SRX

 View Only

  • 1.  SRX route-based VPN Setup

    Posted 24 days ago

    Hello everyone,

    We are in the process of migrating all of our policy‑based VPN tunnels from our Cisco ASA 5516 firewall to a Juniper SRX345. Since Juniper Support confirmed that IKEv2 is not supported for policy‑based VPNs on our Junos version, we are converting these tunnels to route‑based IKEv2 using st0 interfaces.

    Here is my example configuration:

    CryptoMap Configuration

    set security ike proposal Outside2-Map2 encryption-algorithm aes-256-cbc
    set security ike proposal Outside2-Map2 authentication-algorithm sha-256
    set security ike proposal Outside2-Map2 authentication-method pre-shared-keys
    set security ike proposal Outside2-Map2 dh-group group14
    set security ike proposal Outside2-Map2 lifetime-seconds 28800

    set security ike policy Outside2-Map2-Policy proposals Outside2-Map2
    set security ike policy Outside2-Map2-Policy pre-shared-key ascii-text "In Keepass"

    set security ike gateway Outside2-Map2-Gateway address 1.1.1.1
    set security ike gateway Outside2-Map2-Gateway external-interface reth1.0
    set security ike gateway Outside2-Map2-Gateway ike-policy Outside2-Map2-Policy
    set security ike gateway Outside2-Map2-Gateway version v2-only
    set security ike gateway Outside2-Map2-Gateway dead-peer-detection interval 10 threshold 3

    set security ipsec proposal Outside2-Maps2-IPSEC-Proposal protocol esp
    set security ipsec proposal Outside2-Maps2-IPSEC-Proposal encryption-algorithm aes-256-cbc
    set security ipsec proposal Outside2-Maps2-IPSEC-Proposal authentication-algorithm hmac-sha-256-128
    set security ipsec proposal Outside2-Maps2-IPSEC-Proposal lifetime-seconds 3600
    set security ipsec policy Outside2-Maps2-IPSEC-Policy proposals Outside2-Maps2-IPSEC-Proposal
    set security ipsec policy Outside2-Maps2-IPSEC-Policy perfect-forward-secrecy keys group14

    set interfaces st0 unit 0 family inet address 169.254.0.1/30

    set security ipsec vpn Outside2-Map2-VPN ike gateway Outside2-Map2-Gateway
    set security ipsec vpn Outside2-Map2-VPN ike ipsec-policy Outside2-Maps2-IPSEC-Policy
    set security ipsec vpn Outside2-Map2-VPN bind-interface st0.0


    set security zones security-zone VPN interfaces st0.0

    set security policies from-zone 100 to-zone VPN policy 100-to-VPN match source-address any
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN match destination-address any
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN match application any
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN then permit
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN then log session-init

    set security policies from-zone VPN to-zone 100 policy VPN-to-100 match source-address any
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 match destination-address any
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 match application any
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 then permit
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 then log session-init


    set routing-options static route 1.1.1.1/30 next-hop st0.0

    NAT Statement:

    set security nat source rule-set 100-to-Outside_2 from zone 100
    set security nat source rule-set 100-to-Outside_2 to zone 0
    set security nat source rule-set 100-to-Outside_2 rule Server1_to_RemoteServers description "NAT for Server1 traffic to Remote Servers"
    set security nat source rule-set 100-to-Outside_2 rule Server1_to_RemoteServers match source-address 10.10.10.10/32
    set security nat source rule-set 100-to-Outside_2 rule Server1_to_RemoteServers match destination-address 1.1.1.1/30
    set security nat source rule-set 100-to-Outside_2 rule Server1_to_RemoteServers then source-nat pool Sever1-NAT-Pool

    set security nat source rule-set 100-to-Outside_2 from zone 100
    set security nat source rule-set 100-to-Outside_2 to zone 0
    set security nat source rule-set 100-to-Outside_2 rule Server2_to_RemoteServers description "NAT for Server2 traffic to Remote Servers"
    set security nat source rule-set 100-to-Outside_2 rule Server2_to_RemoteServers match source-address 10.10.10.11/30 
    set security nat source rule-set 100-to-Outside_2 rule Server2_to_RemoteServers match destination-address 1.1.1.1/30
    set security nat source rule-set 100-to-Outside_2 rule Server2_to_RemoteServers then source-nat pool Sever2-NAT-Pool

    set security nat source pool Server1-NAT-Pool address 11.11.11.11/32
    set security nat source pool Server2-NAT-Pool address 11.11.11.12/32

    set security nat source rule-set 100-to-Outside_2 rule Server1_to_RemoteServers then source-nat pool Server1-NAT-Pool
    set security nat source rule-set 100-to-Outside_2 rule Server2_to_RemotesServers then source-nat pool Server2-NAT-Pool

     

    Does this look like a correct and complete route‑based IKEv2 configuration for SRX345? Will this properly allow:

    Internal hosts → Remote servers (with source NAT)?

    Remote servers → Internal servers (with return traffic through the tunnel)?

    Are there any best practices I should apply when migrating many former crypto‑map tunnels onto st0 interfaces?





