Article Detail

Description

This article provides an example of how to configure a Manual Key IPsec VPN between an SRX device and a ScreenOS device.

Symptoms

For the manual key IPsec VPN, there is no need to configure an Internet Key Exchange (IKE). However, the following must be manually defined in the IPSEC: SPI value encryption key authentication key :

SRX allows only one SPI for both the IN/OUT direction, so ScreenOS must config the same SPI for the IN/OUT direction in order to work with SRX.
SRX uses DEC to define the SPI, while ScreenOS uses HEX.
NS accepts either a key or a password in the Authentication and Encryption key, whereas the SRX accepts only a key.
When a password is used in NS, the corresponding key can be extracted from the Web UI in NS, which can then be used to configure the SRX.
When a key is used in both NS and SRX, the key-length varies depending on the Authentication and Encryption algorithm. In addition, NS accepts a key in HEX only, whereas the SRX accepts a key in both ASCII or HEX.
The rest of the configuration (for example, the tunnel interface/route-based or policy-based VPN) is similar to a typical VPN configuration.

Solution

Topology

              +–––––––––––––––+              +–––––––––––––––+             
              |               |              |               |             
              |               +––––––––––––––+               |             
+–––––––––––––+   SRX240      |  Manual VPN  |    NS208      +––––––––––––+
              |               +––––––––––––––+               |             
              |               |              |               |             
              +–––––––––––––––+              +–––––––––––––––+             
                         ge-0/0/0          e1                              
                         172.27.6.100      172.27.6.38

Configuration

Example below illustrates configuration of Manual IPsec in NS and SRX using key as Authentication and Encryption key.

[ NS ]
set vpn "to-srx240ea" id 1 manual 1070 1070 gateway 172.27.6.100 outgoing-interface "ethernet1" esp 3des key 3132333435363738,3930313233343536,373839303132333 4 auth sha-1 key 3132333435363738,3930313233343536,37383930

[ SRX ]
set security ipsec vpn to-208a manual gateway 172.27.6.38 set security ipsec vpn to-208a manual external-interface ge-0/0/0.0 set security ipsec vpn to-208a manual protocol esp set security ipsec vpn to-208a manual spi 4208 set security ipsec vpn to-208a manual authentication algorithm hmac-sha1-96 set security ipsec vpn to-208a manual authentication key hexadecimal 3132333435363738393031323334353637383930 set security ipsec vpn to-208a manual encryption algorithm 3des-cbc set security ipsec vpn to-208a manual encryption key hexadecimal 313233343536373839303132333435363738393031323334

Note:

SPI in NS is in HEX (1070), which corresponds to 4208 in the SRX.
NS must define the SAME LOCAL/REMOTE SPI to interoperate with SRX.
NS must have 192-bits (24bytes) for the encryption key for 3DES, and 20bytes for the authentication key for SHA1.

Example below illustrates configuration of Manual IPsec in NS and SRX with juniper123/Juniper123 as the Encryption and Authentication password.

[ NS ]
set vpn "to-srx240ea" id 1 manual 1070 1070 gateway 172.27.6.100 outgoing-interface "ethernet1" esp 3des password juniper123 auth sha-1 password Juniper123
[ SRX ]
set security ipsec vpn to-208a manual gateway 172.27.6.38 set security ipsec vpn to-208a manual external-interface ge-0/0/0.0 set security ipsec vpn to-208a manual protocol esp set security ipsec vpn to-208a manual spi 4208 set security ipsec vpn to-208a manual authentication algorithm hmac-sha1-96 set security ipsec vpn to-208a manual authentication key hexadecimal 94eadcd3e0cb292ff897524c6d55869fc5b856cb set security ipsec vpn to-208a manual encryption algorithm 3des-cbc set security ipsec vpn to-208a manual encryption key hexadecimal d5eadcd3e0cb292feea681bd8cb6a7b058747363746e9fe8

Note:

When a password is used in NS, the HEX key can be extracted from the Web UI as shown in the figure below.
To extract the Hex Key in the Web UI, perform the following procedure:
- Open a Web UI in the NS.
- Go to VPN >Manual key .
- Edit the configured VPN. (The HEX Key is shown in the figure below.)
- Use the HEX Key to configure the encryption/authentication key in Manual VPN in the SRX.
- Extract the HEX key from the Web UI of NS, then configure SRX using this HEX key.

alt

Example below illustrates remainder of configuration using policy-based VPN.

