Technical Tips and Tricks

Monday, February 16, 2015

Juniper Lab Environment - Part V - OSPF NSSA and Totally NSSA

This post is a continuation of my last post, which consisted of multiple OSPF areas, and specifically stub and totally stubby configuration. The fifth part in this series of blog posts will cover a topology that consists of seven vSRXs in my lab network, and a PA-200 that resides at the perimeter of my home network. The goal of this post is to explore the benefits of making area 56 a NSSA and then totally NSSA area. We will then verify connectivity and reach-ability out to the internet from SRX6.

First, let's make area 56 a NSSA area, which will make area 56 almost like a stub area. The main difference is that NSSA's allow redistribution of external routes from the same area.

SRX6 Configuration:

set routing-options static route 10.66.0.0/24 discard
set routing-options static route 10.66.1.0/24 discard
set routing-options static route 10.66.2.0/24 discard
set routing-options static route 10.66.3.0/24 discard
set policy-options policy-statement static term 1 from protocol static
set policy-options policy-statement static term 1 then accept
set protocols ospf export static
set protocols ospf area 0.0.0.56 nssa
set protocols ospf area 0.0.0.56 interface ge-0/0/0.0
set protocols ospf area 0.0.0.56 interface ge-0/0/1.0

Note that above we are adding some static routes and exporting them from the route table to OSPF so that we can simulate the need for configuring a NSSA.

SRX5 Configuration:

set protocols ospf area 0.0.0.56 nssa default-lsa default-metric 10
set protocols ospf area 0.0.0.56 interface ge-0/0/1.0

Here is how the database looks now:

root@6> show ospf database

OSPF database, Area 0.0.0.56
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 5.5.5.5 5.5.5.5 0x80000004 694 0x20 0x64fe 36
Router *6.6.6.6 6.6.6.6 0x80000004 688 0x20 0x3cd 84
Network *10.10.56.6 6.6.6.6 0x80000001 693 0x20 0x2f76 32
Summary 10.7.0.0 5.5.5.5 0x80000002 274 0x20 0x6aa9 28
Summary 10.7.1.0 5.5.5.5 0x80000002 136 0x20 0x5fb3 28
Summary 10.7.2.0 5.5.5.5 0x80000001 1165 0x20 0x56bc 28
Summary 10.7.3.0 5.5.5.5 0x80000001 1165 0x20 0x4bc6 28
Summary 10.10.23.0 5.5.5.5 0x80000001 1165 0x20 0x36c6 28
Summary 10.10.27.0 5.5.5.5 0x80000001 1165 0x20 0x14e3 28
Summary 10.10.34.0 5.5.5.5 0x80000001 1165 0x20 0xb240 28
Summary 10.10.45.0 5.5.5.5 0x80000001 1165 0x20 0x2fb9 28
NSSA 0.0.0.0 5.5.5.5 0x80000003 413 0x20 0x49c9 36
NSSA *10.66.0.0 6.6.6.6 0x80000003 115 0x28 0x4aa7 36
NSSA *10.66.1.0 6.6.6.6 0x80000002 882 0x28 0x41b0 36
NSSA *10.66.2.0 6.6.6.6 0x80000002 882 0x28 0x36ba 36
NSSA *10.66.3.0 6.6.6.6 0x80000002 882 0x28 0x2bc4 36

Now let's take it one step further to make area 56 a totally NSSA, which will shrink the database even more by blocking external routes from other areas, as well as inter-area routes from other areas.

SRX5 Configuration:

set protocols ospf area 0.0.0.56 nssa no-summaries

Here is how the database looks now:

rroot@6> show ospf database

OSPF database, Area 0.0.0.56
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 5.5.5.5 5.5.5.5 0x80000008 3 0x20 0x5c03 36
Router *6.6.6.6 6.6.6.6 0x8000000a 3 0x20 0xb36e 84
Network *10.10.56.6 6.6.6.6 0x80000007 3 0x20 0x237c 32
Summary 0.0.0.0 5.5.5.5 0x80000001 17 0x20 0x75ab 28
NSSA *10.66.0.0 6.6.6.6 0x80000005 3 0x28 0x46a9 36
NSSA *10.66.1.0 6.6.6.6 0x80000004 3 0x28 0x3db2 36
NSSA *10.66.2.0 6.6.6.6 0x80000004 3 0x28 0x32bc 36
NSSA *10.66.3.0 6.6.6.6 0x80000004 3 0x28 0x27c6 36

root@6> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=50 time=26.088 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=50 time=15.279 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=50 time=10.849 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=50 time=10.458 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=50 time=13.091 ms
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 10.458/15.153/26.088/5.734 ms

Saturday, February 14, 2015

Juniper Lab Environment - Part IV - OSPF Stub and Totally Stubby

This post is a continuation of my last post, which consisted of an OSPF virtual link configuration. The fourth part in this series of blog posts will cover a topology that consists of six vSRXs in my lab network, and a PA-200 that resides at the perimeter of my home network. The goal of this post is to explore the benefits of making area 27 a stub area, and then taking it a step further to make it a totally stubby area. We will then verify connectivity and reach-ability out to the internet from SRX7.

