Juniper SRX and Cisco run ipsec vpn + OSPF

Today, we will demonstrate how the Juniper SRX Firewall runs ipsec vpn + OSPF with Cisco routers.

Topology:

650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/133822237.png "title =" 1.PNG" alt = "133822237.png"/>

R1 simulates a cisco device, which is equivalent to a branch site. R2 simulates a carrier device, C1 is a zhuyun device, and bridging with SRX, which is equivalent to a firewall headquarters.) R3 simulates internal routers.

8.8.8.8 and 9.9.9 are used to simulate users behind R3, and 10.10.10.10 is used to simulate users behind R3.

Configuration:

1. ISP

Int e0/0

Ip add 200.1.1.1 255.255.255.0

No sh

Int e0/1

Ip add 200.1.2.1 255.255.255.0

ISP configuration is enough. No other configuration is required. The advantage of VPN is that it has cheated the ISP. Therefore, the ISP does not need to run the routing protocol.

2. R1

Crypto isakmp policy 10

Encr 3des

Hash md5

Authentication pre-share

Group 2

Crypto isakmp key cisco address 200.1.2.2

!

!

Crypto ipsec transform-set cisco esp-3des esp-md5-hmac

!

Crypto ipsec profile ipsecprof

Set transform-set cisco

Interface Loopback0

Ip address 8.8.8.8 255.255.255.0

Ip ospf 110 area 0

!

Interface Loopback1

Ip address 9.9.9 255.255.255.0

Ip ospf 110 area 0

!

Interface Tunnel0

Ip address 172.16.1.1 255.255.255.0

Ip ospf mtu-ignore

Ip ospf 110 area 0

Tunnel source 200.1.1.2

Tunnel destination 200.1.2.2

Tunnel mode ipsec ipv4

Tunnel protection ipsec profile ipsecprof

!

Interface Ethernet0/0

Ip address 200.1.1.2 255.255.255.0

Ip route 0.0.0.0 0.0.0.0 200.1.1.1

3. SRX

Version 12.1X44.4;

System {

Root-authentication {

Encrypted-password "$1 $91 AvSN/4 $ ernVRIttwUahn. nTXm8Mp/"; ## SECRET-DATA

}

Services {

Ssh;

Web-management {

Http {

Interface ge-0/0/0.0;

}

}

}

License {

Autoupdate {

Url https://ae1.juniper.net/junos/key_retrieval;

}

}

}

Interfaces {

Ge-0/0/0 {

Unit 0 {

Family inet {

Address 200.1.2.2/24;

}

}

}

Ge-0/0/1 {

Unit 0 {

Family inet {

Address 192.168.1.1/24;

}

}

}

St0 {

Unit 0 {

Family inet {

Address 172.16.1.2/24;

}

}

}

}

Routing-options {

Static {

Route 0.0.0.0/0 next-hop 200.1.2.1;

}

}

Protocols {

Ospf {

Area 0.0.0.0 {

Interface ge-0/0/1.0;

Interface st0.0;

}

}

}

Security {

Ike {

Proposal L2L-P1-Proposal {

Authentication-method pre-shared-keys;

Dh-group group2;

Authentication-algorithm md5;

Encryption-algorithm 3des-cbc;

}

Policy L2L-P1-Policy {

Mode main;

Proposals L2L-P1-Proposal;

Pre-shared-key ascii-text "$9 $ 7jVb2ji. 5z6wY. 5"; # SECRET-DATA

}

Gateway L2L-P1-Gateway {

Ike-policy L2L-P1-Policy;

Address 200.1.1.2;

External-interface ge-0/0/0.0;

}

}

Ipsec {

Proposal L2L-P2-Proposal {

Protocol esp;

Authentication-algorithm hmac-md5-96;

Encryption-algorithm 3des-cbc;

}

Policy L2L-P2-Policy {

Proposals L2L-P2-Proposal;

}

Vpn Route-vs-SVTI {

Bind-interface st0.0;

Ike {

Gateway L2L-P1-Gateway;

Proxy-identity {

Local 0.0.0.0/0;

Remote 0.0.0.0/0;

Service any;

}

Ipsec-policy L2L-P2-Policy;

}

Establish-tunnels immediately;

}

}

Screen {

Ids-option untrust-screen {

Icmp {

Ping-death;

}

Ip {

Source-route-option;

Tear-drop;

}

Tcp {

Syn-flood {

Alarm-threshold 1024;

Attack-threshold 200;

Source-threshold 1024;

Destination-threshold 2048;

Queue-size 2000; # Warning: 'queue-size' is deprecated

Timeout 20;

}

Land;

}

}

}

Policies {

From-zone trust to-zone SVTI {

Policy permit-all {

Match {

Source-address any;

Destination-address any;

Application any;

}

Then {

Permit;

}

}

}

From-zone SVTI to-zone trust {

Policy permit-all {

Match {

Source-address any;

Destination-address any;

Application any;

}

Then {

Permit;

}

}

}

}

Zones {

Security-zone untrust {

Interfaces {

Ge-0/0/0.0 {

Host-inbound-traffic {

System-services {

Ping;

Ssh;

Ike;

}

}

}

}

}

Security-zone SVTI {

Interfaces {

St0.0 {

Host-inbound-traffic {

Protocols {

Ospf;

}

}

}

}

}

Security-zone trust {

Interfaces {

Ge-0/0/1.0 {

Host-inbound-traffic {

System-services {

Ping;

}

Protocols {

Ospf;

}

}

}

}

}

}

}

[Edit]

4. R3

Int e0/0

Ip add 192.168.1.2 255.255.255.0

Ip OS 110 ar 0

No shut

Int l0

Ip add 10.10.10.10 255.255.255.0

Ip OS 110 ar 0

Test:

R1 view the route table and ping

650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/140814478.png "title =" 2.PNG" alt = "140814478.png"/>

SRX view route table

650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/141009142.png "title =" 3.PNG" alt = "141009142.png"/>

Ping

650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/141111250.png "title =" 4.PNG" alt = "141111250.png"/>

R3 view the route table and ping

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/04304133P-4.png "title =" 6.PNG" alt = "141221223.png"/>

After SRX configuration is complete, you must submit it. Otherwise, the configuration will not take effect, and the interface must allow ike ospf to PING the traffic.

This article is from the "Cisco, zhanbo, Huawei" blog, please be sure to keep this source http://rujinfeng.blog.51cto.com/2712746/1299689