Description

This article provides information about how to configure Manual Key IPSec VPN and verify the configuration on SRX Series Security Gateways

Symptoms

In certain circumstances, we may find that the benefits of IKE are not worth the overhead in processing, and may elect to use manual key VPNs instead.

Solution

The configuration is much lighter with manual key VPNs because there are no Phase 1 or Phase 2 negotiations; each side can just start sending the data at will with the administratively defined IPsec keys. Of course, both sides must be configured appropriately,or else the data will be dropped by either side.

The following needs to be defined: gateway, external-interface, protocol, SPI , authentication algorithm and key, encryption algorithm and key. The key sizes should be according to the selected authentication and encryption algorithms.

For example, for hmac-sha1-96 authentication, the key size should be 20 bytes. This means that the key should be of 20 characters in length.  If it is less than that you will get a commit error, saying that key is too small.

This configuration uses AuthenticationKey123 as the key which is of 20 bytes(20 characters long) length string.

Similarly for aes-256-cbc encryption, use EncryptionKey1234567890123456789 which is a 32 characters string (32 bytes length).

For SPI we can use any value, but it should be same on both sides. Here we have used 1003 (0x 3eb), which we can verify with ipsec security-associations output


Configuration: 

security {
    ipsec {
        vpn myvpn {
            manual {
                gateway 200.1.1.1;
                external-interface ge-0/0/1.0;
                protocol esp;
                spi 1003;
                authentication {
                    algorithm hmac-sha1-96;
                    key ascii-text "$ABC123"; ## SECRET-DATA
                }
                encryption {
                    algorithm aes-256-cbc;
                    key ascii-text "$ABC123"; ## SECRET-DATA
                }
            }
        }
    }

Please note that there is no difference in the configuration of security zones or policies.  It is similar to autokey (IKE) IPSec VPN Configuration.

( Note: the "key ascii-text" line in the configuration sample above has been split into multiple lines to fit the space of this article .)


Verification: 
root@router# run show security ike security-associations

[edit]


As expected there is NO Phase-1 SA. 
root@router# run show security ipsec security-associations
Total active tunnels: 1
ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys
<131074 200.1.1.1 500 ESP:aes-256/sha1 3eb - root
>131074 200.1.1.1 500 ESP:aes-256/sha1 3eb - root

root@router# run show security flow session tunnel
Session ID: 998, Policy name: N/A, Timeout: N/A, Valid
In: 200.1.1.1/0 --> 100.1.1.1/1003;esp, If: ge-0/0/1.0, Pkts: 0, Bytes: 0
Session ID: 999, Policy name: N/A, Timeout: N/A, Valid
In: 200.1.1.1/0 --> 100.1.1.1/0;esp, If: ge-0/0/1.0, Pkts: 0, Bytes: 0 Total sessions: 2
From the above output, it is confirmed that the established Security Associations are using the manually configured SPI (0x3eb).
 

Modification History

2020-02-26: minor non-technical edits.