Saturday, February 25, 2012

Increase IOU NVRAM Size

Bu default IOU image NVRAM size is small not enough for complicated topology.

Router#dir nvram:
Directory of nvram:/

6 -rw- 1636 <no date> startup-config
7 ---- 5 <no date> private-config
1 ---- 38 <no date> persistent-data

8192 bytes total (5475 bytes free)
Router#

Usage: <image> [options] <application id>
<image>: unix-js-m | unix-is-m | unix-i-m | ...
<application id>: instance identifier (0 < id <= 1024)
Options:
-e <n>          Number of Ethernet interfaces (default 2)
-s <n>          Number of Serial interfaces (default 2)
-n <n>          Size of nvram in Kb (default 16K)
-c <name>       Configuration file name
-d              Generate debug information
-t              Netio message trace
-q              Suppress informational messages
-h              Display this help
-C              Turn off use of host clock
-m <n>          Megabytes of router memory (default 64)
-L              Disable local console, use remote console
-u <n>          UDP port base for distributed networks

so add IOU option -n64 into command which allows NVRAM increased to 64K.

#!/bin/bash../wrapper-linux -m ../i86bi_linux-adverterprisek9-ms -p 2001 -- 1 -n64> /dev/null 2>&1 &

Now looks what we got for NVRAM.

Router#dir nvram:
Directory of nvram:/

29 -rw- 1636 <no date> startup-config
30 ---- 5 <no date> private-config
1 ---- 38 <no date> persistent-data

32768 bytes total (30051 bytes free)

Now should be enough for certification importing to test PKI.

Friday, February 24, 2012

Juniper SRX 240H Bootable USB Backup

Juniper 10800 KB has good explanation regarding how to format and mount a USB flash drive on a J-series router, but not too much info for DRP process such as using snapshot stored on USB flash drive. Spent some time trying to make a bootable USB flash drive and here are some my own experience sharing.

Note: I am using SRX240H

Step 1: Insert your USB disk into USB0

Step 2: Find out Dev name for your USB
a. Through /dev folder. You have to carefully compare the difference after you inserted your USB

root@M-Prod% ls /dev
altroot bpf11 bpf24 bpf37 cuau0 da0s4 kmem pass1 ttyp1
ata bpf12 bpf25 bpf38 cuau0.init da0s4a log pci ttyp2
bo0s1a bpf13 bpf26 bpf39 cuau0.lock da0s4c md0 ptyp0 ttyp3
bo0s1c bpf14 bpf27 bpf4 da0 da1 md1 ptyp1 ttyu0
bo0s2a bpf15 bpf28 bpf40 da0s1 da1s1 md2 ptyp2 ttyu0.init
bo0s2c bpf16 bpf29 bpf5 da0s1a devctl md3 ptyp3 ttyu0.lock
bo0s3c bpf17 bpf3 bpf6 da0s1c devstat md4 random urandom
bo0s3e bpf18 bpf30 bpf7 da0s2 fd mdctl root usb
bo0s3f bpf19 bpf31 bpf8 da0s2a fido mem rtfifo usb0
bo0s4a bpf2 bpf32 bpf9 da0s2c fileassoc nfs4 smb usb1
bo0s4c bpf20 bpf33 cfi0 da0s3 gblmem nfslock stderr veriexec
bpf0 bpf21 bpf34 console da0s3c geom.ctl null stdin xpt0
bpf1 bpf22 bpf35 cpld da0s3e gpio octpkt stdout zero
bpf10 bpf23 bpf36 ctty da0s3f klog pass0 ttyp0

b. Another better way is show your log messages
root@M-Prod> show log messages
Feb 18 12:25:44 M-Prod newsyslog[11050]: logfile turned over due to -F request
Feb 23 20:45:01 M-Prod sshd[56519]: subsystem request for netconf by user root
Feb 23 20:59:16 M-Prod /kernel: umass1: JetFlash Mass Storage Device, rev 2.00/1.00, addr 4
Feb 23 20:59:16 M-Prod /kernel: da1 at umass-sim1 bus 1 target 0 lun 0
Feb 23 20:59:16 M-Prod /kernel: da1: <JetFlash TS2GJFV30 8.01> Removable Direct Access SCSI-2 device
Feb 23 20:59:16 M-Prod /kernel: da1: 40.000MB/s transfers
Feb 23 20:59:16 M-Prod /kernel: da1: 1938MB (3969024 512 byte sectors: 255H 63S/T 247C)