[NS208] set address "Trust" "ns-host" 10.10.10.100 255.255.255.255 set address "Untrust" "srx-host" 192.168.166.100 255.255.255.255 set policy id 1 from "Untrust" to "Trust" "srx-host" "ns-host" "ANY" tunnel vpn "to-srx240ea" set policy id 2 from "Trust" to "Untrust" "ns-host" "srx-host" "ANY" tunnel vpn "to-srx240ea" [SRX240] set security policies from-zone untrust to-zone trust policy u2t-208a match source-address ns-host set security policies from-zone untrust to-zone trust policy u2t-208a match destination-address srx-host set security policies from-zone untrust to-zone trust policy u2t-208a match application any set security policies from-zone untrust to-zone trust policy u2t-208a then permit tunnel ipsec-vpn to-208a set security policies from-zone trust to-zone untrust policy t2u-208a match source-address srx-host set security policies from-zone trust to-zone untrust policy t2u-208a match destination-address ns-host set security policies from-zone trust to-zone untrust policy t2u-208a match application any set security policies from-zone trust to-zone untrust policy t2u-208a then permit tunnel ipsec-vpn to-208a set security zones security-zone trust address-book address srx-host 192.168.166.100/32 set security zones security-zone untrust address-book address ns-host 10.10.10.100/32

Verify VPN connection

The IPsec SA status shown below is M . This means Manual in the NS. The SPI uses the HEX value. The value is the same in both the IN/OUT directions.

208 a-> get sa total configured sa: 2 HEX ID Gateway Port Algorithm SPI Life:sec kb Sta PID vsys 00000001< 172.27.6.100 500 esp:3des/sha1 00001070 n/a n/a M/- 1 0 00000001> 172.27.6.100 500 esp:3des/sha1 00001070 n/a n/a M/- 2 0

Similar to IPsec SA in NS, SRX shows SPI in HEX. SPI is the same in the IN/OUT direction. Also, lifetime is blank, because this is a manual VPN.

lab@ srx240 ea.hk> show security ipsec security-associations Total active tunnels: 1 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP:3des/sha1 1070 - root 500 172.27.6.38 >131073 ESP:3des/sha1 1070 - root 500 172.27.6.38

IPsec SA details show a manual IPsec. The SA is not initiated, as expected, because the Manual VPN needs no negotiation.

lab@ srx240 ea.hk> show security ipsec security-associations detail ID: 131073 Virtual-system: root, VPN Name: to-208a Local Gateway: 172.27.6.100, Remote Gateway: 172.27.6.38 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv1 DF-bit: clear Policy-name: u2t-208a Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 600821 Tunnel Down Reason: SA not initiated Direction: inbound, SPI: 1070, AUX-SPI: 0 Mode: Tunnel(0 0), Type: manual , State: installed, VPN Monitoring: - Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc Anti-replay service: disabled Direction: outbound, SPI: 1070, AUX-SPI: 0 Mode: Tunnel(0 0), Type: manual, State: installed, VPN Monitoring: - Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc Anti-replay service: disabled

Troubleshooting

If the SPI is not configured correctly, the event log below is shown. The SPI in the SRX is configured as DEC 1070 (HEX 0x42e) instead of HEX 1070 .

2014-01-27 04:50:15 system alert 00026 IPSec tunnel on interface ethernet1 with tunnel ID 0x1 received a packet with a bad SPI. 172.27.6.100->172.27.6.38/136, ESP, SPI 0x42e , SEQ 0x2e.

After respond-bad-spi is configured for the SRX, the message log below is shown:

lab@ srx240 ea.hk> show configuration | display set | match spi set security ike respond-bad-spi 1

Jan 27 16:01:49 srx240ea.hk RT_IPSEC: RT_IPSEC_BAD_SPI: IPSec tunnel on int ge-0/0/0.0 with tunnel ID 0x20001 received a packet with a bad SPI . 172.27.6.38->172.27.6.100/184, ESP, SPI 0x1071, SEQ 0xc.

If the authentication/encryption key does not match, the error below is shown in the debug flow basic of the NS:

208 b-> get db str ****** 19698061.0: <Untrust/ethernet1> packet received [136]****** ipid = 3982(0f8e), @d780d110 packet passed sanity check. ethernet1:172.27.6.100/0->172.27.6.38/1070,50 <Root> lookup tunnel sess with port 0x00000000 existing session found. sess token 6 flow got session. flow session id 127736 flow_decrypt: 4bd65f8(f), flow_decrypt: 4bd65f8(f)pipeline. IPv4 encrypted pak. Dec: SPI = 0000042e, Data Len = 136 SA tunnel id=0x00000001, flag<00000003> ipsec_dec_np:Cannot locate spi, sa_type<50> dst<172.27.6.38> src<172.27.6.100> spi<42e> seq<29> enqueue to IKE: timems -1777051543, Q 3, saidx 0: spi:42e error -4 packet dropped for sa <0> (n)

Related Information

KB21221 - [SRX] Configure Manual Key IPSec VPN on SRX devices [juniper.net]