Based on the current configuration (see previous posts), we will see all LSA types:

root@7> show ospf database

OSPF database, Area 0.0.0.27
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 2.2.2.2 2.2.2.2 0x80000005 220 0x22 0x8234 36
Router *7.7.7.7 7.7.7.7 0x80000003 1742 0x22 0xc439 84
Network *10.10.27.7 7.7.7.7 0x80000001 1747 0x22 0xb40f 32
Summary 10.10.23.0 2.2.2.2 0x80000004 1257 0x22 0x58ad 28
Summary 10.10.34.0 2.2.2.2 0x80000002 813 0x22 0xec0f 28
Summary 10.10.45.0 2.2.2.2 0x80000003 368 0x22 0x7b73 28
ASBRSum 3.3.3.3 2.2.2.2 0x80000003 516 0x22 0xba6a 28
OSPF AS SCOPE link state database
Type ID Adv Rtr Seq Age Opt Cksum Len
Extern 0.0.0.0 3.3.3.3 0x80000001 497 0x22 0xa6ff 36

Now let's make area 27 a stub area, which will prevent all external routes, as well as local redistribution.

SRX7 Configuration:

set protocols ospf area 0.0.0.27 stub

SRX2 Configuration:

set protocols ospf area 0.0.0.27 stub default-metric 10

Here is how the database looks now:

root@7> show ospf database

OSPF database, Area 0.0.0.27

Type ID Adv Rtr Seq Age Opt Cksum Len

Router 2.2.2.2 2.2.2.2 0x80000006 9 0x20 0x9e19 36

Router *7.7.7.7 7.7.7.7 0x80000005 8 0x20 0x6697 84

Network *10.10.27.7 7.7.7.7 0x80000003 8 0x20 0xcef4 32

Summary 0.0.0.0 2.2.2.2 0x80000001 181 0x20 0xcf5d 28

Summary 10.10.23.0 2.2.2.2 0x80000001 181 0x20 0x7c8e 28

Summary 10.10.34.0 2.2.2.2 0x80000001 181 0x20 0xdf1 28

Summary 10.10.45.0 2.2.2.2 0x80000001 181 0x20 0x9d55 28

Now let's take it one step further to make area 27 a totally stubby area, which will also prevent inter-area routes.

SRX2 Configuration:

set protocols ospf area 0.0.0.27 stub default-metric 10 no-summaries

Here is how the database looks now:

root@7> show ospf database

OSPF database, Area 0.0.0.27

Type ID Adv Rtr Seq Age Opt Cksum Len

Router 2.2.2.2 2.2.2.2 0x8000000a 4 0x20 0x961d 36

Router *7.7.7.7 7.7.7.7 0x8000000a 3 0x20 0x5c9c 84

Network *10.10.27.7 7.7.7.7 0x80000007 3 0x20 0xc6f8 32

Summary 0.0.0.0 2.2.2.2 0x80000001 19 0x20 0xcf5d 28

root@7> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=51 time=21.304 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=51 time=11.713 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=51 time=10.351 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=51 time=10.280 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=51 time=12.657 ms
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 10.280/13.261/21.304/4.118 ms

Saturday, February 7, 2015

Juniper Lab Environment - Part III - OSPF Virtual Link

This post is a continuation of my last post, which consisted of a BGP and OSPF configuration that connected my home network to my lab. The third part in this series of blog posts will cover a topology that consists of six vSRXs in my lab network, and a PA-200 that resides at the perimeter of my home network. The goal of this post is to add on to the existing OSPF network and focus specifically on the virtual link configuration, and then verify that we can ping out to the internet from SRX7.

SRX3 Configuration:

set interfaces ge-0/0/0 unit 0 family inet address 10.10.23.3/24
set protocols ospf area 0.0.0.23 interface ge-0/0/0.0
set protocols ospf area 0.0.0.0 virtual-link neighbor-id 2.2.2.2 transit-area 0.0.0.23

SRX2 Configuration:

set interfaces ge-0/0/1 unit 0 family inet address 10.10.23.2/24
set interfaces ge-0/0/2 unit 0 family inet address 10.10.27.2/24
set interfaces lo0 unit 0 family inet address 2.2.2.2/32
set routing-options router-id 2.2.2.2
set protocols ospf area 0.0.0.23 interface ge-0/0/1.0
set protocols ospf area 0.0.0.27 interface ge-0/0/2.0
set protocols ospf area 0.0.0.0 virtual-link neighbor-id 3.3.3.3 transit-area 0.0.0.23