Step 3: Format USB and Label it

root@M-Prod% dd if=/dev/zero of=/dev/da1 bs=128k
dd: /dev/da1: end of device
15505+0 records in
15504+0 records out
2032140288 bytes transferred in 413.039683 secs (4919964 bytes/sec)

root@M-Prod% disklabel -R -w da1 auto

Step 4: Create File System

root@M-Prod% newfs -U /dev/da1
/dev/da1: 1938.0MB (3969020 sectors) block size 16384, fragment size 2048
using 11 cylinder groups of 183.62MB, 11752 blks, 23552 inodes.
with soft updates
super-block backups (for fsck -b #) at:
32, 376096, 752160, 1128224, 1504288, 1880352, 2256416, 2632480, 3008544, 3384608, 3760672
root@M-Prod%

Step 5: Create snapshot and partition

root@M-Prod> request system snapshot media usb partition
node0:
--------------------------------------------------------------------------
Clearing current label...
Partitioning usb media (/dev/da1) ...

Step 6: Boot Off USB
request system reboot media usb

Step 7: Restore the Junos Configuration:

request system snapshot media internal

If there is no access to CLI, follow this procedure to do recovery:
http://kb.juniper.net/KB10386

---------------------------------------------

Some useful commands when doing backup and restoring:
request routing-engine login node1

file copy node0:/var/jail/junos-srxsme-11.2R2.4-domestic.tgz node1:/var/jail/

root@SRX% md5 jinstall-ex-4200-10.4R1.9-domestic-signed.tgz
MD5 (jinstall-ex-4200-10.4R1.9-domestic-signed.tgz) = 38032c0e237a65b4cbc86a9c6ab06552

root@SRX> file checksum md5 /var/tmp/jinstall-ex-4200-10.4R1.9-domestic-signed.tgz
MD5 (/var/tmp/jinstall-ex-4200-10.4R1.9-domestic-signed.tgz) = 38032c0e237a65b4cbc86a9c6ab06552

---------------------------------------------------------
upgrade error I met during upgrade SRX from 10.4 to 11.2:

root@SRX-Prod> request system software add /cf/var/jail/junos-srxsme-11.2R2.4-domestic.tgz no-copy no-validate
Formatting alternate root (/dev/da0s2a)...
/dev/da0s2a: 298.0MB (610284 sectors) block size 16384, fragment size 2048
using 4 cylinder groups of 74.50MB, 4768 blks, 9600 inodes.
super-block backups (for fsck -b #) at:
32, 152608, 305184, 457760

gzip: stdin: invalid compressed data--format violated
tar: Unexpected EOF in archive
tar: Unexpected EOF in archive
tar: Error is not recoverable: exiting now
Installing package '/altroot/cf/packages/install-tmp/junos-11.2R2.4-domestic' ...
verify-sig: cannot validate junos-boot-srxsme-11.2R2.4.tgz.sig
subject issuer mismatch: /C=US/ST=CA/L=Sunnyvale/O=Juniper Networks/OU=Juniper CA/CN=PackageCA/emailAddress=ca@juniper.net

Installation failed for package '/altroot/cf/packages/install-tmp/junos-11.2R2.4-domestic'

