SRX

Hello,

I am attempting to build an ADVPN environment to replace our Cisco DMVPN environment.  One of my requirements is to have two hubs/suggestors for redundancy.  I have not found any documentation that indicates if it is possible to have two hubs within the same ADVPN, which seems to imply that each hub must have a separate ADVPN.  This would be onerous on my Provisioning department.

I have tested out the configuration below, and it does seem to work correctly.  I have full BGP connectivity from my spoke to the two hubs.  I asked JTAC, and their response was basically:  "well, we can't find anything that says it won't work, so it must be fine", which doesn't give me the warn & fuzzies.

In summary, on my spoke:

• I created two IKE gateway connections, using the WAN IPs of the two hubs, both using the same IKE policy and proposal
• I created two IPSec VPN connections, both bound to interface st0.0, using the same IPSec policy and proposal, but referencing the two IKE gateways
• Then I compacted most of it by using an apply group.

Has anyone ever tried setting up two hubs?  Is this a valid solution, or will it cause issues?

Thanks!

set groups ADVPN_CONFIG security ike gateway <*> ike-policy IKE_POLICY
set groups ADVPN_CONFIG security ike gateway <*> dead-peer-detection probe-idle-tunnel
set groups ADVPN_CONFIG security ike gateway <*> local-identity distinguished-name
set groups ADVPN_CONFIG security ike gateway <*> remote-identity distinguished-name container O=HCE
set groups ADVPN_CONFIG security ike gateway <*> advpn suggester disable
set groups ADVPN_CONFIG security ike gateway <*> advpn partner
set groups ADVPN_CONFIG security ike gateway <*> version v2-only
set groups ADVPN_CONFIG security ike gateway <*> external-interface dl0.0
set groups ADVPN_CONFIG security ipsec vpn <*> ike ipsec-policy IPSEC_POLICY
set groups ADVPN_CONFIG security ipsec vpn <*> establish-tunnels immediately
set groups ADVPN_CONFIG security ipsec vpn <*> bind-interface st0.0

set security apply-groups ADVPN_CONFIG
set security ike proposal IKE_PROPOSAL authentication-method rsa-signatures
set security ike proposal IKE_PROPOSAL dh-group group5
set security ike proposal IKE_PROPOSAL authentication-algorithm sha1
set security ike proposal IKE_PROPOSAL encryption-algorithm aes-256-cbc
set security ike policy IKE_POLICY proposals IKE_PROPOSAL
set security ike policy IKE_POLICY certificate local-certificate SCEP_LOCAL
set security ike gateway HUB-SEC address x.x.x.x
set security ike gateway HUB-PRI address y.y.y.y
set security ipsec proposal IPSEC_PROPOSAL protocol esp
set security ipsec proposal IPSEC_PROPOSAL authentication-algorithm hmac-sha1-96
set security ipsec proposal IPSEC_PROPOSAL encryption-algorithm aes-256-cbc
set security ipsec policy IPSEC_POLICY perfect-forward-secrecy keys group5
set security ipsec policy IPSEC_POLICY proposals IPSEC_PROPOSAL
set security ipsec vpn HUB-SEC ike gateway HUB-SEC
set security ipsec vpn HUB-PRI ike gateway HUB-PRI

Interesting. As far as ADVPN is concerned, the two suggesters don't know about each other ... I wonder what would happen if a spoke receives a competing (or perhaps a duplicate) suggestion for a spoke-to-spoke connection.

That is an excellent question.  I haven't been able to find any ADVPN-specific commands yet which could shed light on it.  For example, Cisco has "show nhrp" and "show ip nhrp"

JunOS has show security ipsec next-hop-tunnels which should be similar ish, I think ...

Thanks for that bit of info!  That command does return a list of next-hop gateway IPs (the private ones) and the corresponding certificate, which is useful for correlating the private IPs with the hostname in the cert's CN.  I just wish it would show a concise list of the ADVPN database, showing the private IP to public IP mappings, like "show dmvpn" on Cisco.