Description

This article demonstrates how to create an IPsec tunnel between IXIA endpoints that are passing through an SRX firewall by using the IxLoad plug-in. 

Symptoms

IxLoad’s IPsec plug-in provides IPsec site-to-site VPN for validating the performance and capacity of IPsec VPNs. It loads modules that implement a full IKE and IPsec protocol stack that emulates hundreds and thousands of secure gateways or IPsec clients and uses real application traffic over encrypted tunnels. 

Features that it supports:

  • Site-to-site and remote access test scenarios

  • IPsec initiator and responder modes

  • VLAN support

  • NAT-T

  • IPsec pre-fragmentation

  • IPsec post-fragmentation

  • Initial contact payload

  • IKEv2 redirect

  • Multiple Traffic Selectors (IKEv2)

  • IPsec over GRE

  • Multiple P2 over P1

For more details, refer to IxLoad: IPSEC and Network Access Test Solution .

Solution

Topology

Steps to create IPsec site-to-site VPN with IKEv1

  1. Create the Originate Network and the Terminate Network.

  2. Add an HTTP Client on Originate and an HTTP Server on Terminate and connect them.

alt

  1. Add the IXIA chassis ports.

alt

  1. Click Network and navigate to Home > Network Wizards > IPsec wizard .

alt

  1. Select the following options for each specified selection:

    • IPsec Test Type: Port to Port

    • IPsec Test Scenario: Site to Site

    • IKE Version: IKEv1

    • Number of IPsec tunnels Per Range: 100

    • Network 1: Initiator; Network 2: Responder

alt

  1. Configure Phase 1 and Phase 2 parameters.

alt

  1. Configure IP addresses.

    • Public/Private IP addresses: The Phase1/Phase 2 tunnel will establish between these IP addresses.

    • Emulated/Protected Subnets: Include details about the networks that communicate behind the VPN host.

alt

  1. Emulated Router Configuration: Include the interface IP addresses on either side to reach the gateway.

alt

  1. Retain the defaults for the MAC configuration.

alt

  1. Retain the default for the VLAN configuration as well.

alt

  1. Select "Generate and Overwrite Existing Configuration."

alt

  1. Click Network 1 > Emulated Router and change the gateway to 10.1.1.1.

alt

  1. Click Network 2 > Emulated Router and change the gateway to 20.1.1.1.

alt

  1. Click Start to run tests for 100 IPsec tunnels.

  2. Show the security flow session summary.

    • Sessions-in-use: 100

    • Valid sessions: 100

SRX Configuration 

set  interfaces fxp0 unit 0 family inet address 10.10.10.10/26
set  routing-options static route 0.0.0.0/0 next-hop 10.10.10.1
set security policies from-zone LAN to-zone WAN policy LAN_WAN match source-address any
set security policies from-zone LAN to-zone WAN policy LAN_WAN match destination-address any
set security policies from-zone LAN to-zone WAN policy LAN_WAN match application any
set security policies from-zone LAN to-zone WAN policy LAN_WAN then permit
set security policies from-zone WAN to-zone LAN policy WAN_LAN match source-address any
set security policies from-zone WAN to-zone LAN policy WAN_LAN match destination-address any
set security policies from-zone WAN to-zone LAN policy WAN_LAN match application any
set security policies from-zone WAN to-zone LAN policy WAN_LAN then permit
set security zones security-zone LAN interfaces xe-1/2/0.0 host-inbound-traffic system-services all
set security zones security-zone WAN interfaces xe-1/2/1.0 host-inbound-traffic system-services all
set interfaces xe-1/2/0 unit 0 family inet address 10.1.1.1/16
set interfaces xe-1/2/1 unit 0 family inet address 20.1.1.1/16
set routing-options static route 30.1.1.0/24 next-hop 10.1.1.2
set routing-options static route 70.1.1.0/24 next-hop 20.1.1.2