Thursday, August 4, 2016

How do I create a Route Based LAN to LAN VPN by using preshared secrets (Juniper to pfSense with ScreenOS 6.0 and later)?

How do I create a Route Based LAN to LAN VPN by using preshared secrets (ScreenOS 6.0 and later)?

SUMMARY:
This article provides information on how to create a Route Based LAN to LAN VPN by using preshared secrets in ScreenOS 6.x.
PROBLEM OR GOAL:
Environment:
  • Preshared secrets

  • Route Based VPN

  • Static IP Addresses on both gateways of VPN
CAUSE:
 
SOLUTION:
  • This example assumes that static IP addresses are assigned on both of the VPN devices of the VPN tunnel.   

  • The tunnel interfaces are created in the Untrust zone. 

  • The preshared secret used is netscreen.

  • The following matrix displays the IP addresses and proposals that are used for this example:

    SiteAB
    Untrust IP of Firewall1.1.1.1 (eth0/0)2.2.2.1  (eth0/0)
    Trust Network10.1.1.0/24172.16.10.0/24
    Phase 1 Proposalpre-g2-3des-shapre-g2-3des-sha
    Phase 2 Proposalg2-esp-3des-shag2-esp-3des-sha


WebUI

Site A:
  1. Create tunnel interface:
    Click Network > Interfaces> List
    1. In upper right corner, select pulldown 'Tunnel IF', and Click New
      1. Interface Name: tunnel.1
      2. Zone: Untrust (trust-vr)
      3. Click unnumbered
      4. Interface ethernet0/0 (trust-vr)     (or whichever interface is in same zone (Untrust) that it can borrow an IP from)
      5. Click OK
  2. Click VPNs > AutoKey Advanced > Gateway
    Click New
    1. Gateway Name: Site B GW
    2. Remote Gateway: Click Static, and enter IP address 2.2.2.1
    3. Click Advanced
    4. Preshared Key: netscreen
    5. Outgoing Interface: ethernet0/0 (or whichever interface goes out to the Internet)
    6. Security Level, User-Defined:  Select Custom, and select Phase 1 Proposal: pre-g2-3des-sha
    7. Mode (Initiator): Main
    8. Click Return
    9. Click OK
  3. Click VPNs > Autokey IKE
    Click New
    1. VPN Name: Site B VPN
    2. Remote Gateway: Click Predefined, and select Site B GW from the pulldown menu
    3. Click Advanced
    4. Security Level, User Defined: Custom, and select Phase 2 Proposal:  g2-esp-3des-sha
    5. Bind To: Tunnel Interface. Select tunnel.1
    6. Click Proxy ID
      1. Local IP/Netmask: 10.1.1.0 / 24
      2. Remote IP/Netmask: 172.16.10.0 /24
      3. Service: ANY
    7. Click VPN Monitor  (recommended)
    8. Click Optimized  (recommended)
    9. Click Rekey  (recommended)
    10. Click Return 
    11. Click OK    (Important)
  4. Click Policy > Policies
    1. Select From Trust to Untrust Zone, and click New
      1. Source Address: Click New Address, and enter 10.1.1.0/24
      2. Destination Address: Click New Address, and enter 172.16.10.0/24
      3. Service: Any
      4. Action: Permit   (Note:  Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
      5. Position at Top: Enabled
      6. Click OK
    2. Select From Untrust to Trust Zone, and click New
      1. Source Address: Click New Address, and enter 172.16.10.0/24
      2. Destination Address: Click New Address, and enter 10.1.1.0/24
      3. Service: Any
      4. Action: Permit   (Note:  Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
      5. Position at Top: Enabled
      6. Click OK
  5. Create static route for destination network through VPN:
    1. Click Network > Routing > Destination
    2. Click New
    3. Network Address / Netmask: 172.16.10.0 / 255.255.255.0
    4. Click Gateway
    5. Interface: tunnel.1
    6. Click OK
Site B:
  1. Create tunnel interface:
    Click Network > Interfaces> List
    1. In upper right corner, select pulldown 'Tunnel IF', and Click New
      1. Interface Name: tunnel.1
      2. Zone: Untrust (trust-vr)
      3. Click unnumbered
      4. Interface ethernet0/0 (trust-vr)     (or whichever interface is in same zone (Untrust) that it can borrow an IP from)
      5. Click OK
  2. Click VPNs > AutoKey Advanced > Gateway
    Click New
    1. Gateway Name: Site A GW
    2. Remote Gateway: Click Static, and enter IP address 1.1.1.1
    3. Click Advanced
    4. Preshared Key: netscreen
    5. Outgoing Interface: ethernet0/0 (or whichever interface goes out to the Internet)
    6. Security Level, User-Defined:  Select Custom, and select Phase 1 Proposal: pre-g2-3des-sha
    7. Mode (Initiator): Main
    8. Click Return
    9. Click OK
  3. Click VPNs > Autokey IKE
    Click New
    1. VPN Name: Site A VPN
    2. Remote Gateway: Click Predefined, and select Site A GW from the pulldown menu
    3. Click Advanced
    4. Security Level, User Defined: Custom, and select Phase 2 Proposal:  g2-esp-3des-sha
    5. Bind To: Tunnel Interface. Select tunnel.1
    6. Click Proxy ID
      1. Local IP/Netmask: 172.16.10.0/24
      2. Remote IP/Netmask: 10.1.1.0/24
      3. Service: ANY
    7. Click VPN Monitor  (recommended)
    8. Click Optimized  (recommended)
    9. Click Rekey  (recommended)
    10. Click Return 
    11. Click OK    (Important)
  4. Click Policy > Policies
    1. Select From Trust to Untrust Zone, and click New
      1. Source Address: Click New Address, and enter 172.16.10.0/24
      2. Destination Address: Click New Address, and enter 10.1.1.0/24
      3. Service: Any
      4. Action: Permit   (Note:  Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
      5. Position at Top: Enabled
      6. Click OK
    2. Select From Untrust to Trust Zone, and click New
      1. Source Address: Click New Address, and enter 10.1.1.0/24
      2. Destination Address: Click New Address, and enter 172.16.10.0/24
      3. Service: Any
      4. Action: Permit   (Note:  Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
      5. Position at Top: Enabled
      6. Click OK
  5. Create static route for destination network through VPN:
    1. Click Network > Routing > Destination
    2. Click New
    3. Network Address / Netmask: 10.1.1.0 / 255.255.255.0
    4. Click Gateway
    5. Interface: tunnel.1
    6. Click OK
NOTE:
If the tunnel interface is bound to the trust zone (i.e. you specified Zone Trust in step 1.1.2), then no policies are needed (i.e. step 4), since everything is routed. The VPN communication is effectively a trust to trust policy.

