[Juniper SRX] Implementasi Policy Based Site-to-Site VPN

Post Views: 3,333

Masih ingin membahas terkait implementasi vpn di juniper, kali ini mengenai bagaimana konfigurasi policy based vpn, pada tulisan ini saya tidak memulai dari awal, melainkan melanjutkan tulisan sebelumnya, anda bisa cek disini

Beberapa catatan terkait policy based vpn dalam hal configurasinya adalah anda tidak membuat interface tunnel atau dikenal dengan interface st, maka routing ke arah lawan tidak perlu dibuat atau dilewatin ke arah interface st tersebut, nah untuk meng-apply konfigurasi vpn yang anda buat itu di set security policy yang anda buat, yaitu yang ke arah site vpn lawan. Mari kita lihat konfigurasi lengkapnya:

##RouteCloud-HQ

Set Interface

root@RouteCloud-HQ> show configuration interfaces
ge-0/0/0 {
    unit 0 {
        family inet {
            address 172.172.16.1/29;
        }
    }
}
ge-0/0/1 {
    unit 0 {
        family inet {
            address 10.20.20.1/24;
        }
    }
}

root@RouteCloud-HQ> show configuration interfaces

ge-0/0/0 {

unit 0 {

family inet {

address 172.172.16.1/29;

}

ge-0/0/1 {

unit 0 {

family inet {

address 10.20.20.1/24;

}

Set Route

root@RouteCloud-HQ> show configuration routing-options
static {
    route 0.0.0.0/0 next-hop 172.172.16.6;
}

root@RouteCloud-HQ> show configuration routing-options

static {

route 0.0.0.0/0 next-hop 172.172.16.6;

}

Set Zone

root@RouteCloud-HQ> show configuration security zones
security-zone Public {
    address-book {
        address brnach1 10.30.30.0/24;
    }
    interfaces {
        ge-0/0/0.0 {
            host-inbound-traffic {
                system-services {
                    ike;
                    ping;
                }
            }
        }
    }
}
security-zone Private {
    address-book {
        address hq-net 10.20.20.0/24;
    }
    interfaces {
        ge-0/0/1.0 {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
        }
    }
}

root@RouteCloud-HQ> show configuration security zones

security-zone Public {

address-book {

address brnach1 10.30.30.0/24;

}

interfaces {

ge-0/0/0.0 {

host-inbound-traffic {

system-services {

ike;

ping;

}

security-zone Private {

address-book {

address hq-net 10.20.20.0/24;

}

interfaces {

ge-0/0/1.0 {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

Interface/zone outbound or yang ke arah site remote anda perlu meng-enable service IKE nya, sama untuk testing koneksi anda bisa aktifin service ping pada interface atau zone tersebut.

Set IKE Fase 1

root@RouteCloud-HQ> show configuration security ike
traceoptions {
    file fase1-log world-readable;
    flag all;
}
proposal ike-phase1-proposal {
    authentication-method pre-shared-keys;
    dh-group group2;
    authentication-algorithm sha1;
    encryption-algorithm aes-128-cbc;
}
policy ike-phase1-policy {
    mode main;
    proposals ike-phase1-proposal;
    pre-shared-key ascii-text "$9$fTF6/CpRhyM8Uikqf5IEhrM8"; ## SECRET-DATA
}
gateway gw-branch1 {
    ike-policy ike-phase1-policy;
    address 172.173.17.1;
    external-interface ge-0/0/0;
}

root@RouteCloud-HQ> show configuration security ike

traceoptions {

file fase1-log world-readable;

flag all;

}

proposal ike-phase1-proposal {

authentication-method pre-shared-keys;

dh-group group2;

authentication-algorithm sha1;

encryption-algorithm aes-128-cbc;

}

policy ike-phase1-policy {

mode main;

proposals ike-phase1-proposal;

pre-shared-key ascii-text "$9$fTF6/CpRhyM8Uikqf5IEhrM8"; ## SECRET-DATA

}

gateway gw-branch1 {

ike-policy ike-phase1-policy;

address 172.173.17.1;

external-interface ge-0/0/0;

}

seperti biasa ada 3 yang diset untuk konfigurasi ike phase 1 yaitu ike proposal, ike policy sama ike gateway. pastikan shared key yang anda set harus sama antara site HQ dan site remote.

