This article contains a configuration example of a site-to-site, route-based VPN between a Juniper Networks SRX and Cisco ASA device. For additional configuration examples, see KB28861 - Examples – Configuring site-to-site VPNs between SRX and Cisco ASA [juniper.net] . For related technical documentation, see IPsec VPN Feature Guide for Security Devices .
Goal:
Network Topology:
Configuration for SRX
root# show |no-more system { root-authentication { encrypted-password “$ABC123"; ## SECRET-DATA } services { ssh; telnet; xnm-clear-text; } syslog { archive size 100k files 3; user * { any emergency; } file messages { any critical; authorization info; } file interactive-commands { interactive-commands error; } } } interfaces { ge-0/0/0 { unit 0 { family inet { address 100.1.1.2/24; } } } ge-0/0/1 { unit 0 { family inet { address 192.168.2.1/24; } } } st0 { unit 0 { family inet; } } } routing-options { static { route 0.0.0.0/0 next-hop 100.1.1.1; route 192.168.1.0/24 next-hop st0.0; } } security { ike { proposal ike-phase1-proposal { authentication-method pre-shared-keys; dh-group group2; authentication-algorithm sha1; encryption-algorithm 3des-cbc; lifetime-seconds 86400; } policy ike-phase1-policy { mode main; proposals ike-phase1-proposal; pre-shared-key ascii-text "$9$6qsMAtOrlMXNbp0MX"; ## SECRET-DATA } gateway gw-chicago { ike-policy ike-phase1-policy; address 100.1.1.1; external-interface ge-0/0/0.0; } } ipsec { proposal ipsec-phase2-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm des-cbc; lifetime-seconds 28800; } policy ipsec-phase2-policy { perfect-forward-secrecy { keys group2; } proposals ipsec-phase2-proposal; } vpn ike-vpn-chicago { bind-interface st0.0; ike { gateway gw-chicago; proxy-identity { local 192.168.2.0/24; remote 192.168.1.0/24; service any; } ipsec-policy ipsec-phase2-policy; } establish-tunnels immediately; } } policies { from-zone trust to-zone untrust { policy vpn-tr-untr { match { source-address sunnyvale; destination-address chicago; application any; } then { permit; } } } from-zone untrust to-zone trust { policy vpn-untr-tr { match { source-address chicago; destination-address sunnyvale; application any; } then { permit; } } zones { security-zone trust { address-book { address sunnyvale 192.168.2.0/24; } host-inbound-traffic { system-services { all; } } interfaces { ge-0/0/1.0; } } security-zone untrust { address-book { address chicago 192.168.1.0/24; } host-inbound-traffic { system-services { ike; } } interfaces { ge-0/0/0.0; st0.0; } } } }
Interface Configuration: ------------------------------------------------------------------------------------------------------------------ ! interface GigabitEthernet0 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface GigabitEthernet1 nameif outside security-level 0 ip address 100.1.1.1 255.255.255.0 ! Policy Configuration : ------------------------------------------------------------------------------------------------------------------ access-list s2s extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 IPSEC/IKE Configuration : ----------------------------------------------------------------------------------------------------------------- crypto ipsec ikev1 transform-set CISCO esp-des esp-md5-hmac crypto map outside_map 20 match address s2s crypto map outside_map 20 set pfs crypto map outside_map 20 set peer 100.1.1.2 crypto map outside_map 20 set ikev1 transform-set CISCO crypto map outside_map 20 set security-association lifetime seconds 28800 crypto map outside_map interface outside crypto isakmp identity address no crypto isakmp nat-traversal crypto ikev1 enable outside crypto ikev1 policy 20 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 tunnel-group 100.1.1.2 type ipsec-l2l tunnel-group 100.1.1.2 ipsec-attributes ikev1 pre-shared-key *****
SRX:
root> show security ike sa Index State Initiator cookie Responder cookie Mode Remote Address 778322 UP 8858011cc0881359 e5ecd6302f0306b0 Main 100.1.1.1 root> show security ipsec sa Total active tunnels: 1 ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway <131073 ESP:des/ md5 fb0a0946 28765/unlim - root 500 100.1.1.1 >131073 ESP:des/ md5 11f6197b 28765/unlim - root 500 100.1.1.1 root> show security ipsec sa detail ID: 131073 Virtual-system: root, VPN Name: ike-vpn-chicago Local Gateway: 100.1.1.2, Remote Gateway: 100.1.1.1 Local Identity: ipv4_subnet(any:0,[0..7]=192.168.2.0/24) Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.1.0/24) Version: IKEv1 DF-bit: clear Bind-Interface:st0.0 Direction: inbound, SPI: 22abf60, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 28571 seconds Lifesize Remaining: 4607999 kilobytes Soft lifetime: Expires in 27982 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: ccb96ffb, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 28571 seconds Lifesize Remaining: 4607999 kilobytes Soft lifetime: Expires in 27982 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 root> show security ipsec statistics | no-more ESP Statistics: Encrypted bytes: 1842192 Decrypted bytes: 1210704 Encrypted packets: 12144 Decrypted packets: 12144 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication failures: 0, Replay errors: 0 ESP authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0
2020-02-21: Changed encrypted password to “$ABC123".