This article provides information on how to configure a Group VPN setup with a key server, SRX device, and Group VPN member. Additionally, a Cisco router as a Group VPN member has been included.
The group VPN feature in Junos 11.1 has been tested with Cisco GET VPN servers that run 12.4(22)T and 12.4(24)T. For specific information, refer to the Release Notes for your release.
The group VPN feature is compatible with the Cisco GET VPN feature, based on the standard GDOI and ESP protocols under limited configurations and scenarios. The proprietary Juniper and Cisco GDOI/ESP protocol extensions are not compatible. This article documents the Juniper member behavior in a Cisco GET VPN topology, which consists of one server and one member. The relevant configurations of server and members are also provided. The summary of incompatible Cisco GET VPN features is as follows. Refer to group VPN functional specifications for complete compatibility information:
set security group-vpn member ike proposal ike_prop authentication-method pre-shared-keys set security group-vpn member ike proposal ike_prop authentication-algorithm sha1 set security group-vpn member ike proposal ike_prop encryption-algorithm 3des-cbc set security group-vpn member ike policy ike_pol mode main set security group-vpn member ike policy ike_pol proposals ike_prop set security group-vpn member ike policy ike_pol pre-shared-key ascii-text "$ABC123" set security group-vpn member ike gateway gateway ike-policy ike_pol set security group-vpn member ike gateway gateway address 20.1.1.1 set security group-vpn member ike gateway gateway local-address 20.1.1.3 set security group-vpn member ipsec vpn gvpn ike-gateway gateway set security group-vpn member ipsec vpn gvpn group-vpn-external-interface ge-2/0/0.0 set security group-vpn member ipsec vpn gvpn group 1 set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-2/0/1.0 set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-2/0/0.0 set security policies from-zone trust to-zone untrust policy scope1 match source-address any set security policies from-zone trust to-zone untrust policy scope1 match destination-address any set security policies from-zone trust to-zone untrust policy scope1 match application any set security policies from-zone trust to-zone untrust policy scope1 then permit tunnel ipsec-group-vpn gvpn set security policies from-zone untrust to-zone trust policy scope1 match source-address any set security policies from-zone untrust to-zone trust policy scope1 match destination-address any set security policies from-zone untrust to-zone trust policy scope1 match application any set security policies from-zone untrust to-zone trust policy scope1 then permit tunnel ipsec-group-vpn gvpn set security policies default-policy deny-all
version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname User1 ! boot-start-marker boot-end-marker ! logging message-counter syslog logging buffered 4096 no logging console enable password <password> ! no aaa new-model ! ! ! dot11 syslog ip source-route ! ! ip cef ! ! no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! voice-card 0 ! ! ! username user password 0 <password> ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 lifetime 3600 crypto isakmp key juniper address 20.1.1.1 ! ! crypto gdoi group group1 identity number 1 server address ipv4 20.1.1.1 ! ! crypto map map-group1 10 gdoi set group group1 ! archive log config hidekeys ! ! ! ! ! ! interface GigabitEthernet0/0 ip address 192.168.99.1 255.255.255.0 duplex auto speed auto ! interface GigabitEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet0/0/0 ip address 10.157.92.144 255.255.224.0 duplex auto speed auto ! interface FastEthernet0/1/0 ip address 20.1.1.2 255.255.255.0 duplex auto speed auto crypto map map-group1 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 10.157.64.1 ip route 100.2.0.0 255.255.0.0 100.1.0.2 ip route 192.168.100.0 255.255.255.0 20.1.1.3 no ip http server no ip http secure-server ! ! ! access-list 1 permit 100.0.0.0 0.0.0.255 access-list 2 permit 100.1.0.1 ! ! ! ! ! ! control-plane ! ! ! ! mgcp fax t38 ecm ! ! ! ! ! ! line con 0 login local line aux 0 line vty 0 4 privilege level 15 login local transport input telnet line vty 5 15 privilege level 15 login local transport input telnet ! scheduler allocate 20000 1000 end
version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname User2 ! boot-start-marker boot-end-marker ! logging message-counter syslog enable password <password> ! no aaa new-model ! ! ! dot11 syslog ip source-route ! ! ip cef ! ! no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! voice-card 0 ! ! ! username user password 0 <password> ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp key juniper address 10.1.1.13 crypto isakmp key juniper address 10.1.1.35 crypto isakmp key juniper address 20.1.1.2 crypto isakmp key juniper address 20.1.1.3 ! ! crypto ipsec transform-set esp-3des-sha esp-3des esp-sha-hmac ! crypto ipsec profile get-vpn set security-association lifetime seconds 350 set transform-set esp-3des-sha ! crypto gdoi group g1 identity number 1 server local no rekey retransmit sa ipsec 1 profile get-vpn match address ipv4 199 no replay address ipv4 20.1.1.1 ! crypto gdoi group group1 ! Incomplete GDOI Group Configuration ! No Group Identity Configured ! No server type configured ! archive log config hidekeys ! ! ! ! ! ! interface GigabitEthernet0/0 no ip address shutdown duplex auto speed auto ! interface GigabitEthernet0/1 ip address 20.1.1.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet0/0/0 ip address 10.157.92.146 255.255.224.0 duplex auto speed auto ! interface FastEthernet0/1/0 no ip address shutdown duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 10.157.64.1 no ip http server no ip http secure-server ! ! ! access-list 199 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 ! ! ! ! ! ! control-plane ! ! ! ! mgcp fax t38 ecm ! ! ! ! ! ! line con 0 login local line aux 0 line vty 0 4 privilege level 15 login local transport input telnet line vty 5 15 privilege level 15 login local transport input telnet ! scheduler allocate 20000 1000 end
2020-02-06: minor non-technical changes. 2020-02-18: minor non-technical changes.