SRX7 Configuration:

set interfaces ge-0/0/0 unit 0 family inet address 10.10.27.7/24
set interfaces ge-0/0/1 unit 0 family inet address 10.7.0.7/24
set interfaces ge-0/0/1 unit 0 family inet address 10.7.1.7/24
set interfaces ge-0/0/1 unit 0 family inet address 10.7.2.7/24
set interfaces ge-0/0/1 unit 0 family inet address 10.7.3.7/24
set interfaces lo0 unit 0 family inet address 7.7.7.7/32
set routing-options router-id 7.7.7.7
set protocols ospf area 0.0.0.27 interface ge-0/0/0.0
set protocols ospf area 0.0.0.27 interface ge-0/0/1.0

OSPF requires all areas to be directly connected to area 0. In certain cases, it may be required to add an OSPF area that resides on the other side of a non-area 0 area. As shown above, Juniper requires that the virtual link configuration resides on ABRs that connect areas 27<->23 and 23<->0.

Verification:

root@1> show route receive-protocol bgp 10.10.13.3

inet.0: 15 destinations, 16 routes (15 active, 0 holddown, 0 hidden)
Prefix Nexthop MED Lclpref AS path
* 3.3.3.3/32 10.10.13.3 65003 I
* 10.7.0.0/24 10.10.13.3 3 65003 I
* 10.7.1.0/24 10.10.13.3 3 65003 I
* 10.7.2.0/24 10.10.13.3 3 65003 I
* 10.7.3.0/24 10.10.13.3 3 65003 I
10.10.13.0/24 10.10.13.3 65003 I
* 10.10.23.0/24 10.10.13.3 65003 I
* 10.10.27.0/24 10.10.13.3 2 65003 I
* 10.10.34.0/24 10.10.13.3 65003 I
* 10.10.45.0/24 10.10.13.3 2 65003 I

root@3> show ospf database

OSPF database, Area 0.0.0.0
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 2.2.2.2 2.2.2.2 0x80000002 675 0x22 0x8dd 36
Router *3.3.3.3 3.3.3.3 0x8000017d 1691 0x22 0x8757 48
Router 4.4.4.4 4.4.4.4 0x8000016b 1924 0x22 0x7621 48
Router 5.5.5.5 5.5.5.5 0x8000015a 81 0x22 0x9093 36
Network 10.10.34.4 4.4.4.4 0x80000158 1924 0x22 0xf981 32
Network 10.10.45.5 5.5.5.5 0x80000152 81 0x22 0xb8b0 32
Summary 10.7.0.0 2.2.2.2 0x80000001 877 0x22 0x8a97 28
Summary 10.7.1.0 2.2.2.2 0x80000001 877 0x22 0x7fa1 28
Summary 10.7.2.0 2.2.2.2 0x80000001 877 0x22 0x74ab 28
Summary 10.7.3.0 2.2.2.2 0x80000001 877 0x22 0x69b5 28
Summary 10.10.23.0 2.2.2.2 0x80000005 378 0x22 0x56ae 28
Summary *10.10.23.0 3.3.3.3 0x80000004 1699 0x22 0x3ac7 28
Summary 10.10.27.0 2.2.2.2 0x80000005 877 0x22 0x2ad6 28
ASBRSum 3.3.3.3 2.2.2.2 0x80000003 853 0x22 0xba6a 28

OSPF database, Area 0.0.0.23
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 2.2.2.2 2.2.2.2 0x80000004 527 0x22 0x10af 36
Router *3.3.3.3 3.3.3.3 0x80000006 1691 0x22 0xd3de 36
Network *10.10.23.3 3.3.3.3 0x80000001 1699 0x22 0xf8f2 32
Summary 10.7.0.0 2.2.2.2 0x80000001 877 0x22 0x8a97 28
Summary 10.7.1.0 2.2.2.2 0x80000001 877 0x22 0x7fa1 28
Summary 10.7.2.0 2.2.2.2 0x80000001 877 0x22 0x74ab 28
Summary 10.7.3.0 2.2.2.2 0x80000001 877 0x22 0x69b5 28
Summary 10.10.27.0 2.2.2.2 0x80000005 877 0x22 0x2ad6 28
Summary *10.10.34.0 3.3.3.3 0x80000003 1162 0x22 0xc235 28
Summary *10.10.45.0 3.3.3.3 0x80000003 751 0x22 0x5398 28
OSPF AS SCOPE link state database
Type ID Adv Rtr Seq Age Opt Cksum Len
Extern *0.0.0.0 3.3.3.3 0x8000004b 339 0x22 0x124a 36

root@3> show ospf neighbor
Address Interface State ID Pri Dead
10.10.34.4 ge-0/0/1.0 Full 4.4.4.4 128 36
10.10.23.2 vl-2.2.2.2 Full 2.2.2.2 0 30
10.10.23.2 ge-0/0/0.0 Full 2.2.2.2 128 35