--------------------------------------------------------------

Upgrade successful
root@SRX-Prod> request system software add no-copy no-validate /cf/var/jail/junos-srxsme-11.2R2.4-domestic.tgz
Formatting alternate root (/dev/da0s2a)...
/dev/da0s2a: 298.0MB (610284 sectors) block size 16384, fragment size 2048
using 4 cylinder groups of 74.50MB, 4768 blks, 9600 inodes.
super-block backups (for fsck -b #) at:
32, 152608, 305184, 457760
Installing package '/altroot/cf/packages/install-tmp/junos-11.2R2.4-domestic' ...
Verified junos-boot-srxsme-11.2R2.4.tgz signed by PackageProduction_11_2_0
Verified junos-srxsme-11.2R2.4-domestic signed by PackageProduction_11_2_0
Saving boot file package in /var/sw/pkg/junos-boot-srxsme-11.2R2.4.tgz
JUNOS 11.2R2.4 will become active at next reboot
WARNING: A reboot is required to load this software correctly
WARNING: Use the 'request system reboot' command
WARNING: when software installation is complete
Saving state for rollback ...

--------------------------------------------------------------

12 dropped packets during rebooting second SRX cluster member after frist SRX rebooted:

Reply from 10.94.200.14: bytes=32 time<1ms TTL=126
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from 10.94.200.14: bytes=32 time=1ms TTL=126

Monday, February 20, 2012

Cisco IOU IPsec Site to Site VPN with Pre-shared key, RSA Key, or CA Part 2

Cisco IOU IPsec Site to Site VPN with RSA key

Physical Diagram is still same as before. Since pre-shared key ipsec is already configured and working properly. The only thing needs to do is to change authentication method and import peer's public key. Of course have to generate your own private key and public first. Also, time on both devices will have to be synchronized.

R1(config)#crypto key generate rsa general-keys label R1
The name for the keys will be: R1
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.

How many bits in the modulus [512]:
% Generating 512 bit RSA keys, keys will be non-exportable...[OK]

R1(config)#
*Feb 20 11:57:54.456: RSA key size needs to be atleast 768 bits for ssh version 2
R1(config)#
*Feb 20 11:57:54.464: %SSH-5-ENABLED: SSH 1.5 has been enabled

R1#show crypto key mypubkey rsa R1
% Key pair was generated at: 19:57:54 CST Feb 20 2012
Key name: R1
Storage Device: not specified
Usage: General Purpose Key
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00A28FA5 DC744F51
02B0954B 6ED06BBE 8C30AE2E 7CEBBB82 861E9590 DF27CBED 8C26404F 5A42E174
749CEBC6 427AC823 DD5E1FC1 9C467B70 18128E87 C7567565 D5020301 0001

R1(config)#crypto key pubkey-chain rsa
R1(config-pubkey-chain)#addressed-key 2.2.2.2 encryption
R1(config-pubkey-key)#key-string
Enter a public key as a hexidecimal number ....
---Copy the whole public key from R2, which can be got by above steps on R2
R1(config-pubkey)#$886F70D 01010105 00034B00 30480241 00A1D58D A10F0D3C
R1(config-pubkey)#$858EF64 1386DB4E FBD07BCE 3A149B48 6676CD75 CD69331A
R1(config-pubkey)#$C8C10B60 876FA497 CCC86377 3C0FAF0A 354FED28 73020301 0001
R1(config-pubkey)#
R1(config-pubkey)#quit
R1(config-pubkey-key)#

R1#show crypto key pubkey-chain rsa address 2.2.2.2
Key address: 2.2.2.2
Usage: Encryption Key
Source: Manually entered
Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00A1D58D A10F0D3C
17A843C9 A2654A88 7858EF64 1386DB4E FBD07BCE 3A149B48 6676CD75 CD69331A
4BBA6976 C8C10B60 876FA497 CCC86377 3C0FAF0A 354FED28 73020301 0001

R1#sh crypto key mypubkey rsa
% Key pair was generated at: 19:57:54 CST Feb 20 2012
Key name: R1
Storage Device: private-config
Usage: General Purpose Key
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00A28FA5 DC744F51
02B0954B 6ED06BBE 8C30AE2E 7CEBBB82 861E9590 DF27CBED 8C26404F 5A42E174
749CEBC6 427AC823 DD5E1FC1 9C467B70 18128E87 C7567565 D5020301 0001
% Key pair was generated at: 20:12:59 CST Feb 20 2012
Key name: R1.server
Temporary key
Usage: Encryption Key
Key is not exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00CF0A3B C0AF2BE1
40AF1DF0 9B600A1D A228CB74 E5D714BC D5561DC5 FB2936C9 0818F1D7 B650DAF8
5B5BD010 3A4D5A4F D1B0C324 376FFD24 2567B79E 0BA019F5 1E664610 02AFF0FC
848B99F2 2B2CEEC1 6086153D C6F2A83C 4442F6A8 49CB59DB AB020301 0001

----Do upper similar steps on R2 to generate R2 own private key and public key, also import R1's public key.

