Implementing Site-to-Site VPN

Overview

Task:

• Configure R5 with loopback 50 to emulate VLAN 50
• Assign it an IP address 10.50.50.5/24
• Configure a Site-to-Site VPN between SRX and R5
• R5 is fully pre-configured
• Use route-based approach on the SRX
• Use the tunnel to communicate VLANs 31 & 50
• 192.168.31.0/24 (VLAN 31)
• 10.50.50.0/24 (VLAN 50)
• Protect Phase I connection with the following cryptographic functions:
• 3DES
• SHA-1
• DH group 2
• Data tunnels should be protected as follows:
• ESP
• AES-128 CBC
• SHA-1
• VPN peers should authenticate each other using pre-shared keys
• Set the key to “secretkey”
• The tunnel should be negotiated when traffic is received from R3
• To login to SRX authenticate as "root" with password "Juniper!", and then issue "cli"

Solutions:

R5
        int loopback50
         ip address 10.50.50.5 255.255.255.0
        SRX
        set interfaces st0 unit 0 family inet
        !
        set routing-options static route 10.50.50.0/24 next-hop st0.0
        !
        set security zones security-zone untrust interfaces st0.0
        set security zones security-zone untrust host-inbound-traffic system-services ike
        !
        set security ike proposal IKEPROP authentication-method pre-shared-keys
        set security ike proposal IKEPROP dh-group group2
        set security ike proposal IKEPROP authentication-algorithm sha1
        set security ike proposal IKEPROP encryption-algorithm 3des-cbc
        !
        set security ike policy IKEPOL mode main
        set security ike policy IKEPOL proposals IKEPROP
        set security ike policy IKEPOL pre-shared-key ascii-text secretkey
        !
        set security ike gateway IKEGW ike-policy IKEPOL
        set security ike gateway IKEGW address 172.1.5.5
        set security ike gateway IKEGW external-interface ge-0/0/1
        !
        set security ipsec proposal IPSECPROP protocol esp
        set security ipsec proposal IPSECPROP authentication-algorithm hmac-sha1-96
        set security ipsec proposal IPSECPROP encryption-algorithm aes-128-cbc
        !
        set security ipsec policy IPSECPOL proposals IPSECPROP
        !
        set security ipsec vpn VPN bind-interface st0.0
        set security ipsec vpn VPN ike gateway IKEGW
        set security ipsec vpn VPN ike proxy-identity local 192.168.31.0/24
        set security ipsec vpn VPN ike proxy-identity remote 10.50.50.0/24
        set security ipsec vpn VPN ike proxy-identity service any
        set security ipsec vpn VPN ike ipsec-policy IPSECPOL
        set security ipsec vpn VPN establish-tunnels on-traffic