Set IPSec Fase 2

root@RouteCloud-HQ> show configuration security ipsec
traceoptions {
    flag all;
}
proposal ipsec-phase2-proposal {
    protocol esp;
    authentication-algorithm hmac-sha1-96;
    encryption-algorithm aes-128-cbc;
}
policy ipsec-phase2-policy {
    perfect-forward-secrecy {
        keys group2;
    }
    proposals ipsec-phase2-proposal;
}
vpn ike-vpn-branch1 {
    ike {
        gateway gw-branch1;
        ipsec-policy ipsec-phase2-policy;
    }
}

root@RouteCloud-HQ> show configuration security ipsec

traceoptions {

flag all;

}

proposal ipsec-phase2-proposal {

protocol esp;

authentication-algorithm hmac-sha1-96;

encryption-algorithm aes-128-cbc;

}

policy ipsec-phase2-policy {

perfect-forward-secrecy {

keys group2;

}

proposals ipsec-phase2-proposal;

}

vpn ike-vpn-branch1 {

ike {

gateway gw-branch1;

ipsec-policy ipsec-phase2-policy;

}

Untuk IPSec fase 2 ada 3 bagian yang anda konfigurasi yaitu ipsec proposal, ipsec policy, dan ipsec vpn.

Apply VPN di Security Policy:

root@RouteCloud-HQ> show configuration security policies
from-zone Public to-zone Private {
    policy Public-Private-VPN {
        match {
            source-address brnach1;
            destination-address hq-net;
            application any;
        }
        then {
            permit {
                tunnel {
                    ipsec-vpn ike-vpn-branch1;
                    pair-policy Private-Public-VPN;
                }
            }
        }
    }
    policy permit-any {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone Private to-zone Public {
    policy Private-Public-VPN {
        match {
            source-address hq-net;
            destination-address brnach1;
            application any;
        }
        then {
            permit {
                tunnel {
                    ipsec-vpn ike-vpn-branch1;
                    pair-policy Public-Private-VPN;
                }
            }
        }
    }
    policy permit-any {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}

root@RouteCloud-HQ> show configuration security policies

from-zone Public to-zone Private {

policy Public-Private-VPN {

match {

source-address brnach1;

destination-address hq-net;

application any;

}

then {

permit {

tunnel {

ipsec-vpn ike-vpn-branch1;

pair-policy Private-Public-VPN;

}

policy permit-any {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone Private to-zone Public {

policy Private-Public-VPN {

match {

source-address hq-net;

destination-address brnach1;

application any;

}

then {

permit {

tunnel {

ipsec-vpn ike-vpn-branch1;

pair-policy Public-Private-VPN;

}

policy permit-any {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

Pastikan vpn policy nya berada di posisi paling atas, jika tidak peernya tidak akan up. kemudian trafic yang match dan dengan vpn policy tersebut akan di enkrispi nantinya, jika trafic tersebut gk match, maka next policy akan digunakan, dalam hal ini policy permit-any yang saya set diatas.

#Branch 1

Set Interface

root@Branch1> show configuration interfaces
ge-0/0/0 {
    unit 0 {
        family inet {
            address 172.173.17.1/29;
        }
    }
}
ge-0/0/1 {
    unit 0 {
        family inet {
            address 10.30.30.1/24;
        }
    }
}

root@Branch1> show configuration interfaces

ge-0/0/0 {

unit 0 {

family inet {

address 172.173.17.1/29;

}

ge-0/0/1 {

unit 0 {

family inet {

address 10.30.30.1/24;

}

Set route

root@Branch1> show configuration routing-options
static {
    route 0.0.0.0/0 next-hop 172.173.17.6;
}

root@Branch1> show configuration routing-options

static {

route 0.0.0.0/0 next-hop 172.173.17.6;