---Troubleshooting ipsec issue.
R1#debug crypto ipsec
Crypto IPSEC debugging is on
R1#debug crypto isakmp
Crypto ISAKMP debugging is on
R1#debug crypto engine
Crypto Engine debugging is on
R1#clear crypto session

Unfortunately, no matter how I tried to adjust configuration and debug packets, I still got following error:

"%CRYPTO-6-IKMP_CRYPT_FAILURE: IKE (connection id 0) unable to decrypt (w/RSA private key) packet"

R1#ping 2.2.2.2 source 1.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1

*Feb 20 12:32:57.499: IPSEC(key_engine): request timer fired: count = 1,
(identity) local= 12.1.1.1, remote= 12.1.1.2,
local_proxy= 1.1.1.0/255.255.255.0/0/0 (type=4),
remote_proxy= 2.2.2.0/255.255.255.0/0/0 (type=4)
*Feb 20 12:32:57.499: select crypto engine: ce_engine[2] does not accept the capabilities
*Feb 20 12:32:57.499: select crypto engine: ce_engine[2] does not accept the capabilities
*Feb 20 12:32:57.499: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 12.1.1.1, remote= 12.1.1.2,
local_proxy= 1.1.1.0/255.255.255.0/0/0 (type=4),
remote_proxy= 2.2.2.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-sha-hmac (Tunnel),
lifedur= 3600s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
*Feb 20 12:32:57.499: ISAKMP:(0): SA request profile is (NULL)
*Feb 20 12:32:57.499: ISAKMP: Created a peer struct for 12.1.1.2, peer port 500
*Feb 20 12:32:57.499: ISAKMP: New peer created peer = 0xB5F85C90 peer_handle = 0x8000000B
*Feb 20 12:32:57.499: ISAKMP: Locking peer struct 0xB5F85C90, refcount 1 for isakmp_initiator
*Feb 20 12:32:57.499: ISAKMP: local port 500, remote port 500
*Feb 20 12:32:57.499: select crypto engine: ce_engine[2] does not accept the capabilities
*Feb 20 12:32:57.499: ISAKMP: set new node 0 to QM_IDLE
*Feb 20 12:32:57.499: ISAKMP:(0):insert sa successfully sa = B563A678
*Feb 20 12:32:57.499: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
*Feb 20 12:32:57.499: ISAKMP:(0):found peer pre-shared key matching 12.1.1.2
*Feb 20 12:32:57.499: select crypto engine: ce_engine[2] does not accept the capabilities
*Feb 20 12:32:57.499: ISAKMP:(0):incorrect policy settings. Unable to initiate.
*Feb 20 12:32:57.499: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Feb 20 12:32:57.499: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1

*Feb 20 12:32:57.499: ISAKMP: Unlocking peer struct 0xB5F85C90 for isadb_unlock_peer_delete_sa(), count 0
*Feb 20 12:32:57.499: ISAKMP: Deleting peer node by peer_reap for 12.1.1.2: B5F85C90
*Feb 20 12:32:57.499: ISAKMP:(0):purging SA., sa=B563A678, delme=B563A678
*Feb 20 12:32:57.499: ISAKMP:(0):purging node 172968404
*Feb 20 12:32:57.499: ISAKMP: Error while processing SA request: Failed to initialize SA
*Feb 20 12:32:57.499: ISAKMP: Error while processing KMI message 0, error 2.
*Feb 20 12:32:57.499: IPSEC(key_engine): got a queue event with 1 KMI message(s).....
Success rate is 0 percent (0/5)

--------------------------------------------------------------------------------------

Cause :
Basically, it is incorrectly RSA key caused decryption failed on the peer. After review all steps again, I found I was using show crypto key mypubkey rsa label R1 to generate key. It looks like router only accept the key which generated by full domain name. To fix issue, we need to use crypto key generate rsa to generate R1.test.com key. After re-generate key again, all looks fine.

