《分享》XG與Juniper SRX做IPsec串接

順子沒碰過Juniper SRX，但業務帶回來的案子中，有不少需求是與客戶既有的SRX進行串接。
既然這需求備增，那順子也來筆記一下XG如何跟Juniper SRX做IPsec串接。

Juniper上的IPsec VPN有分為route base與policy base兩種，
而Sophos XG為policy base IPsec VPN，所以SRX上的設定自然要以policy base的方式來進行。
SRX與XG兩端的情境配置如下圖。

• Juniper SRX上的設定
  SRX上Phase1/2的相關組態與放行policy設定可參考如下。
  Configure Phase 1 of the IPsec tunnel.
  [edit security ike]
  user@host# set proposal ike-pshase1-proposal authentication-method pre-shared-keys
  user@host# set proposal ike-pshase1-proposal dh-group group2
  user@host# set proposal ike-pshase1-proposal authentication-algorithm md5
  user@host# set proposal ike-pshase1-proposal encryption-algorithm aes-128-cbc
  
  Configure the IKE policies, and reference the proposals.
  [edit security ike]
  user@host# set policy ike-phase1-policy mode main
  user@host# set policy ike-phase1-policy ike-pshase1-proposal
  user@host# set policy ike-phase1-policy pre-shared-key ascii-text "12345678"
  
  Configure the IKE gateway, and reference the policy.
  [edit security ike]
  user@host# set gateway GW_XG ike-policy ike-phase1-policy
  user@host# set gateway GW_XG address 211.1.2.3
  user@host# set gateway GW_XG external-interface ge-0/0/0.0
  
  Configure Phase 2 of the IPsec tunnel.
  [edit security ipsec]
  user@host# set proposal ipsec-phase2-proposal protocol esp
  user@host# set proposal ipsec-phase2-proposal authentication-algorithm hmac-md5-96
  user@host# set proposal ipsec-phase2-proposal encryption-algorithm aes-128-cbc
  
  Configure the policies, and reference the proposals.
  [edit security ipsec]
  user@host# set policy ipsec-phase2-polic perfect-forward-secrecy keys group2
  user@host# set policy ipsec-phase2-polic proposals ipsec-phase2-proposal
  
  Configure AutoKey IKE, and reference the policy and gateway.
  [edit security ipsec]
  user@host# set vpn ike-vpn-XG ike GW_XG
  user@host# set vpn ike-vpn-XG ike ipsec-policy ipsec-phase2-policy
  
  Configure the security policy from Juniper to Sophos.
  [edit security policies from-zone trust to-zone untrust]
  user@host# set policy VPN-XG match source-address addr_10_2_3_0_24
  user@host# set policy VPN-XG match destination-address addr_192_168_0_0_24
  user@host# set policy VPN-XG match application any
  user@host# set policy VPN-XG then permit tunnel ipsec-vpn ike-vpn-XG
  user@host# set policy VPN-XG then permit tunnel pair-policy VPN-SRX
  
  Configure the security policy from Sophos to Juniper.
  [edit security policies from-zone untrust to-zone trust]
  user@host# set policy VPN-SRX match source-address addr_192_168_0_0_24
  user@host# set policy VPN-SRX match destination-address addr_10_2_3_0_24
  user@host# set policy VPN-SRX match application any
  user@host# set policy VPN-SRX then permit tunnel ipsec-vpn ike-vpn-XG
  user@host# set policy VPN-SRX then permit tunnel pair-policy VPN-XG
  
  設定完成後，SRX上相關IPsec組態結構顯示如下。
  
  interfaces {
      ge-0/0/0 {
          unit 0 {
              family inet {
                  address 123.123.123.123/24;
              }
          }
      }
      ge-0/0/1 {
          unit 0 {
              family inet {
                  address 10.2.3.254/24;
              }
          }
      }
  }
  routing-options {
      static {
          route 0.0.0.0/0 next-hop 123.123.123.254;
      }
  }
  security {
      ike {
          proposal ike-pshase1-proposal {
              authentication-method pre-shared-keys;
              dh-group group2;
              authentication-algorithm md5;
              encryption-algorithm aes-128-cbc;
          }
          policy ike-phase1-policy {
              mode main;
              proposals ike-pshase1-proposal;
              pre-shared-key ascii-text "12345678";
          }
          gateway GW-XG {
              ike-policy ike-phase1-policy;
              address 211.1.2.3;
              external-interface ge-0/0/0.0;
          }
      }
      ipsec {
          proposal ipsec-phase2-proposal {
              protocol esp;
              authentication-algorithm hmac-md5-96;
              encryption-algorithm aes-128-cbc;
          }
          policy ipsec-phase2-policy {
              perfect-forward-secrecy {
                  keys group2;
              }
              proposals ipsec-phase2-proposal;
          }
          vpn ike-vpn-XG {
              ike {
                  gateway GW-XG;
                  ipsec-policy ipsec-phase2-policy;
              }
          }
      }
      nat {
          source {
              rule-set trust-to-untrust {
                  from zone trust;
                  to zone untrust;
                  rule NO-NAT {
                      match {
                          source-address 10.2.3.0/24;
                          destination-address 192.168.0.0/21;
                      }
                      then {
                          source-nat {
                              off;
                          }
                      }
                  }
                  rule source-nat-rule {
                      match {
                          source-address 0.0.0.0/0;
                      }
                      then {
                          source-nat {
                              interface;
                          }
                      }
                  }
              }
          }
      }
      policies {
          from-zone trust to-zone untrust {
              policy VPN-XG {
                  match {
                      source-address addr_10_2_3_0_24;
                      destination-address addr_192_168_0_0_24;
                      application any;
                  }
                  then {
                      permit {
                          tunnel {
                              ipsec-vpn ike-vpn-XG;
                              pair-policy VPN-SRX;
                          }
                      }
                  }
              }
          from-zone untrust to-zone trust {
              policy VPN-SRX {
                  match {
                      source-address addr_192_168_0_0_24;
                      destination-address addr_10_2_3_0_24;
                      application any;
                  }
                  then {
                      permit {
                          tunnel {
                              ipsec-vpn ike-vpn-XG;
                              pair-policy VPN-XG;
                          }
                      }
                  }
              }
          }
      }
      zones {
          security-zone trust {
              address-book {
                  address addr_10_2_3_0_24 10.2.3.0/24;
              }
          }
          security-zone untrust {
              address-book {
                  address addr_192_168_0_0_24 192.168.0.0/24;
              }
          }
      }
  }
  
  
• Sophos XG上的設定
  XG上，以上述的Phase1/2設定，新建一個對應的profile。
  
  
  
  然後在IPsec VPN連線設定中，選用此profile，並選擇動作為Initiate，作為連線的主動發起端。
  
  
  
  
• 其它
  若設定正確的話，於XG上啟動該IPsec VPN連線，兩端應該就能順利連接起來了。
  
  在實作中順子曾遇到一個情況，雖然IPsec成功的介接起來了，
  但這連線頻頻斷線，每兩分鐘就會上下一次...
  
  檢視SRX設定後，發現是順子把route base組態與policy base組態混淆了，
  在混用設定的情況下，雖然IPsec會通，也可以ping到對端，
  但就是很不穩定，每兩分鐘就會斷一次，讓順子相當困擾...
  
  最後把SRX組態修改為如上的設定後，IPsec VPN就穩定下來，不再一直上上下下了∼
  

♥順子老婆的網拍，請多關照∼

If you don't like something, change it.
If you can't change it, change your attitude.
Don't complain!