and C need both to be route based VPN for this config to work.

    ok thank you.
    so,

    1. route based vpn from  A to B ( proxy id = source network A & destination network B )

    2. route based Vpn  from C to B ( proxy id = source network B & destination network C )

    3 ) on B i have to setup a policy that permit traffic from A to C

    1. A have to setup a route to C using B as GW ( tunnel interface )
    2. C have to setup a route to A using B as GW ( tunnel interface )

    missing something? if not it seems to be easy.

    thank you so much.


  • Global Moderator

    A needs set a route to reach C to B and C needs to set a rout to reach A to B. on B you you need a policy to allow the traffic. A and C need both to be route based VPN for this config to work.



  • Hi
    is it possible to route vpn traffic from customer “A” to customer “C” towards a netscren “B”.

    I (B) have a vpn with “C”.
    I have to establish a new vpn with “A”.
    “A” needs to reach “C”  but it can’t estatblish a VPN directly.
    is it possible to accomplish it without changing the actual vpn? ( B –> C ) ?
    thank you



  • would you please post the configuration of Certificate based Netscreen-remote dialup vpn using smart card. I need step by step configuration. please post it……


 

23
Online

38.4k
Users

12.7k
Topics

44.5k
Posts