Article Detail

Description

This article describes how to configure remote access IPSec VPN with group Internet key exchange (IKE) ID on SRX.

Symptoms

A group IKE ID is usually used in organizations with dialup IPSec VPN using a single user definition. Sometimes it is confused with another similar method, share IKE ID, for which XAUTH must be used. A group IKE ID is used to define one user policy and can be used to connect with multiple users.

There are two kinds of group IKE ID:

Partial IKE ID+ pre-shared key (each user will have its own key). This article will focus on a set up using a partial IKE ID and a pre-shared key.
Certificate - Group IKE ID with certificate is out of the scope of this article.

Solution

Important:

NS-Remote is not supported for SRX; please refer to KB15053 - SRX Client-to-LAN VPN solutions [juniper.net] .
NS-Remote is used here to demonstrate the setting required on the VPN client.
If NS-Remote is used to connect to the SRX, it is at user's own risk, as Juniper does not officially support NS-Remote on SRX.

Sample network setup

  client1 ----\
               \   ___________          +-------- staff subnet
                \ (           )         | 10.123.50.0/24
                 (             )        |
  client2 ------(   Internet    )----- SRX
                 (             )        |
                / (___________)         |
               /                        +-------- manager subnet
  client3 ----/                           10.123.100.0/24

In this example, the organization has two tiers of access:

Resources for general staff
Resources for managers

General staff will be assigned the IKE ID:

<username> @staff.abc.com

Manager will be assigned the IKE ID:

<username> @manager.abc.com

Configuration

Below is an overview of the configuration steps:

Interfaces and routing configuration
Security zone configuration
IKE configuration
IPSec configuration
Security policies
User key generation
Remote IPSec VPN client configuration sample (NS-Remote)
Remote IPsec VPN client configuration sample (NCP)

Here are the details of the configuration steps:

Interfaces and routing configuration

Assuming the interface and address assignment are as follows:
```
     Interface   | IP address             | function
   --------------+------------------------+--------------------------
     ge-0/0/0    | 10.123.200.1/24        | Connect to Internet
     ge-0/0/1    | 10.123.50.1/24         | Connect to staff subnet
     ge-0/0/2    | 10.123.100.1/24        | Connect to manager subnet
```
Configuration statements:

set interface ge-0/0/0 unit 0 family inet address 10.123.200.1/24 set interface ge-0/0/1 unit 0 family inet address 10.123.50.1/24 set interface ge-0/0/2 unit 0 family inet address 10.123.100.1/24
Since ge-0/0/0 is connecting to Internet, the default route should be configured.
Assume the next-hop is 10.123.200.2.

Configuration statements:

set routing-options static route 0.0.0.0/0 next-hop 10.123.200.2
Security zone configuration

Security zones are a logical grouping of interfaces that serve with the same security domain. On the SRX, if you need telnet or J-Web to the SRX, it must be configured explicitly on a per zone basis. By default, any traffic that is sent to any zone will get dropped. Based on this network setup, the following system services must be added:
```
     Internet   | Zone      | allowed system traffic
   -------------+-----------+--------------------------
     ge-0/0/0   | untrust   | ike, ssh, https
     ge-0/0/1   | staff     | ping
     ge-0/0/2   | manager   | all
```
Configuration statements:

set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ssh set security zones security-zone untrust host-inbound-traffic system-services https set security zones security-zone untrust interface ge-0/0/0 set security zones security-zone staff host-inbound-traffic system-services ping set security zones security-zone staff interface ge-0/0/1 set security zones security-zone manager host-inbound-traffic system-service all set security zones security-zone manager interface ge-0/0/2
IKE configuration
```
   IKE proposal (Phase1 proposal)
   Authentication method     : pre-share key
   Authentication algorithm  : SHA-1
   Diffie-Hellman group      : DH group 2
   Encryption algorithm      : 3DES
   IKE gateway mode          : aggressive
   VPN terminating interface : ge-0/0/0
   Partial IKE ID            : @staff.abc.com (staff vpn)
                               @manager.abc.com (manager vpn)
   Pre-share key seed        : <key-seed>
```
Configuration statements:

set security ike proposals p1-proposal authentication-method pre-shared-keys set security ike proposals p1-proposal dh-group group2 set security ike proposals p1-proposal authentication-algorithm sha1 set security ike proposals p1-proposal encryption-algorithm 3des-cbc set security ike policy p1-policy mode aggressive set security ike policy p1-policy proposals p1-proposal set security ike policy p1-policy pre-share-key ascii-text <key-seed> set security ike gateway staff-ike-gateway dynamic user-at-hostname @staff.abc.com set security ike gateway staff-ike-gateway dynamic connection-limit 100 set security ike gateway staff-ike-gateway dynamic ike-user-type group-ike-id set security ike gateway staff-ike-gateway external-interface ge-0/0/0 set security ike gateway staff-ike-gateway ike-policy p1-policy set security ike gateway manager-ike-gateway dynamic user-at-hostname @manager.abc.com set security ike gateway manager-ike-gateway dynamic connection-limit 20 set security ike gateway manager-ike-gateway dynamic ike-user-type group-ike-id set security ike gateway manager-ike-gateway external-interface ge-0/0/0 set security ike gateway manager-ike-gateway ike-policy p1-policy
IPsec configuration
```
   IPSec proposal (Phase 2 proposal)
   Perfect-forward-secrecy : no
   Authentication algorithm : SHA-1
   Encryption algorithm   : 3DES
   IPSec protocol         : ESP
```
Configuration statements:

set security ipsec proposals p2-proposal protocol esp set security ipsec proposals p2-proposal authentication-algorithm hmac-sha1-96 set security ipsec proposals p2-proposal encryption-algorithm 3des-cbc set security ipsec policy p2-policy proposals p2-proposal set security ipsec vpn staff-vpn ike gateway staff-ike-gateway set security ipsec vpn staff-vpn ike ipsec-policy p2-policy set security ipsec vpn manager-vpn ike gateway manager-ike-gateway set security ipsec vpn manager-vpn ike ipsec-policy p2-policy
Security policies
```
     VPN         | Permit to access
   --------------+------------------------------
     staff-vpn   | staff-net   (10.123.50.0/24)
     manager-vpn | manager-net (10.123.100.0/24)
```
Configuration statements:

set security zones security-zone staff address-book address staff-net 10.123.50.0/24 set security zones security-zone manager address-book address manager-net 10.123.100.0/24 set security policies from-zone untrust to-zone staff policy dialup-vpn-staff match source-address any set security policies from-zone untrust to-zone staff policy dialup-vpn-staff match destination-address staff-net set security policies from-zone untrust to-zone staff policy dialup-vpn-staff match application any set security policies from-zone untrust to-zone staff policy dialup-vpn-staff then permit tunnel ipsec-vpn staff-vpn set security policies from-zone untrust to-zone manager policy dialup-vpn-manager match source-address any set security policies from-zone untrust to-zone manager policy dialup-vpn-manager match destination-address manager-net set security policies from-zone untrust to-zone manager policy dialup-vpn-manager match application any set security policies from-zone untrust to-zone manager policy dialup-vpn-manager then permit tunnel ipsec-vpn manager-vpn
User key generation

Operation commands:

show security ike pre-shared-key user-id <full ike id> master-key <key-seed>
Example:

Eric is a manager and has two staff persons (Peter and Mary) under his management.
Eric's full IKE ID = [email protected]
Peter's full IKE ID = [email protected]
Mary's full IKE ID = [email protected]

[email protected]> show security ike pre-shared-key user-id [email protected] master-key SeedPreShare Pre-shared key: 31185d786e78e445de113bf1b0e97351b70d0ec9 [email protected]> show security ike pre-shared-key user-id [email protected] master-key SeedPreShare Pre-shared key: 78e445de113bf1b0e97351b70d0ec931185d786e [email protected]> show security ike pre-shared-key user-id [email protected] master-key SeedPreShare Pre-shared key: 3bf1b0e97351b70d0ec931185d786e78e445de11
Remote IPSec VPN client configuration sample (NS-Remote)

NS-Remote is not supported for SRX, please refer to KB15053 - SRX Client-to-LAN VPN solutions [juniper.net] .
NS-Remote is used here to demonstrate the setting required on the VPN client.
If NS-Remote is used to connect to the SRX, it is at the user's own risk, as Juniper does not officially support NS-Remote on SRX.
- Right click on NS-Remote icon sitting on system tray and select Security Policy Editor .
- Right click on My Connections , select Add , then select Connection .
- Enter the name for connection, for example, "VPN-SRX".
- On left pane, change ID Type to "IP Subnet".
- Enter Subnet and Mask, for example, 10.123.100.0 and 255.255.255.0
- Check the checkbox on the right of Use and enter the IP address of the external interface of SRX VPN, for example, 10.123.200.1
- Click on the " + " sign on the right of the connection you just create.
- Click on My Identity .
- On the left pane, change Select Certificate to "NONE".
- Click Pre-Shared Key and enter the key string that generated on SRX on step 6.
- Change ID Type to "E-mail Address" and enter the full IKE ID on the box below it.
- Click on the " + " sign on the right of Security Policy on right pane.
- Select Aggressive Mode on Phase 1 Negotiation Mode.
- Click on the " + " sign on the right of "Authentication (Phase 1)" on the right pane, and click on "Proposal 1".
- Change the setting as per IKE policy configured on SRX; you can leave "SA Life" as default setting.
```
       Authentication Method = Pre-Shared Key
       Encrypt Alg           = Triple DES
       Hash Alg              = SHA-1
       Key Grup              = Hiffie-Hellman Group 2    
```
- Click on the " + " sign on the right of "Key Exchange (Phase 2)" on the right pane, and click on "Proposal 1"
- Change the setting as per IPSec Policy configured on SRX; you can leave "SA Life" as default setting
```
       Encapsulation Protocol (ESp) = Checked
       Encrypt ALG                  = Triple DES
       Hash Alg                     = SHA-1
       Encapsulation                = Tunnel
```
- Click on the Save button on the top