    ------------------------------
    NATHAN GUESS
    ------------------------------


  • 2.  RE: SRX route-based VPN Setup

    Posted 24 days ago

    On first read what stands out is 1.1.1.1 -- that's the far side of the VPN tunnel. It should be reachable outside the tunnel and you shouldn't route it through the tunnel itself.  It becomes recursive when you do. Traffic going into st0 must be encapsulated in ESP, then the encapsulated traffic nust go to the gateway (1.1.1.1) but the route to the gateway is through st0 so it must be encapsulated, after which it goes through st0 again which means encapsulation, etc.

    I have to give the config a more thorough read.

    As an aside, it's possible to successfully mash together route-based VPN on the SRX side with tunnel-mode policy-based VPN on the other side. I've done it with MikroTik on the far side since they don't have an st interface equivalent, but I value most about the st0 interface is the ability to run dynamic routing on it.



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 3.  RE: SRX route-based VPN Setup

    Posted 24 days ago

    Nikolay, I apologize if that configuration is a little difficult to read, here is hopefully a more readable version:

    set security ike proposal Outside2-Map2 encryption-algorithm aes-256-cbc
    set security ike proposal Outside2-Map2 authentication-algorithm sha-256
    set security ike proposal Outside2-Map2 authentication-method pre-shared-keys
    set security ike proposal Outside2-Map2 dh-group group14
    set security ike proposal Outside2-Map2 lifetime-seconds 28800

    set security ike policy Outside2-Map2-Policy proposals Outside2-Map2
    set security ike policy Outside2-Map2-Policy pre-shared-key ascii-text "In Keepass"

    set security ike gateway Outside2-Map3-Gateway address 160.76.8.8
    set security ike gateway Outside2-Map3-Gateway external-interface reth1.0
    set security ike gateway Outside2-Map3-Gateway ike-policy Outside2-Map2-Policy
    set security ike gateway Outside2-Map3-Gateway version v2-only
    set security ike gateway Outside2-Map3-Gateway dead-peer-detection interval 10 threshold 3

    set security ipsec proposal Outside2-Map3-IPSEC-Proposal protocol esp
    set security ipsec proposal Outside2-Map3-IPSEC-Proposal encryption-algorithm aes-256-cbc
    set security ipsec proposal Outside2-Map3-IPSEC-Proposal authentication-algorithm hmac-sha-256-128
    set security ipsec proposal Outside2-Map3-IPSEC-Proposal lifetime-seconds 3600
    set security ipsec policy Outside2-Map2-IPSEC-Policy proposals Outside2-Maps2-IPSEC-Proposal
    set security ipsec policy Outside2-Map2-IPSEC-Policy perfect-forward-secrecy keys group14

    set interfaces st0 unit 0 family inet address "no address needs defined

    set security ipsec vpn Outside2-Map2-VPN ike gateway Outside2-Map3-Gateway
    set security ipsec vpn Outside2-Map2-VPN ike ipsec-policy Outside2-Maps2-IPSEC-Policy
    set security ipsec vpn Outside2-Map2-VPN bind-interface st0.0


    set security zones security-zone VPN interfaces st0.0

    set security policies from-zone 100 to-zone VPN policy 100-to-VPN match source-address any
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN match destination-address any
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN match application any
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN then permit
    set security policies from-zone 100 to-zone VPN policy 100-to-VPN then log session-init

    set security policies from-zone VPN to-zone 100 policy VPN-to-100 match source-address any
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 match destination-address any
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 match application any
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 then permit
    set security policies from-zone VPN to-zone 100 policy VPN-to-100 then log session-init


    set policy-options prefix-list PL-CHI-GoodSam_PAC-Holter-Servers 168.112.142.108/32
    set policy-options prefix-list PL-CHI-GoodSam_PAC-Holter-Servers 168.112.142.109/32
    set policy-options prefix-list PL-CHI-GoodSam_PAC-Holter-Servers 168.112.142.110/32
    set policy-options prefix-list PL-CHI-GoodSam_PAC-Holter-Servers 168.112.142.111/32

    set routing-options static route 168.112.142.108/30 next-hop st0.0

    set security nat source rule-set 100-to-Outside_2 from zone 100
    set security nat source rule-set 100-to-Outside_2 to zone 0
    set security nat source rule-set 100-to-Outside_2 rule NRSERVER04_to_CHI-GoodSam-PACS description "NAT for NRSERVER04 traffic to CHI-GoodSam PACS/Holter Servers"
    set security nat source rule-set 100-to-Outside_2 rule NRSERVER04_to_CHI-GoodSam-PACS match source-address 1.1.11.111/32
    set security nat source rule-set 100-to-Outside_2 rule NRSERVER04_to_CHI-GoodSam-PACS match destination-address 168.112.142.108/30
    set security nat source rule-set 100-to-Outside_2 rule NRSERVER04_to_CHI-GoodSam-PACS then source-nat pool NRSERVER04-NAT-Pool

