Today, we will demonstrate how the Juniper SRX Firewall runs ipsec vpn + OSPF with Cisco routers.
Topology:
650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/133822237.png "title =" 1.PNG" alt = "133822237.png"/>
R1 simulates a cisco device, which is equivalent to a branch site. R2 simulates a carrier device, C1 is a zhuyun device, and bridging with SRX, which is equivalent to a firewall headquarters.) R3 simulates internal routers.
8.8.8.8 and 9.9.9 are used to simulate users behind R3, and 10.10.10.10 is used to simulate users behind R3.
Configuration:
1. ISP
Int e0/0
Ip add 200.1.1.1 255.255.255.0
No sh
Int e0/1
Ip add 200.1.2.1 255.255.255.0
ISP configuration is enough. No other configuration is required. The advantage of VPN is that it has cheated the ISP. Therefore, the ISP does not need to run the routing protocol.
2. R1
Crypto isakmp policy 10
Encr 3des
Hash md5
Authentication pre-share
Group 2
Crypto isakmp key cisco address 200.1.2.2
!
!
Crypto ipsec transform-set cisco esp-3des esp-md5-hmac
!
Crypto ipsec profile ipsecprof
Set transform-set cisco
Interface Loopback0
Ip address 8.8.8.8 255.255.255.0
Ip ospf 110 area 0
!
Interface Loopback1
Ip address 9.9.9 255.255.255.0
Ip ospf 110 area 0
!
Interface Tunnel0
Ip address 172.16.1.1 255.255.255.0
Ip ospf mtu-ignore
Ip ospf 110 area 0
Tunnel source 200.1.1.2
Tunnel destination 200.1.2.2
Tunnel mode ipsec ipv4
Tunnel protection ipsec profile ipsecprof
!
Interface Ethernet0/0
Ip address 200.1.1.2 255.255.255.0
Ip route 0.0.0.0 0.0.0.0 200.1.1.1
3. SRX
Version 12.1X44.4;
System {
Root-authentication {
Encrypted-password "$1 $91 AvSN/4 $ ernVRIttwUahn. nTXm8Mp/"; ## SECRET-DATA
}
Services {
Ssh;
Web-management {
Http {
Interface ge-0/0/0.0;
}
}
}
License {
Autoupdate {
Url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
Interfaces {
Ge-0/0/0 {
Unit 0 {
Family inet {
Address 200.1.2.2/24;
}
}
}
Ge-0/0/1 {
Unit 0 {
Family inet {
Address 192.168.1.1/24;
}
}
}
St0 {
Unit 0 {
Family inet {
Address 172.16.1.2/24;
}
}
}
}
Routing-options {
Static {
Route 0.0.0.0/0 next-hop 200.1.2.1;
}
}
Protocols {
Ospf {
Area 0.0.0.0 {
Interface ge-0/0/1.0;
Interface st0.0;
}
}
}
Security {
Ike {
Proposal L2L-P1-Proposal {
Authentication-method pre-shared-keys;
Dh-group group2;
Authentication-algorithm md5;
Encryption-algorithm 3des-cbc;
}
Policy L2L-P1-Policy {
Mode main;
Proposals L2L-P1-Proposal;
Pre-shared-key ascii-text "$9 $ 7jVb2ji. 5z6wY. 5"; # SECRET-DATA
}
Gateway L2L-P1-Gateway {
Ike-policy L2L-P1-Policy;
Address 200.1.1.2;
External-interface ge-0/0/0.0;
}
}
Ipsec {
Proposal L2L-P2-Proposal {
Protocol esp;
Authentication-algorithm hmac-md5-96;
Encryption-algorithm 3des-cbc;
}
Policy L2L-P2-Policy {
Proposals L2L-P2-Proposal;
}
Vpn Route-vs-SVTI {
Bind-interface st0.0;
Ike {
Gateway L2L-P1-Gateway;
Proxy-identity {
Local 0.0.0.0/0;
Remote 0.0.0.0/0;
Service any;
}
Ipsec-policy L2L-P2-Policy;
}
Establish-tunnels immediately;
}
}
Screen {
Ids-option untrust-screen {
Icmp {
Ping-death;
}
Ip {
Source-route-option;
Tear-drop;
}
Tcp {
Syn-flood {
Alarm-threshold 1024;
Attack-threshold 200;
Source-threshold 1024;
Destination-threshold 2048;
Queue-size 2000; # Warning: 'queue-size' is deprecated
Timeout 20;
}
Land;
}
}
}
Policies {
From-zone trust to-zone SVTI {
Policy permit-all {
Match {
Source-address any;
Destination-address any;
Application any;
}
Then {
Permit;
}
}
}
From-zone SVTI to-zone trust {
Policy permit-all {
Match {
Source-address any;
Destination-address any;
Application any;
}
Then {
Permit;
}
}
}
}
Zones {
Security-zone untrust {
Interfaces {
Ge-0/0/0.0 {
Host-inbound-traffic {
System-services {
Ping;
Ssh;
Ike;
}
}
}
}
}
Security-zone SVTI {
Interfaces {
St0.0 {
Host-inbound-traffic {
Protocols {
Ospf;
}
}
}
}
}
Security-zone trust {
Interfaces {
Ge-0/0/1.0 {
Host-inbound-traffic {
System-services {
Ping;
}
Protocols {
Ospf;
}
}
}
}
}
}
}
[Edit]
4. R3
Int e0/0
Ip add 192.168.1.2 255.255.255.0
Ip OS 110 ar 0
No shut
Int l0
Ip add 10.10.10.10 255.255.255.0
Ip OS 110 ar 0
Test:
R1 view the route table and ping
650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/140814478.png "title =" 2.PNG" alt = "140814478.png"/>
SRX view route table
650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/141009142.png "title =" 3.PNG" alt = "141009142.png"/>
Ping
650) this. width = 650; "src =" http://img1.51cto.com/attachment/201309/141111250.png "title =" 4.PNG" alt = "141111250.png"/>
R3 view the route table and ping
650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/04304133P-4.png "title =" 6.PNG" alt = "141221223.png"/>
After SRX configuration is complete, you must submit it. Otherwise, the configuration will not take effect, and the interface must allow ike ospf to PING the traffic.
This article is from the "Cisco, zhanbo, Huawei" blog, please be sure to keep this source http://rujinfeng.blog.51cto.com/2712746/1299689