root@2> show ospf database

OSPF database, Area 0.0.0.0
Type ID Adv Rtr Seq Age Opt Cksum Len
Router *2.2.2.2 2.2.2.2 0x80000002 595 0x22 0x8dd 36
Router 3.3.3.3 3.3.3.3 0x8000017d 1614 0x22 0x8757 48
Router 4.4.4.4 4.4.4.4 0x8000016b 1847 0x22 0x7621 48
Router 5.5.5.5 5.5.5.5 0x80000159 3004 0x22 0x9292 36
Network 10.10.34.4 4.4.4.4 0x80000158 1847 0x22 0xf981 32
Network 10.10.45.5 5.5.5.5 0x80000151 3004 0x22 0xbaaf 32
Summary *10.7.0.0 2.2.2.2 0x80000001 797 0x22 0x8a97 28
Summary *10.7.1.0 2.2.2.2 0x80000001 797 0x22 0x7fa1 28
Summary *10.7.2.0 2.2.2.2 0x80000001 797 0x22 0x74ab 28
Summary *10.7.3.0 2.2.2.2 0x80000001 797 0x22 0x69b5 28
Summary *10.10.23.0 2.2.2.2 0x80000005 298 0x22 0x56ae 28
Summary 10.10.23.0 3.3.3.3 0x80000004 1622 0x22 0x3ac7 28
Summary *10.10.27.0 2.2.2.2 0x80000005 797 0x22 0x2ad6 28
ASBRSum *3.3.3.3 2.2.2.2 0x80000003 773 0x22 0xba6a 28

OSPF database, Area 0.0.0.23
Type ID Adv Rtr Seq Age Opt Cksum Len
Router *2.2.2.2 2.2.2.2 0x80000004 447 0x22 0x10af 36
Router 3.3.3.3 3.3.3.3 0x80000006 1614 0x22 0xd3de 36
Network 10.10.23.3 3.3.3.3 0x80000001 1621 0x22 0xf8f2 32
Summary *10.7.0.0 2.2.2.2 0x80000001 797 0x22 0x8a97 28
Summary *10.7.1.0 2.2.2.2 0x80000001 797 0x22 0x7fa1 28
Summary *10.7.2.0 2.2.2.2 0x80000001 797 0x22 0x74ab 28
Summary *10.7.3.0 2.2.2.2 0x80000001 797 0x22 0x69b5 28
Summary *10.10.27.0 2.2.2.2 0x80000005 797 0x22 0x2ad6 28
Summary 10.10.34.0 3.3.3.3 0x80000003 1084 0x22 0xc235 28
Summary 10.10.45.0 3.3.3.3 0x80000003 673 0x22 0x5398 28

OSPF database, Area 0.0.0.27
Type ID Adv Rtr Seq Age Opt Cksum Len
Router *2.2.2.2 2.2.2.2 0x80000004 797 0x22 0x526a 36
Router 7.7.7.7 7.7.7.7 0x80000003 758 0x22 0x1ae8 84
Network *10.10.27.2 2.2.2.2 0x80000001 797 0x22 0xcd0f 32
Summary *10.10.23.0 2.2.2.2 0x80000001 1061 0x22 0x5eaa 28
Summary *10.10.34.0 2.2.2.2 0x80000002 150 0x22 0xec0f 28
Summary *10.10.45.0 2.2.2.2 0x80000002 1 0x22 0x7d72 28
ASBRSum *3.3.3.3 2.2.2.2 0x80000001 1061 0x22 0xbe68 28
OSPF AS SCOPE link state database
Type ID Adv Rtr Seq Age Opt Cksum Len
Extern 0.0.0.0 3.3.3.3 0x8000004b 261 0x22 0x124a 36

root@2> show ospf neighbor
Address Interface State ID Pri Dead
10.10.23.3 vl-3.3.3.3 Full 3.3.3.3 0 35
10.10.23.3 ge-0/0/1.0 Full 3.3.3.3 128 33
10.10.27.7 ge-0/0/2.0 Full 7.7.7.7 128 38

root@7> show ospf database

OSPF database, Area 0.0.0.27
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 2.2.2.2 2.2.2.2 0x80000004 692 0x22 0x526a 36
Router *7.7.7.7 7.7.7.7 0x80000003 651 0x22 0x1ae8 84
Network 10.10.27.2 2.2.2.2 0x80000001 692 0x22 0xcd0f 32
Summary 10.10.23.0 2.2.2.2 0x80000001 956 0x22 0x5eaa 28
Summary 10.10.34.0 2.2.2.2 0x80000002 45 0x22 0xec0f 28
Summary 10.10.45.0 2.2.2.2 0x80000001 956 0x22 0x7f71 28
ASBRSum 3.3.3.3 2.2.2.2 0x80000001 956 0x22 0xbe68 28
OSPF AS SCOPE link state database
Type ID Adv Rtr Seq Age Opt Cksum Len
Extern 0.0.0.0 3.3.3.3 0x8000004b 156 0x22 0x124a 36

root@7> show ospf neighbor
Address Interface State ID Pri Dead
10.10.27.2 ge-0/0/0.0 Full 2.2.2.2 128 36

root@7> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=51 time=14.689 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=51 time=10.233 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=51 time=14.090 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=51 time=15.701 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 10.233/13.678/15.701/2.071 ms

Juniper Lab Environment - Part II - Basic OSPF, & Routing Policy

This post is a continuation of my last post, which consisted of a simple BGP configuration that connected my home network to my lab. The second part in this series of blog posts will cover a topology that consists of four vSRXs in my lab network, and a PA-200 that resides at the perimeter of my home network. The goal of this post is to build an OSPF network and then inject routes between protocols so that we can ping out to internet from SRX5.