}

Set Zone

root@Branch1> show configuration security zones
security-zone Public {
    address-book {
        address net_hq 10.20.20.0/24;
    }
    interfaces {
        ge-0/0/0.0 {
            host-inbound-traffic {
                system-services {
                    ike;
                    ping;
                }
            }
        }
    }
}
security-zone Private {
    address-book {
        address net-branch 10.30.30.0/24;
    }
    interfaces {
        ge-0/0/1.0 {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
        }
    }
}

root@Branch1> show configuration security zones

security-zone Public {

address-book {

address net_hq 10.20.20.0/24;

}

interfaces {

ge-0/0/0.0 {

host-inbound-traffic {

system-services {

ike;

ping;

}

security-zone Private {

address-book {

address net-branch 10.30.30.0/24;

}

interfaces {

ge-0/0/1.0 {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

Set IKE Fase 1:

root@Branch1> show configuration security ike
traceoptions {
    file fase1-log;
    flag all;
}
proposal ike-phase1-proposal {
    authentication-method pre-shared-keys;
    dh-group group2;
    authentication-algorithm sha1;
    encryption-algorithm aes-128-cbc;
}
policy ike-phase1-policy {
    mode main;
    proposals ike-phase1-proposal;
    pre-shared-key ascii-text "$9$p1vY01EhSlLx-Ygzn/9pu8XxdYg"; ## SECRET-DATA
}
gateway gw-routecloud-hq {
    ike-policy ike-phase1-policy;
    address 172.172.16.1;
    external-interface ge-0/0/0;
}

root@Branch1> show configuration security ike

traceoptions {

file fase1-log;

flag all;

}

proposal ike-phase1-proposal {

authentication-method pre-shared-keys;

dh-group group2;

authentication-algorithm sha1;

encryption-algorithm aes-128-cbc;

}

policy ike-phase1-policy {

mode main;

proposals ike-phase1-proposal;

pre-shared-key ascii-text "$9$p1vY01EhSlLx-Ygzn/9pu8XxdYg"; ## SECRET-DATA

}

gateway gw-routecloud-hq {

ike-policy ike-phase1-policy;

address 172.172.16.1;

external-interface ge-0/0/0;

}

Set IPSec Fase 2

root@Branch1> show configuration security ipsec
traceoptions {
    flag all;
}
proposal ipsec-phase2-proposal {
    protocol esp;
    authentication-algorithm hmac-sha1-96;
    encryption-algorithm aes-128-cbc;
}
policy ipsec-phase2-policy {
    perfect-forward-secrecy {
        keys group2;
    }
    proposals ipsec-phase2-proposal;
}
vpn ike-vpn-hq {
    ike {
        gateway gw-routecloud-hq;
        ipsec-policy ipsec-phase2-policy;
    }
}

root@Branch1> show configuration security ipsec

traceoptions {

flag all;

}

proposal ipsec-phase2-proposal {

protocol esp;

authentication-algorithm hmac-sha1-96;

encryption-algorithm aes-128-cbc;

}

policy ipsec-phase2-policy {

perfect-forward-secrecy {

keys group2;

}

proposals ipsec-phase2-proposal;

}

vpn ike-vpn-hq {

ike {

gateway gw-routecloud-hq;

ipsec-policy ipsec-phase2-policy;

}

Set Policy

root@Branch1> show configuration security policies | no-more
from-zone Public to-zone Private {
    policy PermitVPN {
        match {
            source-address net_hq;
            destination-address net-branch;
            application any;
        }
        then {
            permit {
                tunnel {
                    ipsec-vpn ike-vpn-hq;
                    pair-policy Private-Public-VPN;
                }
            }
        }
    }
    policy permit-any {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone Private to-zone Public {
    policy Private-Public-VPN {
        match {
            source-address net-branch;
            destination-address net_hq;
            application any;
        }
        then {
            permit {
                tunnel {
                    ipsec-vpn ike-vpn-hq;
                    pair-policy PermitVPN;
                }
            }
        }
    }
    policy permit-any {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}

root@Branch1> show configuration security policies | no-more

from-zone Public to-zone Private {

policy PermitVPN {

match {

source-address net_hq;

destination-address net-branch;

application any;