    set security nat source rule-set 100-to-Outside_2 from zone 100
    set security nat source rule-set 100-to-Outside_2 to zone 0
    set security nat source rule-set 100-to-Outside_2 rule TVHS-Holter_to_CHI-HolterServers description "NAT for TVHS Holter PC traffic to CHI-GoodSam PACS/Holter Servers"
    set security nat source rule-set 100-to-Outside_2 rule TVHS-Holter_to_CHI-HolterServers match source-address 2.2.22.22/32
    set security nat source rule-set 100-to-Outside_2 rule TVHS-Holter_to_CHI-HolterServers match destination-address 168.112.142.108/30
    set security nat source rule-set 100-to-Outside_2 rule TVHS-Holter_to_CHI-HolterServers then source-nat pool HOLTER-NAT-Pool

    set security nat source pool NRSERVER04-NAT-Pool address 10.160.40.102/32
    set security nat source pool HOLTER-NAT-Pool address 10.160.40.103/32

    set security nat source rule-set 100-to-Outside_2 rule NRSERVER04_to_CHI-GoodSam-PACS then source-nat pool NRSERVER04-NAT-Pool
    set security nat source rule-set 100-to-Outside_2 rule TVHS-Holter_to_CHI-HolterServers then source-nat pool HOLTER-NAT-Pool


    ------------------------------
    NATHAN GUESS
    ------------------------------

    Original Message


  • 4.  RE: SRX route-based VPN Setup

    Posted 24 days ago

    Oh, I see. And, presumably the other side will have routes to send traffic for 10.160.40.102 and 10.160.40.103 into the tunnel.

    Your NAT rule should be to zone VPN rather than to zone 0 since st0.0 is in zone VPN and traffic to 168.112.142.108/30 is routed via st0.0. 

    And yes, you should be able to leave st0.0 unnumbered; just also omit the "address" keyword and leave it ending in "unit 0 family inet". That should be enough.

    Are you looking to allow traffic initiated from the other side? Right now, it looks like you're just trying to cover your servers reaching out to the remote side. So technically you don't need security policies from VPN to 100.



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 5.  RE: SRX route-based VPN Setup

    Posted 24 days ago

    I am wanting traffic to flow from either site. 



    ------------------------------
    NATHAN GUESS
    ------------------------------

    Original Message


  • 6.  RE: SRX route-based VPN Setup

    Posted 24 days ago

    In that case look into using static NAT instead of source NAT, so the mapping between 10.160.40.102 and 1.1.11.111 will work for traffic initiated from the other side as well. Here's a decent starting point: https://www.juniper.net/documentation/us/en/software/junos/nat/topics/topic-map/security-nat-static.html



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 7.  RE: SRX route-based VPN Setup

    Posted 24 days ago

    Thank you for the Feedback, what would a NAT statement with Port-forwarding look like. 
    For example:
    any IPv4>69.2.17.2:443>10.97.1.1



    ------------------------------
    NATHAN GUESS
    ------------------------------

    Original Message


  • 8.  RE: SRX route-based VPN Setup

    Posted 24 days ago

    That would be something like:

    set security nat destination pool poolname address 10.97.1.1/32
    set security nat destination rule-set blah from zone 0
    set security nat destination rule-set blah rule rulename match destination-address 69.2.17.2/32
    set security nat destination rule-set blah rule rulename match destination-port 443
    set security nat destination rule-set blah rule rulename then destination-nat pool poolname

    NOTE: if the incoming interface address is not 69.2.17.2 --AND-- we're talking about ethernet interface, then you'll also need:

    set security nat proxy-arp interface interfacename address 69.2.17.2/32

    Proxy-ARP is not needed if traffic is coming in on st0.0.



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 9.  RE: SRX route-based VPN Setup

    Posted 23 days ago

    Nikolay I appreciate the responses!

    I have one more question for you. When Setting up the Nat Statements how would you configure it when you have multiple address/devices. 

    For example:

    set security address-book global address TVHS_Meditech-PrintServers-NAT 10.255.19.28/30
    set security address-book global address TVHS_MT-PS01 10.1.1.1/32
    set security address-book global address TVHS_MT-PS02 10.1.1.2/32
    set security address-book global address AveleCare-Trax-Network 10.155.2.0/24

    set security address-book global address-set TVHS-Meditech-PrintServers address TVHS_MT-PS01
    set security address-book global address-set TVHS-Meditech-PrintServers address TVHS_MT-PS02


    Is there a way to define the address-set in the rule-set instead of creating multiple entries?



    ------------------------------
    NATHAN GUESS
    ------------------------------

    Original Message


  • 10.  RE: SRX route-based VPN Setup

    Posted 23 days ago

    No, I don't believe you can use an address-set in NAT rules. And even the named addresses that you can use have to be IP addresses and not DNS names for example. Actually, since JunOS 22.2 you can use dns-name address book entries in NAT, but with some caveats: https://www.juniper.net/documentation/us/en/software/junos/release-notes/22.2/junos-release-notes-22.2r1/topics/new-features/feature-descriptions/nat-7.html#:~:text=NAT%20support%20for%20DNS%20(SRX,show%20security%20nat%20source%20pool.%5D



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message