SRX5 Configuration:

set interfaces ge-0/0/0 unit 0 family inet address 10.10.45.5/24
set interfaces lo0 unit 0 family inet address 5.5.5.5/32
set routing-options router-id 5.5.5.5
set protocols ospf area 0.0.0.0 interface ge-0/0/0.0

SRX4 Configuration:

set interfaces ge-0/0/0 unit 0 family inet address 10.10.34.4/24
set interfaces ge-0/0/1 unit 0 family inet address 10.10.45.4/24
set interfaces lo0 unit 0 family inet address 4.4.4.4/32
set routing-options router-id 4.4.4.4
set protocols ospf area 0.0.0.0 interface ge-0/0/0.0
set protocols ospf area 0.0.0.0 interface ge-0/0/1.0

SRX3 Configuration

set interfaces ge-0/0/1 unit 0 family inet address 10.10.34.3/24
set interfaces lo0 unit 0 family inet address 3.3.3.3/32
set routing-options router-id 3.3.3.3
set protocols ospf area 0.0.0.0 interface ge-0/0/1.0

OSPF Verification:

root@3> show ospf database

OSPF database, Area 0.0.0.0
Type ID Adv Rtr Seq Age Opt Cksum Len
Router *3.3.3.3 3.3.3.3 0x80000109 227 0x22 0x70e2 48
Router 4.4.4.4 4.4.4.4 0x80000102 2131 0x22 0x49b7 48
Router 5.5.5.5 5.5.5.5 0x800000f8 9 0x22 0x5f24 36
Network 10.10.34.4 4.4.4.4 0x800000f2 2124 0x22 0xc71a 32
Network 10.10.45.5 5.5.5.5 0x800000f1 470 0x22 0x7c4e 32

root@3> show ospf neighbor
Address Interface State ID Pri Dead
10.10.34.4 ge-0/0/1.0 Full 4.4.4.4 128 32

root@5> show ospf database

OSPF database, Area 0.0.0.0
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 3.3.3.3 3.3.3.3 0x80000109 422 0x22 0x70e2 48
Router 4.4.4.4 4.4.4.4 0x80000102 2324 0x22 0x49b7 48
Router *5.5.5.5 5.5.5.5 0x800000f8 200 0x22 0x5f24 36
Network 10.10.34.4 4.4.4.4 0x800000f2 2317 0x22 0xc71a 32
Network *10.10.45.5 5.5.5.5 0x800000f1 661 0x22 0x7c4e 32

root@5> show ospf neighbor
Address Interface State ID Pri Dead
10.10.45.4 ge-0/0/0.0 Full 4.4.4.4 128 35

root@5> show route

inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[Direct/0] 1w1d 21:11:21
                    > via lo0.0
10.10.34.0/24      *[OSPF/10] 3d 14:41:29, metric 2
                    > to 10.10.45.4 via ge-0/0/0.0
10.10.45.0/24      *[Direct/0] 1w1d 21:11:10
                    > via ge-0/0/0.0
10.10.45.5/32      *[Local/0] 1w1d 21:11:10
                      Local via ge-0/0/0.0
224.0.0.5/32       *[OSPF/10] 1w1d 21:11:26, metric 1
                      MultiRecv

Route Injection:

In the previous post, we exported a default route to BGP so that we could ping the internet from SRX3. We now need to export the same default route to OSPF so that we can also ping the internet from any router in area 0 of our OSPF network. As you can see above, SRX5 does not have a default route

SRX3 Configuration:

set policy-options policy-statement bgp term 1 from protocol bgp
set policy-options policy-statement bgp term 1 from route-filter 0.0.0.0/0 exact
set policy-options policy-statement bgp term 1 then accept
set protocols bgp export ospf