}

then {

permit {

tunnel {

ipsec-vpn ike-vpn-hq;

pair-policy Private-Public-VPN;

}

policy permit-any {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone Private to-zone Public {

policy Private-Public-VPN {

match {

source-address net-branch;

destination-address net_hq;

application any;

}

then {

permit {

tunnel {

ipsec-vpn ike-vpn-hq;

pair-policy PermitVPN;

}

policy permit-any {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

Testing dan Verifikasi:

Lakukan test ping ke arah lawan dari ip client, misal dari client Branch1 ke arah HQ:

Untuk melihat status vpn apakah sudah up atau belum anda bisa pake ikuti langkah berikut:

root@Branch1> show security ike security-associations
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
5447390 UP     ceecabbe057e6ce3  797dfdd8706c91c6  Main           172.172.16.1

root@Branch1> show security ike security-associations detail
IKE peer 172.172.16.1, Index 5447390, Gateway Name: gw-routecloud-hq
  Role: Responder, State: UP
  Initiator cookie: ceecabbe057e6ce3, Responder cookie: 797dfdd8706c91c6
  Exchange type: Main, Authentication method: Pre-shared-keys
  Local: 172.173.17.1:500, Remote: 172.172.16.1:500
  Lifetime: Expires in 27596 seconds
  Peer ike-id: 172.172.16.1
  Xauth assigned IP: 0.0.0.0
  Algorithms:
   Authentication        : hmac-sha1-96
   Encryption            : aes128-cbc
   Pseudo random function: hmac-sha1
   Diffie-Hellman group  : DH-group-2
  Traffic statistics:
   Input  bytes  :                  968
   Output bytes  :                  764
   Input  packets:                    5
   Output packets:                    4
  Flags: IKE SA is created
  IPSec security associations: 1 created, 0 deleted
  Phase 2 negotiations in progress: 0

    Negotiation type: Quick mode, Role: Responder, Message ID: 0
    Local: 172.173.17.1:500, Remote: 172.172.16.1:500
    Local identity: 172.173.17.1
    Remote identity: 172.172.16.1
    Flags: IKE SA is created

root@Branch1> show security ike active-peer
Remote Address                      Port     Peer IKE-ID                         XAUTH username                      Assigned IP
172.172.16.1                        500      172.172.16.1

root@Branch1> show security ipsec security-associations
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway
  <2    ESP:aes-cbc-128/sha1 3dec82b3 2363/ unlim - root 500  172.172.16.1
  >2    ESP:aes-cbc-128/sha1 d8aebcbb 2363/ unlim - root 500  172.172.16.1

root@Branch1> show security ipsec security-associations detail
  ID: 2 Virtual-system: root, VPN Name: ike-vpn-hq
  Local Gateway: 172.173.17.1, Remote Gateway: 172.172.16.1
  Local Identity: ipv4_subnet(any:0,[0..7]=10.30.30.0/24)
  Remote Identity: ipv4_subnet(any:0,[0..7]=10.20.20.0/24)
  Version: IKEv1
    DF-bit: clear
    Policy-name: PermitVPN
  Port: 500, Nego#: 5, Fail#: 0, Def-Del#: 0 Flag: 0x600829
  Last Tunnel Down Reason: Initial contact received
    Direction: inbound, SPI: 3dec82b3, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 2361 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 1766 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64

    Direction: outbound, SPI: d8aebcbb, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 2361 seconds
    Lifesize Remaining:  Unlimited
    Soft lifetime: Expires in 1766 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
    Anti-replay service: counter-based enabled, Replay window size: 64


root@Branch1> show security ipsec statistics
ESP Statistics:
  Encrypted bytes:          2214152
  Decrypted bytes:           530955
  Encrypted packets:           6039
  Decrypted packets:           5718
AH Statistics:
  Input bytes:                    0
  Output bytes:                   0
  Input packets:                  0
  Output packets:                 0
Errors:
  AH authentication failures: 0, Replay errors: 0
  ESP authentication failures: 0, ESP decryption failures: 0
  Bad headers: 0, Bad trailers: 0

