Description

This article provides information about the possibility of supporting P2MP on st0 in the logical system.

Symptoms

A hub-to-spoke VPN is configured with P2MP being enabled on st0 in the logical system; the commit fails:

set security ike policy ike-policy-test mode main
set security ike policy ike-policy-test proposals standards
set security ike policy ike-policy-test pre-shared-key ascii-text test1234

set security ike gateway ike-gateway-test ike-policy ike-policy-test
set security ike gateway ike-gateway-test address 10.1.1.2
set security ike gateway ike-gateway-test external-interface reth1.0

set security ipsec policy ipsec-policy-test proposals standards

set security ipsec vpn vpn-test1 bind-interface st0.1
set security ipsec vpn vpn-test1 ike gateway ike-gateway-test
set security ipsec vpn vpn-test1 ike ipsec-policy ipsec-policy-test

set security ipsec vpn vpn-test2 bind-interface st0.1
set security ipsec vpn vpn-test2 ike gateway ike-gateway-test
set security ipsec vpn vpn-test2 ike proxy-identity local 192.168.10.0/24
set security ipsec vpn vpn-test2 ike proxy-identity remote 192.168.20.0/24
set security ipsec vpn vpn-test2 ike ipsec-policy ipsec-policy-test

set security ipsec vpn vpn-test3 bind-interface st0.1
set security ipsec vpn vpn-test3 ike gateway ike-gateway-test
set security ipsec vpn vpn-test3 ike proxy-identity local 192.168.10.0/24
set security ipsec vpn vpn-test3 ike proxy-identity remote 192.168.30.0/24
set security ipsec vpn vpn-test3 ike ipsec-policy ipsec-policy-test

set logical-systems lsys-test interfaces st0 unit 1 multipoint
set logical-systems lsys-test interfaces st0 unit 1 family inet address 10.10.10.1/28
set logical-systems lsys-test interfaces st0 unit 1 family inet next-hop-tunnel 10.10.10.2 ipsec-vpn vpn-test2
set logical-systems lsys-test interfaces st0 unit 1 family inet next-hop-tunnel 10.10.10.3 ipsec-vpn vpn-test3

{primary:node0}[edit]
root@SRX650# commit check
[edit logical-systems lsys-test interfaces st0 unit 1 family inet next-hop-tunnel 10.10.10.2 ipsec-vpn]
'ipsec-vpn vpn-test2'
Referenced IPSec vpn must be defined under [edit security ipsec vpn] hierarchy level
[edit logical-systems lsys-test interfaces st0 unit 1 family inet next-hop-tunnel 10.10.10.3 ipsec-vpn]
'ipsec-vpn vpn-test3'
Referenced IPSec vpn must be defined under [edit security ipsec vpn] hierarchy level

Solution


P2MP is not yet supported in the logical system and there is no schedule for such support. One workaround is to remove P2MP and use P2P in st0 by creating multiple st0s for different VPN objects.