R1#sh crypto key mypubkey rsa
% Key pair was generated at: 19:57:54 CST Feb 20 2012
Key name: R1
Storage Device: private-config
Usage: General Purpose Key
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00A28FA5 DC744F51
02B0954B 6ED06BBE 8C30AE2E 7CEBBB82 861E9590 DF27CBED 8C26404F 5A42E174
749CEBC6 427AC823 DD5E1FC1 9C467B70 18128E87 C7567565 D5020301 0001
% Key pair was generated at: 21:13:01 CST Feb 20 2012
Key name: R1.server
Temporary key
Usage: Encryption Key
Key is not exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00B81668 4937CAC9
8B996057 48180B77 B19C3177 119EE6A4 4B79D41C 8FCDF0EC 44F7415D 2E7BE8A4
3FE8BC6A E554586F ECAE5EDA C45A1E26 8A57C64C C7296E4B 0A14582D 021D2CF1
0A9C903C 1EFF9283 E9E2B28C 5C07F11E 42045F04 956B10FA A9020301 0001
% Key pair was generated at: 21:14:05 CST Feb 20 2012
Key name: R1.test.com
Storage Device: not specified
Usage: General Purpose Key
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E1BF42 30D90C58
AA2E7978 44D0706E DDFA8A87 5C8C2C72 D33A5030 A5902E9B E156AD48 94E7364F
8D0E3880 78CEFFD4 5CB75C2C DFF6586C E5168D7C 57B495CF 99020301 0001

R2#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
12.1.1.1 12.1.1.2 QM_IDLE 1001 ACTIVE
----------------------------------------------------------------------------------------------

R1#sh run
Building configuration...

Current configuration : 2445 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
clock timezone CST 8
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip source-route
!
!
!
!
ip cef
ip domain name test.com
no ipv6 traffic interface-statistics
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
redundancy
!
!
crypto isakmp policy 10
authentication rsa-encr
!
!
crypto ipsec transform-set P2-Transform esp-des esp-sha-hmac
!
crypto map P2-Transform 10 ipsec-isakmp
set peer 12.1.1.2
set transform-set P2-Transform
match address acl_vpn
!
!
crypto key pubkey-chain rsa
addressed-key 12.1.1.2 encryption
address 12.1.1.2
key-string
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00EFFA4A B7F46348
6FDE6D35 C9FA3F48 75EC7F85 080AFB77 1306A1E1 81936A60 FE95A7AA 278516AB
87E7E70E AB957573 7B25508C 35DA3972 3CA6C5BB EB52C3BE F3020301 0001
quit
!
!
ip ssh version 1
!
!
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/0
no ip address
shutdown
!
interface Ethernet0/1
no ip address
shutdown
!
interface Ethernet0/2
no ip address
shutdown
!
interface Ethernet0/3
no ip address
shutdown
!
interface Ethernet1/0
no ip address
shutdown
!
interface Ethernet1/1
no ip address
shutdown
!
interface Ethernet1/2
no ip address
shutdown
!
interface Ethernet1/3
ip address 12.1.1.1 255.255.255.0
crypto map P2-Transform
!
interface Serial2/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/3
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/3
no ip address
shutdown
serial restart-delay 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 2.2.2.0 255.255.255.0 12.1.1.2
!
ip access-list extended acl_vpn
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255
!
!
!
!
!
!
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
exception data-corruption buffer truncate
end

Sunday, February 19, 2012

Cisco IOU IPsec Site to Site VPN with Pre-shared key, RSA Key, or CA Part 1

Cisco IOU IPsec Site to Site VPN

R1#sh ver
Cisco IOS Software, Linux Software (I86BI_LINUX-ADVENTERPRISEK9-M), Experimental Version 12.4(20090407:185408) [yuiu-redbuild-V124_24_5_6_PIC1 177]
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 08-Apr-09 02:09 by yuiu

ROM: Bootstrap program is Linux

R1 uptime is 45 minutes
System returned to ROM by reload at 0
System image file is "unix:../i86bi_linux-adventerprisek9-ms"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Linux Unix (Intel-x86) processor with 40401K bytes of memory.
Processor board ID 1
8 Ethernet interfaces
8 Serial interfaces
16K bytes of NVRAM.

