#Set vpn monitor rekey junos manual
#Set vpn monitor rekey junos software

Set security ike proposal SHA256-AES128-5-86400 authentication-method pre-shared-keys Set security ike proposal SHA256-AES128-5-86400 description ike-phase1-proposal1 The structure of the config is about the same on both routers, but, as usual, the names of the sections do not coincide at all. Tunnel protection ipsec profile IPSEC-PROFILE-AMS1-VPN2 Ikev2 local-authentication pre-shared-key. Ikev2 remote-authentication pre-shared-key. Set security-association lifetime seconds 3600 Set security-association lifetime kilobytes unlimited Protocol esp encryption aes-256 aes-192 aesĬrypto ipsec profile IPSEC-PROFILE-AMS1-VPN2 DPD (dead peer detection) and vpn-monitor are used up to the heap (they have a slightly different type of checks, for reliability I use both).Ĭrypto ipsec ikev2 ipsec-proposal SHA256-AES128 It can be seen that IKEv2 is used, without traffic-selectors (we already have enough tools in our arsenal to restrict traffic flow - from BGP prefix lists to security policies). Set security zones security-zone ZONE-VPN interfaces st0.7 host-inbound-traffic protocols bgp Set security zones security-zone ZONE-VPN interfaces st0.7 host-inbound-traffic system-services traceroute

Set security zones security-zone ZONE-VPN interfaces st0.7 host-inbound-traffic system-services ike Set security zones security-zone ZONE-VPN interfaces st0.7 host-inbound-traffic system-services ping Set interfaces st0 unit 7 family inet address 169.254.100.1/30 Set interfaces st0 unit 7 family inet mtu 1436 Set interfaces st0 unit 7 description 'ASA An圜onnect router' Set security ipsec vpn VPN-ASA establish-tunnels immediately Set security ipsec vpn VPN-ASA ike ipsec-policy SHA256-AES128-3600-14-policy Set security ipsec vpn VPN-ASA ike gateway GW-ASA Set security ipsec vpn VPN-ASA vpn-monitor destination-ip 169.254.100.2 Set security ipsec vpn VPN-ASA vpn-monitor source-interface st0.7 Set security ipsec vpn VPN-ASA df-bit clear Set security ipsec vpn VPN-ASA bind-interface st0.7 Set security ike gateway GW-ASA version v2-only Set security ike gateway GW-ASA external-interface ae0.4 Set security ike gateway GW-ASA local-identity inet 198.51.100.2 Set security ike gateway GW-ASA dead-peer-detection threshold 3 Set security ike gateway GW-ASA dead-peer-detection interval 10 Set security ike gateway GW-ASA address 192.0.2.2 Set security ike gateway GW-ASA ike-policy IKE-ASA Set security ike policy IKE-ASA pre-shared-key ascii-text. Set security ike policy IKE-ASA proposals SHA256-AES128-5-86400

Set security ike policy IKE-ASA mode main I have quite a few different tunnels built on it, in the end I came to something like this:

route based IPSec between them (routing will be provided by BGP, I will also say a few words about it).

ASA was with our partner, then there was no way to debug, respectively.Īnd now the opportunity presented itself to assemble a scheme in which both sides (both SRX and ASA) are under our control, respectively, you can play wonderfully well. And again in the logs there is silence and confusion.

#Set vpn monitor rekey junos manual

And again unsuccessfully - during regeneration, the tunnel fell safely (and it did not always rise without a manual restart). And at the current job, not so long ago, the chance presented itself to reassemble such a scheme.

#Set vpn monitor rekey junos software

Since then, the recommended JunOS for SRX has been updated to 15.1 (for the SRX300 line, at least), and ASA learned in route based IPSec (from software version 9.8), which somewhat simplifies the configuration.