Remote IPSec VPN client configuration sample (NCP)

Start NCP IPSec VPN client program.
Click configuration on top manual and select profiles.
On Profiles window, select Add , then Manual configuration profile and click Next.
Enter a profile name, for example, "VPN-SRX".
Under VPN Gateway Parameters:

       Gateway  = IP address of external interface of SRX VPN, say 10.123.200.1
       XAUTH    = checked
       User ID  = XAUTH user name
       Password = XAUTH password
       Click Next

Under IPSec Configuration:

       Exchange Mode = aggressive mode
       PFS Group     = none
       Click Next

Pre-shared Key:

       Pre-shared Key      = enter the key string that generated on SRX on step 6
       Local Identity Type = Full Qualified Username
       Local Identity ID   = Full IKE ID
       Click Next

IPsec Configuration - IP Address:

       IP Address Assignment = IKE Config Mode
       Click Next

On Profile window, click Edit.
IPSec General Settings:

       IKE Policy > "Pre-shared Key" > Edit
       Authentication = Pre-shared Key
       Encryption     = Triple DES
       HASH           = SHA
       DH Group       = DH-Group 2
       Click OK

IPSec Policy > Add

       Name = "ESP - 3DES - SHA-1"
       Protocol       = ESP
       Encryption     = Triple DES
       Authentication = SHA
       Click OK

Click Close to exit IPSec Configuration
IKE Policy = "Pre-shared Key"
IPSec Policy = "ESP - 3DES - SHA-1"
Exch. Mode = aggressive mode
PFS Group = none
Click OK and click OK to complete.

Verify setting

Normally, configuration can be confirmed by having traffic test whether ping, telnet or FTP will serve it.

When you ping to the remote resource, the first packet may not be working as VPN is not established yet. However, you should see the connection established for the subsequent traffic. Observe the NS-Remote icon on system tray; you will see a green light flash as long as traffic is being sent over VPN.

In addition, you can check with IKE and IPSec SA on SRX to confirm the connection:

[email protected]> show security ike security-associations detail 
IKE peer 10.123.200.2, Index 8,
  Role: Responder, State: UP
  Initiator cookie: 62965b8a5755aa97, Responder cookie: b2ce44b11068b3a9
  Exchange type: Aggressive, Authentication method: Pre-shared-keys
  Local: 10.123.200.1:500, Remote: 10.123.200.2:500
  Lifetime: Expires in 3498 seconds
  Peer ike-id: [email protected]
  Xauth assigned IP: 0.0.0.0
  Algorithms:
   Authentication : sha1 
   Encryption : 3des-cbc
   Pseudo random function: hmac-sha1
  Traffic statistics:
   Input bytes : 772
   Output bytes : 748
   Input packets: 4
   Output packets: 2
  Flags: Caller notification sent    
  IPSec security associations: 1 created, 0 deleted
  Phase 2 negotiations in progress: 1
  
    Negotiation type: Quick mode, Role: Responder, Message ID: 2876009343
    Local: 10.123.200.1:500, Remote: 10.123.200.2:500
    Local identity: ipv4_subnet(any:0,[0..7]=10.123.100.0/24)
    Remote identity: ipv4(any:0,[0..3]=10.123.200.2)
    Flags: Caller notification sent, Waiting for done


[email protected]> show security ipsec security-associations detail 
  Virtual-system: root
  Local Gateway: 10.123.200.1, Remote Gateway: 10.123.200.2
  Local Identity: ipv4_subnet(any:0,[0..7]=10.123.100.0/24)
  Remote Identity: ipv4(any:0,[0..3]=10.123.200.2)
    DF-bit: clear
    Policy-name: dialup-vpn-manager
  
    Direction: inbound, SPI: aaec9268, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 3475 seconds
    Lifesize Remaining: Unlimited
    Soft lifetime: Expires in 2883 seconds
    Mode: tunnel, Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
    Anti-replay service: counter-based enabled, Replay window size: 64
   
    Direction: outbound, SPI: b43106f3, AUX-SPI: 0
                               , VPN Monitoring: -
    Hard lifetime: Expires in 3475 seconds
    Lifesize Remaining: Unlimited
    Soft lifetime: Expires in 2883 seconds
    Mode: tunnel, Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
    Anti-replay service: counter-based enabled, Replay window size: 64

Finally, you can check with IKE active peer to confirm which users are connected:

[email protected]> show security ike active-peer 
Remote Address                     Port      Peer IKE-ID                  XAUTH username                Assigned IP
10.123.200.2                       500       [email protected]