Configuration register is 0x0

R1#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater

Device ID Local Intrfce Holdtme Capability Platform Port ID
R2.test.com Eth 1/3 129 R Linux Uni Eth 1/3

Physical Diagram

R1#sh run
Building configuration...

Current configuration : 2144 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
clock timezone CST 8
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip source-route
!
ip cef
ip domain name test.com
no ipv6 traffic interface-statistics
no ipv6 cef
!
multilink bundle-name authenticated
!
redundancy
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key 123456 address 12.1.1.2
!
!
crypto ipsec transform-set P2-Transform esp-des esp-sha-hmac
!
crypto map P2-Transform 10 ipsec-isakmp
set peer 12.1.1.2
set transform-set P2-Transform
match address acl_vpn
!
!
!
!
!
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/0
no ip address
shutdown
!
interface Ethernet0/1
no ip address
shutdown
!
interface Ethernet0/2
no ip address
shutdown
!
interface Ethernet0/3
no ip address
shutdown
!
interface Ethernet1/0
no ip address
shutdown
!
interface Ethernet1/1
no ip address
shutdown
!
interface Ethernet1/2
no ip address
shutdown
!
interface Ethernet1/3
ip address 12.1.1.1 255.255.255.0
crypto map P2-Transform
!
interface Serial2/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/3
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/3
no ip address
shutdown
serial restart-delay 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 2.2.2.0 255.255.255.0 12.1.1.2
!
ip access-list extended acl_vpn
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255
!
!
!
!
!
!
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!

exception data-corruption buffer truncate
end

--------------------------------------------------------------------------------------------------------

R2#sh run
Building configuration...

Current configuration : 2128 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
clock timezone CST 8
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip source-route
!
!
!
!
ip cef
ip domain name test.com
no ipv6 traffic interface-statistics
no ipv6 cef
!
multilink bundle-name authenticated
!
redundancy
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key 123456 address 12.1.1.1
!
!
crypto ipsec transform-set P2-Tran esp-des esp-sha-hmac
!
crypto map P1-P2-Map 10 ipsec-isakmp
set peer 12.1.1.1
set transform-set P2-Tran
match address acl_vpn
!
interface Loopback0
ip address 2.2.2.2 255.255.255.0
!
interface Ethernet0/0
no ip address
shutdown
!
interface Ethernet0/1
no ip address
shutdown
!
interface Ethernet0/2
no ip address
shutdown
!
interface Ethernet0/3
no ip address
shutdown
!
interface Ethernet1/0
no ip address
shutdown
!
interface Ethernet1/1
no ip address
shutdown
!
interface Ethernet1/2
no ip address
shutdown
!
interface Ethernet1/3
ip address 12.1.1.2 255.255.255.0
crypto map P1-P2-Map
!
interface Serial2/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/3
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/3
no ip address
shutdown
serial restart-delay 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 1.1.1.0 255.255.255.0 12.1.1.1
!
ip access-list extended acl_vpn
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
exception data-corruption buffer truncate
end

--------------------------------------------------------------------------------------------

R2#ping 1.1.1.1 source 2.2.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/9/24 ms

R2#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
12.1.1.1 12.1.1.2 QM_IDLE 1001 ACTIVE

IPv6 Crypto ISAKMP SA

R2#

Sunday, February 12, 2012

JunOS SRX Source Routing, PBR, FBF

Enabling Source Routing

Starting in Junos OS Release 8.2 for IPv6 and Junos OS Release 8.5 for IPv4, source routing is disabled by default on J Series Services Routers , M Series Multiservice Edge Routers, MX Series Ethernet Services Routers, T Series Core Routers, and on EX Series switches. To enable source routing, include the source-routing statement:

source-routing {(ip | ipv6);}
----------------------------------------------------------------------

