This article provides topology and configuration examples for configuring an IPSEC tunnel between a JunOS and IOS system.

Below is an example of a working configurations between Juniper router running JUNOS software and a Cisco router running IOS.

Topology


  M10
  R1      lo0 77.77.77.77
ge-0/0/0 
   |
   |
   |
   |
ge-0/2/0
  M5                                          
  R2                                         cisco3640  lo0 88.88.88.88
fe-0/0/0  ===========IPSec==================    fa0/1
   |                                              |
   |                                              |
   +----------- fe-0/0/0   M7i  fe-0/0/1 ----------+
                        Sydney                             

The IPSec Tunnel is created between the Fastethernet interface addresses of  router R2 and cisco3640:

R2   fe-0/0/0:   11.0.0.1/30
cisco3640 fa0/1: 12.0.0.1/30

The relevant configuration of router R2:

[edit]
user@M5-R2# show interfaces | no-more
fe-0/0/0 {
    unit 0 {
        family inet {
            address 11.0.0.1/30;
        }
    }
}
ge-0/2/0 {
    unit 0 {
        family inet {
            mtu 1300;
            address 21.0.0.1/30;
        }
    }
}
sp-0/3/0 {
    unit 1 {
        family inet;
        service-domain inside;
    }
    unit 2 {
        family inet;
        service-domain outside;
    }
}
lo0 {
    unit 0 {
        family inet {
            address 99.99.99.99/32;
        }
    }
}

[edit]
user@M5-R2# show routing-options
static {
    route 77.77.77.77/32 next-hop 21.0.0.2;
    route 0.0.0.0/0 next-hop 11.0.0.2;
    route 88.88.88.88/32 next-hop sp-0/3/0.1;
}

user@M5-R2# show services
service-set ss1 {
    next-hop-service {
        inside-service-interface sp-0/3/0.1;
        outside-service-interface sp-0/3/0.2;
    }
    ipsec-vpn-options {
        local-gateway 11.0.0.1;
    }
    ipsec-vpn-rule-sets ruleset1;
}
ipsec-vpn {
    rule dyn {
        term 1 {
            from {
                source-address {
                    77.77.77.77/32;
                }
                destination-address {
                    88.88.88.88/32;
                }
            }
            then {
                remote-gateway 12.0.0.1;
                dynamic {
                    ike-policy ike-pol;
                    ipsec-policy ipsec-pol;
                }
                clear-dont-fragment-bit;
            }
        }
        match-direction input;
    }
    rule-set ruleset1 {
        rule dyn;
    }
    ipsec {
        proposal ipsec-pro {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 3600;
        }
        policy ipsec-pol {
            proposals ipsec-pro;
        }
    }
    ike {
        proposal ike-pro {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm des-cbc;
            lifetime-seconds 3600;
        }
        policy ike-pol {
            mode main;
            proposals ike-pro;
            pre-shared-key ascii-text "$9$7-Vs4UDk.5FUD9A0ORE";
        }
    }
    establish-tunnels immediately;
}


cisco3640#sh run
...
hostname cisco3640
...
!        
crypto isakmp policy 10
 authentication pre-share
 group 2
 lifetime 3600
crypto isakmp key key123 address 11.0.0.1
!
!
crypto ipsec transform-set ts esp-3des esp-sha-hmac
crypto ipsec transform-set ts-man esp-des esp-md5-hmac
!
crypto map dyn 10 ipsec-isakmp  
 set peer 11.0.0.1
 set transform-set ts
 match address 120
!
!
interface Loopback1
 ip address 88.88.88.88 255.255.255.255
!
interface FastEthernet0/1
 ip address 12.0.0.1 255.255.255.252
 duplex auto
 speed auto
 no cdp enable
 crypto map dyn
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
ip route 11.0.0.0 255.255.255.252 12.0.0.2
ip route 77.77.77.77 255.255.255.255 FastEthernet0/1
ip route 99.99.99.0 255.255.255.0 FastEthernet0/1
!
access-list 120 permit ip host 88.88.88.88 host 77.77.77.77
!
!
!...
end