root@Branch1> show security ike security-associations

Index State Initiator cookie Responder cookie Mode Remote Address

5447390 UP ceecabbe057e6ce3 797dfdd8706c91c6 Main 172.172.16.1

root@Branch1> show security ike security-associations detail

IKE peer 172.172.16.1, Index 5447390, Gateway Name: gw-routecloud-hq

Role: Responder, State: UP

Initiator cookie: ceecabbe057e6ce3, Responder cookie: 797dfdd8706c91c6

Exchange type: Main, Authentication method: Pre-shared-keys

Local: 172.173.17.1:500, Remote: 172.172.16.1:500

Lifetime: Expires in 27596 seconds

Peer ike-id: 172.172.16.1

Xauth assigned IP: 0.0.0.0

Algorithms:

Authentication : hmac-sha1-96

Encryption : aes128-cbc

Pseudo random function: hmac-sha1

Diffie-Hellman group : DH-group-2

Traffic statistics:

Input bytes : 968

Output bytes : 764

Input packets: 5

Output packets: 4

Flags: IKE SA is created

IPSec security associations: 1 created, 0 deleted

Phase 2 negotiations in progress: 0

Negotiation type: Quick mode, Role: Responder, Message ID: 0

Local: 172.173.17.1:500, Remote: 172.172.16.1:500

Local identity: 172.173.17.1

Remote identity: 172.172.16.1

Flags: IKE SA is created

root@Branch1> show security ike active-peer

Remote Address Port Peer IKE-ID XAUTH username Assigned IP

172.172.16.1 500 172.172.16.1

root@Branch1> show security ipsec security-associations

Total active tunnels: 1

ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway

<2 ESP:aes-cbc-128/sha1 3dec82b3 2363/ unlim - root 500 172.172.16.1

>2 ESP:aes-cbc-128/sha1 d8aebcbb 2363/ unlim - root 500 172.172.16.1

root@Branch1> show security ipsec security-associations detail

ID: 2 Virtual-system: root, VPN Name: ike-vpn-hq

Local Gateway: 172.173.17.1, Remote Gateway: 172.172.16.1

Local Identity: ipv4_subnet(any:0,[0..7]=10.30.30.0/24)

Remote Identity: ipv4_subnet(any:0,[0..7]=10.20.20.0/24)

Version: IKEv1

DF-bit: clear

Policy-name: PermitVPN

Port: 500, Nego#: 5, Fail#: 0, Def-Del#: 0 Flag: 0x600829

Last Tunnel Down Reason: Initial contact received

Direction: inbound, SPI: 3dec82b3, AUX-SPI: 0

, VPN Monitoring: -

Hard lifetime: Expires in 2361 seconds

Lifesize Remaining: Unlimited

Soft lifetime: Expires in 1766 seconds

Mode: Tunnel(0 0), Type: dynamic, State: installed

Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)

Anti-replay service: counter-based enabled, Replay window size: 64

Direction: outbound, SPI: d8aebcbb, AUX-SPI: 0

, VPN Monitoring: -

Hard lifetime: Expires in 2361 seconds

Lifesize Remaining: Unlimited

Soft lifetime: Expires in 1766 seconds

Mode: Tunnel(0 0), Type: dynamic, State: installed

Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)

Anti-replay service: counter-based enabled, Replay window size: 64

root@Branch1> show security ipsec statistics

ESP Statistics:

Encrypted bytes: 2214152

Decrypted bytes: 530955

Encrypted packets: 6039

Decrypted packets: 5718

AH Statistics:

Input bytes: 0

Output bytes: 0

Input packets: 0

Output packets: 0

Errors:

AH authentication failures: 0, Replay errors: 0

ESP authentication failures: 0, ESP decryption failures: 0

Bad headers: 0, Bad trailers: 0

Oke cukup simple ya, 🙂

Jika ada pertanyaan, silahkan komen dibawah,

Keep update ya 🙂

arisyi

arisyi.net

Tag Cloud

Posting Terbaru

Komentar