On Netscreen:

set source-routing enable
set route source 192.168.200.0/0 interface ethernet0/3 gateway x.x.x.x(公网IP) preference 20

------------------------------------------------------------------------------------

PBR is called filter-based forwarding (FBF) in Junos

Note: When searching the Technical Documentation for Policy Based Routing (PBR) configuration, search for: filter-based forwarding

------------------------------------------------------------------------

Configuring Filter-Based Forwarding

http://www.juniper.net/techpubs/en_US/junos10.4/topics/usage-guidelines/policy-configuring-filter-based-forwarding.html

You can configure filters to classify packets based on source address and specify the forwarding path the packets take within the router by configuring a filter on the ingress interface. For example, you can use this filter for applications to differentiate traffic from two clients that have a common access layer (for example, a Layer 2 switch) but are connected to different Internet service providers (ISPs). When the filter is applied, the router can differentiate the two traffic streams and direct each to the appropriate network. Depending on the media type the client is using, the filter can use the source IP address to forward the traffic to the corresponding network through a tunnel. You can also configure filters to classify packets based on IP protocol type or IP precedence bits.

Note: Source-class usage filter matching and unicast reverse-path forwarding checks are not supported on an interface configured with filter-based forwarding (FBF).

You can also forward packets based on output filters by configuring a filter on the egress interfaces. In the case of port mirroring, it is useful for port-mirrored packets to be distributed to multiple monitoring PICs and collection PICs based on patterns in packet headers. FBF on the port-mirroring egress interface must be configured.

Packets forwarded to the output filter have been through at least one route lookup when an FBF filter is configured on the egress interface. After the packet is classified at the egress interface by the FBF filter, it is redirected to another routing table for further route lookup.

Filter-based forwarding is supported for IPv4 and IPv6.

To direct traffic meeting defined match conditions to a specific routing instance, include the routing-instance filter action:

routing-instance routing-instance;

For IPv4 traffic, include the action at the [edit firewall family inet filter filter-name term term-name then] hierarchy level. For IPv6 traffic, include the action at the [edit firewall family inet6 filter filter-name term term-name then] hierarchy level. For MPLS traffic, configure the filter terms at the [edit firewall family mpls filter filter-name term term-name then] hierarchy level.

The routing-instance filter action accepts the traffic meeting the match conditions and directs it to the routing instance named in routing-instance. For information about forwarding instances and routing instances, see the Junos OS Routing Protocols Configuration Guide.

Note: In Junos OS Release 9.0 and later, you can no longer specify a routing-instance name of default or include special characters within the name of a routing instance.

To complete the configuration, you must also create a routing table group that adds interface routes to the following routing instances:

Routing instance named in the action
Default routing table inet.0

You create a routing table group to resolve the routes installed in the routing instance to directly connected next hops on that interface. For more information on routing table groups and interface routes, see the Junos OS Routing Protocols Configuration Guide.

Examples: Configuring Filter-Based Forwarding

Configure a filter to direct traffic to ISP1 or ISP2 based on source address matching:

[edit firewall]family inet {filter classify-customers {term isp1-customers {from {source-address 10.1.1.0/24;source-address 10.1.2.0/24;}then {routing-instance isp1-route-table;}}term isp2-customers {from {source-address 10.2.1.0/24;source-address 10.2.2.0/24;}then {routing-instance isp2-route-table;}}term default {then {accept;}}}}

Configure a filter-based forwarding (FBF) filter for family inet6:

[edit]firewall {family inet6 {filter ftf_fbf {term 0 {from {source-address {::10.34.1.0/120;}}then {count ce1;log;routing-instance ce1;}}term 1 {from {source-address {::10.34.2.0/120;}}then {count ce2;log;routing-instance ce2;}}term default {then {count default;accept;}}}}}

Network Security Memorandum

Pages