This article provides a configuration example for enabling IPsec VPNs using Equal Cost Multi Path (ECMP) for peer reachability.
Network topologies may require a need for SRX IPsec VPNs to use ECMP allowing establishment of 2 VPN tunnels using different egress interfaces to same peer IP.
Example:
Main configuration of SRX-1 :
set security ike proposal ike-p1-proposal authentication-method pre-shared-keys set security ike proposal ike-p1-proposal dh-group group2 set security ike proposal ike-p1-proposal authentication-algorithm sha1 set security ike proposal ike-p1-proposal encryption-algorithm aes-128-cbc set security ike policy ike-p1-policy mode main set security ike policy ike-p1-policy proposals ike-p1-proposal set security ike policy ike-p1-policy pre-shared-key ascii-text juniper set security ike gateway gw-1 ike-policy ike-p1-policy set security ike gateway gw-1 address 30.1.1.1 set security ike gateway gw-1 external-interface ge-0/0/0.0 set security ike gateway gw-2 ike-policy ike-p1-policy set security ike gateway gw-2 address 30.1.1.1 set security ike gateway gw-2 external-interface ge-0/0/1.0 set security ipsec proposal ipsec-p2-proposal protocol esp set security ipsec proposal ipsec-p2-proposal authentication-algorithm hmac-sha1-96 set security ipsec policy ipsec-p2-policy perfect-forward-secrecy keys group2 set security ipsec policy ipsec-p2-policy proposals ipsec-p2-proposal set security ipsec vpn ike-vpn-gw1 bind-interface st0.0 set security ipsec vpn ike-vpn-gw1 ike gateway gw-1 set security ipsec vpn ike-vpn-gw1 ike ipsec-policy ipsec-p2-policy set security ipsec vpn ike-vpn-gw1 establish-tunnels immediately set security ipsec vpn ike-vpn-gw2 bind-interface st0.1 set security ipsec vpn ike-vpn-gw2 ike gateway gw-2 set security ipsec vpn ike-vpn-gw2 ike ipsec-policy ipsec-p2-policy set security ipsec vpn ike-vpn-gw2 establish-tunnels immediately set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust interfaces ge-0/0/1.0 set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone vpn host-inbound-traffic system-services all set security zones security-zone vpn interfaces st0.0 set security zones security-zone vpn interfaces st0.1 set interfaces ge-0/0/0 unit 0 family inet address 10.1.1.1/24 set interfaces ge-0/0/1 unit 0 family inet address 20.1.1.1/24 set interfaces st0 unit 0 family inet set interfaces st0 unit 1 family inet set routing-options static route 30.1.1.0/24 next-hop 10.1.1.2 set routing-options static route 30.1.1.0/24 next-hop 20.1.1.2 set routing-options forwarding-table export load-balancing-policy <<< For ECMP set policy-options policy-statement load-balancing-policy then load-balance per-packet << <For ECMP</span>
Main configuration of SRX-2 :
set security ike proposal ike-p1-proposal authentication-method pre-shared-keys set security ike proposal ike-p1-proposal dh-group group2 set security ike proposal ike-p1-proposal authentication-algorithm sha1 set security ike proposal ike-p1-proposal encryption-algorithm aes-128-cbc set security ike policy ike-p1-policy mode main set security ike policy ike-p1-policy proposals ike-p1-proposal set security ike policy ike-p1-policy pre-shared-key ascii-text juniper set security ike gateway gw-1 ike-policy ike-p1-policy set security ike gateway gw-1 address 10.1.1.1 set security ike gateway gw-1 external-interface ge-0/0/0.0 set security ike gateway gw-2 ike-policy ike-p1-policy set security ike gateway gw-2 address 20.1.1.1 set security ike gateway gw-2 external-interface ge-0/0/0.0 set security ipsec proposal ipsec-p2-proposal protocol esp set security ipsec proposal ipsec-p2-proposal authentication-algorithm hmac-sha1-96 set security ipsec policy ipsec-p2-policy perfect-forward-secrecy keys group2 set security ipsec policy ipsec-p2-policy proposals ipsec-p2-proposal set security ipsec vpn ike-vpn-gw1 bind-interface st0.0 set security ipsec vpn ike-vpn-gw1 ike gateway gw-1 set security ipsec vpn ike-vpn-gw1 ike ipsec-policy ipsec-p2-policy set security ipsec vpn ike-vpn-gw2 bind-interface st0.1 set security ipsec vpn ike-vpn-gw2 ike gateway gw-2 set security ipsec vpn ike-vpn-gw2 ike ipsec-policy ipsec-p2-policy set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone vpn host-inbound-traffic system-services all set security zones security-zone vpn interfaces st0.0 set security zones security-zone vpn interfaces st0.1 set interfaces ge-0/0/0 unit 0 family inet address 30.1.1.1/24 set interfaces st0 unit 0 family inet set interfaces st0 unit 1 family inet set routing-options static route 0.0.0.0/0 next-hop 30.1.1.2
SRX-1:
# run show route forwarding-table | find "30.1.1.0" 30.1.1.0/24 user 0 ulst 262142 2 10.1.1.2 ucst 1342 3 ge-0/0/0.0 20.1.1.2 ucst 1347 2 ge-0/0/1.0 # run show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 3607558 UP 11db6a93c908f2e1 449b8fdd5e1b585c Main 30.1.1.1 3607559 UP 28139f1968036459 e00e660ebd080747 Main 30.1.1.1 [edit] # run show security ipsec security-associations Total active tunnels: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP: sha1 d74e4b1a 1764/ unlim - root 500 30.1.1.1 >131073 ESP: sha1 3ede9a74 1764/ unlim - root 500 30.1.1.1 <131074 ESP: sha1 8bb86967 1764/ unlim - root 500 30.1.1.1 >131074 ESP: sha1 a2011257 1764/ unlim - root 500 30.1.1.1
# run show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 2491525 UP 11db6a93c908f2e1 449b8fdd5e1b585c Main 10.1.1.1 2491526 UP 28139f1968036459 e00e660ebd080747 Main 20.1.1.1 [edit] # run show security ipsec security-associations Total active tunnels: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP: sha1 3ede9a74 1733/ unlim - root 500 10.1.1.1 >131073 ESP: sha1 d74e4b1a 1733/ unlim - root 500 10.1.1.1 <131074 ESP: sha1 a2011257 1733/ unlim - root 500 20.1.1.1 >131074 ESP: sha1 8bb86967 1733/ unlim - root 500 20.1.1.1