Default Route Verification:

root@5> show route

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[OSPF/150] 00:01:24, metric 0, tag 0
                    > to 10.10.45.4 via ge-0/0/0.0
5.5.5.5/32         *[Direct/0] 1w1d 21:11:21
                    > via lo0.0
10.10.34.0/24      *[OSPF/10] 3d 14:41:29, metric 2
                    > to 10.10.45.4 via ge-0/0/0.0
10.10.45.0/24      *[Direct/0] 1w1d 21:11:10
                    > via ge-0/0/0.0
10.10.45.5/32      *[Local/0] 1w1d 21:11:10
                      Local via ge-0/0/0.0
10.10.56.0/24      *[Direct/0] 10:06:18
                    > via ge-0/0/1.0
10.10.56.5/32      *[Local/0] 10:06:18
                      Local via ge-0/0/1.0
224.0.0.5/32       *[OSPF/10] 1w1d 21:11:26, metric 1
                      MultiRecv

root@5> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
^C
--- 8.8.8.8 ping statistics ---
0 packets transmitted, 0 packets received, 100% packet loss

Even though the default route is there now, we have to remember that SRX1 does not know about the OSPF network that we just created.

root@1> show route

inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 00:04:13
                    > to 10.234.234.1 via ge-0/0/0.0
1.1.1.1/32         *[Direct/0] 00:04:25
                    > via lo0.0
10.10.13.0/24      *[Direct/0] 00:04:13
                    > via ge-0/0/1.0
10.10.13.1/32      *[Local/0] 00:04:14
                      Local via ge-0/0/1.0
10.234.234.0/24    *[Direct/0] 00:04:13
                    > via ge-0/0/0.0
10.234.234.20/32   *[Local/0] 00:04:14
                      Local via ge-0/0/0.0

Another policy that exports our OSPF networks to BGP should do it.

SRX3 Configuration:

set policy-options policy-statement ospf term 1 from protocol ospf
set policy-options policy-statement ospf term 1 from protocol direct
set policy-options policy-statement ospf term 1 then accept
set protocols bgp export ospf

OSPF Networks Verification:

root@1> show route

inet.0: 9 destinations, 10 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0 *[Static/5] 04:31:35
> to 10.234.234.1 via ge-0/0/0.0
1.1.1.1/32 *[Direct/0] 04:31:47
> via lo0.0
3.3.3.3/32 *[BGP/170] 04:22:18, localpref 100
AS path: 65003 I
> to 10.10.13.3 via ge-0/0/1.0
10.10.13.0/24 *[Direct/0] 04:31:35
> via ge-0/0/1.0
[BGP/170] 04:22:18, localpref 100
AS path: 65003 I
> to 10.10.13.3 via ge-0/0/1.0
10.10.13.1/32 *[Local/0] 04:31:36
Local via ge-0/0/1.0
10.10.34.0/24 *[BGP/170] 04:22:18, localpref 100
AS path: 65003 I
> to 10.10.13.3 via ge-0/0/1.0
10.10.45.0/24 *[BGP/170] 04:22:18, MED 2, localpref 100
AS path: 65003 I
> to 10.10.13.3 via ge-0/0/1.0
10.234.234.0/24 *[Direct/0] 04:31:35
> via ge-0/0/0.0
10.234.234.20/32 *[Local/0] 04:31:36
Local via ge-0/0/0.0

Now let's try to ping the internet from SRX5.

root@5> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=51 time=12.184 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=51 time=8.414 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=51 time=12.200 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=51 time=10.210 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 8.414/10.752/12.200/1.574 ms

Juniper Lab Environment - Part I - Basic eBGP, and Routing Policy

I have been working in my lab for quite some time to test out different scenarios. I thought it would be useful to share a step-by-step design, and some of the different exercises I have gone through. The first part in this series of blog posts will cover a basic topology that consists of two vSRXs in my lab network, and a PA-200 that resides at the perimeter of my home network. The goal of this particular post is to use eBGP to interconnect the two vSRX firewalls (SRX1 and SRX3) and then inject a default route that will allow us to ping out to the internet from SRX3.

The following should be noted prior to moving forward:

The vSRX is a firewall. As such, it is required to configure security zones and policies. This and subsequent posts assume that the basic security features (zones/policies) have been already been configured. I will show that portion of the configuration in this post only.
The PA-200 that resides on the perimeter of my home network required a route that points back to my lab network. This will not be covered.
Some of the configuration items in these posts are for lab purposes only and may or may not be applicable/best practice in a production environment. Always consult a professional prior to making changes in a production environment!

SRX1 Configuration:

set interfaces ge-0/0/0 unit 0 family inet address 10.234.234.20/24
set interfaces ge-0/0/1 unit 0 family inet address 10.10.13.1/24
set interfaces lo0 unit 0 family inet address 1.1.1.1/32
set routing-options router-id 1.1.1.1
set routing-options autonomous-system 65001
set routing-options static route 0.0.0.0/0 next-hop 10.234.234.1
set protocols bgp group 1 type external
set protocols bgp group 1 peer-as 65003
set protocols bgp group 1 neighbor 10.10.13.3
set policy-options policy-statement static term 1 from protocol static
set policy-options policy-statement static term 1 from route-filter 0.0.0.0/0 exact
set policy-options policy-statement static term 1 then accept
set protocols bgp group 1 export static

