This article contains a configuration example of site-to-site, policy-based VPNs between SRX and Cisco ASA, with multiple networks behind the SRX and ASA, and full mesh traffic between the networks . For additional configuration examples, see KB28861 - Examples – Configuring site-to-site VPNs between SRX and Cisco ASA [juniper.net] . For related technical documentation, see IPsec VPN Feature Guide for Security Devices .
Goal:
Network Topology: Traffic patterns for above topology Full mesh Vpn traffic between all four subnets i.e 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24, 192.168.4.0/24.
Configuration for SRX
root# show |no-more system { root-authentication { encrypted-password “$ABC123"; ## SECRET-DATA } services { ssh; telnet; xnm-clear-text; } syslog { archive size 100k files 3; user * { any emergency; } file messages { any critical; authorization info; } file interactive-commands { interactive-commands error; } } } interfaces { ge-0/0/0 { unit 0 { family inet { address 100.1.1.2/24; } } } ge-0/0/1 { unit 0 { family inet { address 192.168.2.1/24; } } } ge-0/0/2 { unit 0 { family inet { address 192.168.3.1/24; } } } } routing-options { static { route 0.0.0.0/0 next-hop 100.1.1.1; } } security { ike { proposal ike-phase1-proposal { authentication-method pre-shared-keys; dh-group group2; authentication-algorithm sha1; encryption-algorithm 3des-cbc; lifetime-seconds 86400; } policy ike-phase1-policy { mode main; proposals ike-phase1-proposal; pre-shared-key ascii-text "$9$erkW87g4ZjkPLxZj"; ## SECRET-DATA } gateway gw-Chicago { ike-policy ike-phase1-policy; address 100.1.1.1; external-interface ge-0/0/0; } } ipsec { proposal ipsec-phase2-proposal { protocol esp; authentication-algorithm hmac-md5-96; encryption-algorithm des-cbc; lifetime-seconds 28800; } policy ipsec-phase2-policy { perfect-forward-secrecy { keys group2; } proposals ipsec-phase2-proposal; } vpn ike-vpn-Chicago { ike { gateway gw-Chicago; ipsec-policy ipsec-phase2-policy; } establish-tunnels immediately; } } policies { from-zone trust to-zone untrust { policy vpn-tr-untr { match { source-address Sunnyvale; destination-address Chicago; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } policy vpn-tr-untr_1 { match { source-address Sunnyvale; destination-address Chicago_2; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } policy vpn-tr-untr_2 { match { source-address Sunnyvale_2; destination-address Chicago_2; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } policy vpn-tr-untr_3 { match { source-address Sunnyvale_2; destination-address Chicago; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } } from-zone untrust to-zone trust { policy vpn-untr-tr { match { source-address Chicago; destination-address Sunnyvale; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } policy vpn-untr-tr_1 { match { source-address Chicago; destination-address Sunnyvale_2; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } policy vpn-untr-tr_2 { match { source-address Chicago_2; destination-address Sunnyvale; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } policy vpn-untr-tr_3 { match { source-address Chicago_2; destination-address Sunnyvale_2; application any; } then { permit { tunnel { ipsec-vpn ike-vpn-Chicago; } } } } } } zones { security-zone trust { address-book { address Sunnyvale 192.168.2.0/24; address Sunnyvale_2 192.168.3.0/24; } host-inbound-traffic { system-services { all; } } interfaces { ge-0/0/1.0; ge-0/0/2.0; } } security-zone untrust { address-book { address Chicago 192.168.1.0/24; address Chicago_2 192.168.4.0/24; } host-inbound-traffic { system-services { ike; } } interfaces { ge-0/0/0.0; } } } }
Interface Configuration: -------------------------------------------------------- ! interface GigabitEthernet0 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface GigabitEthernet1 nameif outside security-level 0 ip address 100.1.1.1 255.255.255.0 ! interface GigabitEthernet2 nameif inside-2 security-level 100 ip address 192.168.4.1 255.255.255.0 ! Policy Configuration : --------------------------------------------------------------------------------------------- access-list s2s extended permit ip 192.168.4.