Configuring IPSec

Problem

You need a secure method of sending information between sites.

Solution

Start by defining the IPSec SA between your two intranet sites. On each security router, define identical SAs:

	[edit security ipsec]
	aviva@router1# edit security-association  site1-site2 
	[edit security ipsec security-association site1-site2 ]
	aviva@router1# set description  "SA from site1 to site2 "
	aviva@router1# set mode tunnel 
	aviva@router1# set manual direction bidirectional protocol bundle 
	aviva@router1# set manual direction bidirectional spi  400 
	aviva@router1# set manual direction bidirectional auxiliary-spi  400 
	aviva@router1# set manual direction bidirectional authentication algorithm hmac-sha1-96 
	aviva@router1# set manual direction bidirectional authentication key ascii-text  
$1991poPPi 
	aviva@router1# set manual direction bidirectional encryption algorithm des-cbc 
	aviva@router1# set manual direction bidirectional encryption key ascii-text  $1991poPPi 

Configuring a firewall filter accepts all traffic returning from the remote site:

	[edit firewall filter traffic-out-of-ipsec-tunnel ]
	aviva@router1# set term out-of-ipsec-tunnel from source-address  10.0.97.0/24 
	aviva@router1# set term out-of-ipsec-tunnel from destination-address  10.0.12.0/24 
	aviva@router1# set term out-of-ipsec-tunnel then accept 

Finally, apply the second filter on the ES interface that goes from the local security gateway to the remote security gateway:

	[edit interfaces es-3/0/0 ]
	aviva@router1# set unit 0 tunnel source  10.0.12.33 
	aviva@router1# set unit 0 tunnel destination  10.0.97.62 
	aviva@router1# set unit 0 family inet ipsec-sa  site1-site2 
	aviva@router1# set unit 0 family inet filter input  traffic-out-of-ipsec-tunnel 

 

Discussion

This recipe shows how to set up IPSec for M-series and T-series routers that have ES PICs. The setup process is fairly involved. There are three basic components to the configuration: defining the SA and the tunnel to carry the secured traffic, creating firewall filters to place traffic going from one site to the other into the tunnel, and configuring the interfaces to apply the filters and create the tunnel on the ES PIC. This recipe shows how to set up a manual SA, in which you specify all SA parameters in the configuration. While setting up SAs manually can be manageable in small networks, it does not scale well. As the network size increases, having IPSec dynamically configure SAs is a better option (see Recipe 3.2).

The SA is bidirectional, so the same encryption and authentication keys are used on incoming and outgoing traffic through the IPSec tunnel. To use different keys in each direction, use the set direction inbound and set direction outbound commands.

To start, define the SA. Because you have two routers acting as the security gateways between your two sites, you use tunnel mode. For the other SA parameters, this example chooses to use both the AH and ESP protocols (specified with the protocol bundle statement), HMAC-SHA1-96 authentication, DES-CBC encryption, and a SPI value of 400. The auxiliary SPI is needed because we are using both AH and ESP. Both security gateway routers must have the same SA configuration.

Next, you create a firewall filter to accept traffic returning from the remote site and you apply it to the ES interface. You need to set up similar firewall filters on the remote security gateway router.

Finally, you configure the router interfaces. On the ES interface facing the remote security gateway router, configure the tunnel on the logical unit, and for the IPv4 protocol family, associate the SA and apply the traffic-out-of-ipsec-tunnel filter. Set up the remote router in a similar fashion.

Use the following command to verify that the SA is active:

	aviva@router1> show ipsec security-associations detail
	Security association: site1-site2, Interface family: Up

	 Local gateway: 10.0.12.33, Remote gateway: 10.0.97.62
	 Local identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
	 Remote identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)

	 Direction: inbound, SPI: 400, AUX-SPI: 400
	 Mode: tunnel, Type: manual, State: Installed
	 Protocol: BUNDLE, Authentication: hmac-sha1-96, Encryption: des-cbc
	 Anti-replay service: Disabled

	 Direction: outbound, SPI: 400, AUX-SPI: 400
	 Mode: tunnel, Type: manual, State: Installed
	 Protocol: BUNDLE, Authentication: hmac-sha1-96, Encryption: des-cbc
	 Anti-replay service: Disabled

The first line shows that the SA is active (Up), and you see that the inbound and outbound SAs are installed. This command also shows the configured SA parameters.

You can check the status of the IPSec tunnel with the ping and traceroute commands. You should be able to ping a system at the remote site:

	aviva@router1> ping  10.0.97.2 
	PING 10.0.97.2 (10.0.97.2): 56 data bytes
	64 bytes from 10.0.97.2: icmp_seq=0 ttl=253 time=0.939 ms
	64 bytes from 10.0.97.2: icmp_seq=1 ttl=253 time=0.886 ms
	64 bytes from 10.0.97.2: icmp_seq=2 ttl=253 time=0.826 ms
	^C
	--- 10.0.97.2 ping statistics ---
	3 packets transmitted, 3 packets received, 0% packet loss
	round-trip min/avg/max/stddev = 0.826/0.884/0.939/0.046 ms

Use the traceroute command to verify that the traffic travels over the tunnel:

	aviva@router1> traceroute  10.0.97.2 
	traceroute to 10.0.97.2 (10.0.97.2), 30 hops max, 40 byte packets
	 1 10.0.12.2 (10.0.12.2) 0.655 ms 0.549 ms 0.508 ms
	 2 10.0.0.3 (10.0.0.3) 0.833 ms 0.786 ms 0.757 ms
	 3 10.0.97.2 (10.0.97.2) 0.808 ms 0.741 ms 0.716 ms

In the second line of the traceroute output, you don't see 10.0.97.62, which is the IP address of the remote side of the tunnel, but rather 10.0.0.3, which is the loopback address of the remote security gateway router.

The configuration is a bit complex, so it's worth looking at the structure of the relevant portions of the configuration file rather than all the commands that you use to configure it. Some comments have been added.

	[edit security 
ipsec]
	security-association site1-site2 { # <-- define the SA
	 description "tunnel from site1 to site2";
	 mode tunnel; # <-- use tunnel mode
	 manual { # <-- negotiate SA parameters up front
	 direction bidirectional {
	 protocol bundle;
	 spi 400;
	 auxiliary-spi 400;
	 authentication {
	 algorithm hmac-sha1-96;
	 key ascii-text "$9$…"; ## SECRET-DATA
	 }
	 encryption {
	 algorithm des-cbc;
	 key ascii-text "$9$b…"; ## SECRET-DATA
	 }
	 }
	 }
	}

	[edit firewall]
	filter traffic-out-of- 
ipsec-tunnel { # <-- receive remote traffic
	 term out-of- 
ipsec-tunnel {
	 from {
	 source-address { # <-- remote subnet
	 10.0.97.0/24;
	 }
	 destination-address { # <-- local subnet
	 10.0.12.0/24;
	 }
	 then accept;
	 }
	}

	[edit interfaces]
	es-3/0/0 { # <-- interface facing remote security gateway router
	 unit 0 {
	 tunnel {
	 source 10.0.12.33;
	 destination 10.0.97.62;
	 }
	 family inet {
	 ipsec-sa site1-site2;
	 filter {
	 input traffic-out-of-ipsec-tunnel;
	 }
	 }
	 }
	}