CLI

Site A:
  1. Create tunnel interface
    1. set int tun.1 zone untrust
    2. set int tun.1 ip unnumbered interface e0/0
  2. Set Gateway
    1. set ike gateway "Site B GW" address 2.2.2.1 outgoing-interface e0/0 preshare netscreen proposal pre-g2-3des-sha
  3. Set Autokey Ike
    1. set vpn "Site B VPN" gateway "Site B GW" proposal g2-esp-3des-sha
    2. set vpn "Site B VPN" bind int tun.1
    3. set vpn "Site B VPN" proxy-id local-ip 10.1.1.10/24 remote-ip 172.16.10.0/24 any
    4. set vpn "Site B VPN" monitor optimized rekey
  4. Set Policies
    1. set address trust 10.1.1.0/24 10.1.1.0/24
    2. set address untrust 172.16.10.0/24 172.16.10.0/24
    3. set policy from trust to untrust 10.1.1.0/24 172.16.10.0/24 any permit
    4. set policy id xx move before (name of first policy) from trust to untrust
    5. set policy from untrust to trust 172.16.10.0/24 10.1.1.0/24 any permit
    6. set policy id xx move before (name of first policy) from untrust to trust
  5. Create static route
    1. set route 172.16.10.0/24 int tun.1
Site B:
  1. Create tunnel interface
    1. set int tun.1 zone untrust
    2. set int tun.1 ip unnumbered interface e0/0
  2. Set Gateway
    1. set ike gateway "Site A GW" address 1.1.1.1 outgoing-interface e0/0 preshare netscreen proposal pre-g2-3des-sha
  3. Set Autokey Ike
    1. set vpn "Site A VPN" gateway "Site A GW" proposal g2-esp-3des-sha
    2. set vpn "Site A VPN" bind int tun.1
    3. set vpn "Site A VPN" proxy-id local-ip 172.16.10.0/24 remote-ip 10.1.1.10/24 any
    4. set vpn "Site A VPN" monitor optimized rekey
  4. Set Policies
    1. set address trust 172.16.10.0/24 172.16.10.0/24
    2. set address untrust 10.1.1.0/24 10.1.1.0/24
    3. set policy from trust to untrust 172.16.10.0/24 10.1.1.0/24 any permit
    4. set policy id xx move before (name of first policy) from trust to untrust
    5. set policy from untrust to trust 10.1.1.0/24 172.16.10.0/24 any permit
    6. set policy id xx move before (name of first policy) from untrust to trust
  5. Create static route
    1. set route 10.1.1.0/24 int tun.1

 If you have performed the following procedure,and need help with troubleshooting, refer to the VPN Configuration & Troubleshooting Guide.

Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)