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list s2s extended permit ip 192.168.4.0 255.255.255.0 192.168.3.0 255.255.255.0 access-list s2s extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list s2s extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0 IPSEC/IKE Configuration : ---------------------------------------------------------------------------------------------- crypto ipsec ikev1 transform-set CISCO esp-des esp-md5-hmac crypto map outside_map 20 match address s2s crypto map outside_map 20 set pfs crypto map outside_map 20 set peer 100.1.1.2 crypto map outside_map 20 set ikev1 transform-set CISCO crypto map outside_map 20 set security-association lifetime seconds 28800 crypto map outside_map interface outside crypto isakmp identity address no crypto isakmp nat-traversal crypto ikev1 enable outside crypto ikev1 policy 20 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 tunnel-group 100.1.1.2 type ipsec-l2l tunnel-group 100.1.1.2 ipsec-attributes ikev1 pre-shared-key *****
SRX:
root>show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 6264927 UP 52959d5a2d434e9a 17dd29031f5900a1 Main 100.1.1.1 root>show security ipsec security-associations Total active tunnels: 4 ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway <2 ESP:des/ md5 7cb671d3 27630/unlim - root 500 100.1.1.1 >2 ESP:des/ md5 511ecbc2 27630/unlim - root 500 100.1.1.1 <3 ESP:des/ md5 aeabf790 27689/unlim - root 500 100.1.1.1 >3 ESP:des/ md5 3ff617aa 27689/unlim - root 500 100.1.1.1 <4 ESP:des/ md5 a6aa22f8 27689/unlim - root 500 100.1.1.1 >4 ESP:des/ md5 2ba33701 27689/unlim - root 500 100.1.1.1 <5 ESP:des/ md5 79fc6420 27689/unlim - root 500 100.1.1.1 >5 ESP:des/ md5 bb9bb558 27689/unlim - root 500 100.1.1.1 root>show security ipsec security-associations detail | no-more Virtual-system: root Local Gateway: 100.1.1.2, Remote Gateway: 100.1.1.1 Local Identity: ipv4_subnet(any:0,[0..7]=192.168.2.0/24) Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.1.0/24) Version: IKEv1 DF-bit: clear Policy-name: vpn-tr-untr Direction: inbound, SPI: 7cb671d3, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27508 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26886 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 511ecbc2, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27508 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26886 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Virtual-system: root Local Gateway: 100.1.1.2, Remote Gateway: 100.1.1.1 Local Identity: ipv4_subnet(any:0,[0..7]=192.168.2.0/24) Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.4.0/24) Version: IKEv1 DF-bit: clear Policy-name: vpn-tr-untr_1 Direction: inbound, SPI: aeabf790, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27567 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26933 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 3ff617aa, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27567 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26933 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Virtual-system: root Local Gateway: 100.1.1.2, Remote Gateway: 100.1.1.1 Local Identity: ipv4_subnet(any:0,[0..7]=192.168.3.0/24) Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.4.0/24) Version: IKEv1 DF-bit: clear Policy-name: vpn-tr-untr_2 Direction: inbound, SPI: a6aa22f8, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27567 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26944 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 2ba33701, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27567 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26944 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Virtual-system: root Local Gateway: 100.1.1.2, Remote Gateway: 100.1.1.1 Local Identity: ipv4_subnet(any:0,[0..7]=192.168.3.0/24) Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.1.0/24) Version: IKEv1 DF-bit: clear Policy-name: vpn-tr-untr_3 Direction: inbound, SPI: 79fc6420, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27567 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26929 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: bb9bb558, AUX-SPI: 0 , VPN Monitoring: - Hard lifetime: Expires in 27567 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 26929 seconds Mode: Tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc Anti-replay service: counter-based enabled, Replay window size: 64 root>show security ipsec statistics ESP Statistics: Encrypted bytes: 20480 Decrypted bytes: 3944 Encrypted packets: 150 Decrypted packets: 46 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication failures: 0, Replay errors: 0 ESP authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0
2020-02-21: Changed encrypted password to “$ABC123".