The important thing to remember about routing policy is that all actions are performed from the perspective of the routing table. In this case, there is a default route in the routing table that has the trust interface of the PA-200 as the next hop. The policy statement static is applied as an export policy because we are exporting the static route we created to the BGP routing protocol. This will allow us to see the default route on SRX3.

set security zones security-zone home host-inbound-traffic system-services all
set security zones security-zone home host-inbound-traffic protocols all
set security zones security-zone home interfaces ge-0/0/0.0
set security zones security-zone home interfaces lo0.0
set security zones security-zone lab host-inbound-traffic system-services all
set security zones security-zone lab host-inbound-traffic protocols all
set security zones security-zone lab interfaces ge-0/0/1.0
set security policies from-zone lab to-zone lab policy default-permit match source-address any
set security policies from-zone lab to-zone lab policy default-permit match destination-address any
set security policies from-zone lab to-zone lab policy default-permit match application any
set security policies from-zone lab to-zone lab policy default-permit then permit
set security policies from-zone home to-zone home policy default-permit match source-address any
set security policies from-zone home to-zone home policy default-permit match destination-address any
set security policies from-zone home to-zone home policy default-permit match application any
set security policies from-zone home to-zone home policy default-permit then permit
set security policies from-zone lab to-zone home policy default-permit match source-address any
set security policies from-zone lab to-zone home policy default-permit match destination-address any
set security policies from-zone lab to-zone home policy default-permit match application any
set security policies from-zone lab to-zone home policy default-permit then permit
set security policies from-zone home to-zone lab policy default-permit match source-address any
set security policies from-zone home to-zone lab policy default-permit match destination-address any
set security policies from-zone home to-zone lab policy default-permit match application any
set security policies from-zone home to-zone lab policy default-permit then permit
set security nat source rule-set 1 from zone lab
set security nat source rule-set 1 to zone home
set security nat source rule-set 1 rule 1 match source-address 0.0.0.0/0
set security nat source rule-set 1 rule 1 then source-nat interface

SRX3 Configuration:

set interfaces ge-0/0/2 unit 0 family inet address 10.10.13.3/24
set interfaces lo0 unit 0 family inet address 3.3.3.3/32
set routing-options router-id 3.3.3.3
set routing-options autonomous-system 65003
set protocols bgp group 1 type external
set protocols bgp group 1 peer-as 65001
set protocols bgp group 1 neighbor 10.10.13.1
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces lo0.0
set security zones security-zone trust interfaces ge-0/0/2.0
set security policies from-zone trust to-zone trust policy default-permit match source-address any
set security policies from-zone trust to-zone trust policy default-permit match destination-address any
set security policies from-zone trust to-zone trust policy default-permit match application any
set security policies from-zone trust to-zone trust policy default-permit then permit

Verification from SRX3:

root@3> show bgp summary
Groups: 1 Peers: 1 Down peers: 0
Table          Tot Paths Act Paths Suppressed    History Damp State    Pending
inet.0                 1          1          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted
10.10.13.1            65001       5619       5628       0       6 1d 17:22:45 1/1/1/0              0/0/0/0

root@3> show route receive-protocol bgp 10.10.13.1

inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
Prefix Nexthop MED Lclpref AS path
* 0.0.0.0/0 10.10.13.1 65001 I

root@3> show route

inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0 *[BGP/170] 00:14:10, localpref 100
AS path: 65001 I
> to 10.10.13.1 via ge-0/0/2.0
3.3.3.3/32 *[Direct/0] 05:52:13
> via lo0.0
10.10.13.0/24 *[Direct/0] 05:51:57
> via ge-0/0/2.0
10.10.13.3/32 *[Local/0] 05:51:58
Local via ge-0/0/2.0

root@3> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=53 time=10.330 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=53 time=6.143 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=53 time=10.245 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 8.414/10.752/12.200/1.574 ms

Saturday, November 22, 2014

Panorama, Templates, and Python Scripting

It has been quite some time since my last post. I have been super busy on different customer engagements as of late and its cutting into my posts!

I am a fan of the saying, "Centralize what you can, and only distribute what you must." The Panorama appliance from Palo Alto Networks does a great job of accomplishing this when deployed in environments with many geographically distributed locations. I recently utilized this appliance to deploy over 250 firewalls in about 2 weeks for a customer and found that it made my job a lot easier from a configuration perspective, but also made the security administrator's job much easier moving forward.

If you know anything about Panorama, you will know that Device Groups cover Policy and Objects information, while Templates cover Network and Device information (overview). For this particular deployment, there was one Device Group for the majority of the locations due to policies being standardized by the organization. Templates were a different story because IP addressing and other device-specific information will obviously vary from site to site. Palo Alto has a KB article that shows how to clone entire templates, which is what I utilized when originally deploying the firewalls. However, there isn't a very clear way to make changes to specific settings within all templates once the firewalls are deployed... For example, lets say I need to add the same syslog server profile to every firewall. Do I really have to enter the information into each template???

Maybe there is a better way to do this that I don't know about (UPDATE: there are now Template Stacks FYI), but I was able to utilize a Python, Jinja2, and csv file containing template names for each location. I wanted to share what I did because I believe it will help many other admins out there that run into issues with deployment. Please note that I am no way an expert at Python. I've merely utilized the automation tools that I've learned from previous endeavors and colleagues to apply them to this specific use case.

Step 1:

Using your favorite Linux flavor, install Python and Jinja2. Create a directory somewhere on the machine for the files you will be creating.

Step 2:

Create a csv file called "device_data.csv" with a column heading (i.e. location). The corresponding values should be equal to the template names in Panorama.

location
California
Texas
New York
Florida
Germany
Hong Kong
Beijing

Step 3:

Create a jinja2 file called "panorama_conf_template.j2" with the configuration parameters and include your variable (i.e. location).

set template {{ location }} config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER

Step 4:

Create your python script called "make_config.py" so that upon execution it will use the information from your jinja and csv files to create your config.

#!/usr/bin/python

# Import the necessary modules
import csv
import sys
import glob
import os
from jinja2 import Template

##################################################
# Begin: User defined variables
##################################################
# Path to configs
conf_path=""
# File name of your csv file
csv_filename="device_data.csv"

##################################################
# End: User defined variables
##################################################

# Read device_data.csv from the current directory
# csv.DictReader reads the first row as a header row and stores the column headings as keys
device_data = csv.DictReader(open(csv_filename))

# Loops through the device_data csv so we can perform actions for each row
for row in device_data:
    # Stores the contents of each "cell" as the value for the column header
    # key : value pair

    # The below example will print the value of the location column for the current row.
    # print row["location"]
    data = row

    # creates a filename variable for the template configuration based on the store in the CSV
    conffilename = conf_path + row["location"] + ".txt";

    # Open the store config Jinja2 template file.
    with open("panorama_conf_template.j2") as t_fh:
        t_format = t_fh.read()

    # Set it up as a template
    template = Template(t_format)

    # Create the .txt file
    fout = open(conffilename, 'w')
    print fout

    # Write the conf file with the template and data from the current row
    # Performs a "search and replace"
    fout.write((template.render(data)))
    fout.close()

    # Print to SDOUT
    #print (template2.render(data))

# finds all files ending in .txt and combines them into a single config file
read_files = glob.glob("*.txt")

with open("config_script.conf", "wb") as outfile:
    for f in read_files:
        with open(f, "rb") as infile:
            outfile.write(infile.read())

# deletes all .txt files as they are not needed once they are combined into the config file
filelist = glob.glob("*.txt")
for f in filelist:
    os.remove(f)

print "Good bye!"

Result:

Executing the script will result in the creation of the "config_script.conf" file which contains the following configuration data that can be entered (copy/paste) via SSH in Panorama:

set template California config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER
set template Texas config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER
set template New York config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER
set template Florida config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER
set template Germany config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER
set template Hong Kong config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER
set template Beijing config shared log-settings syslog syslog-profile server syslog-1 transport UDP port 514 format BSD server 1.1.1.1 facility LOG_USER

Hopefully this is helpful to other engineers that want to save some time. This could be applied to really any configuration data that you are trying to automate.

Thursday, May 15, 2014

Juniper L2VPN over MPLS over GRE over IPSec

I am starting to learn more and more about different scenarios where customers have multiple sites, and need to ensure that the same broadcast domain is available over a layer 3 connection (sometimes referred to as layer 2 being "stretched") to each location. A prime example of this would be a highly virtualized organization that has multiple datacenters across multiple, geographically dispersed locations. Certain features (i.e. VMotion) require a layer 2 connection in order to function. This obviously presents a problem. Below is an example of what I did with one customer to overcome this exact issue by following this blog post. It wasn't very clear, so I thought I would post a configuration from my lab along with explanations. I thought this was a cool option because it is all done within the same default virtual router (I have seen other examples of L2VPN over MPLS, where there are multiple VRs configured). In short, there are obviously many different ways to accomplish this task.

The configuration is based on the topology below:

SRX1:

First, we have to create two firewall filters that we will later apply to the interfaces that we will be using in our configuration. These are required in order to change the interfaces on the SRX from secure context (flow-based forwarding) to router context (packet-based forwarding), which is necessary in order to avoid the flow module in the SRX itself. A full explanation can be found here:
set firewall family mpls filter MPLS-PACKET-MODE term ALL-TRAFFIC then packet-mode
set firewall family mpls filter MPLS-PACKET-MODE term ALL-TRAFFIC then accept
set firewall family ccc filter CCC-PACKET-MODE term ALL-TRAFFIC then packet-mode
set firewall family ccc filter CCC-PACKET-MODE term ALL-TRAFFIC then accept

Layer 2 interface configuration:
set interfaces ge-0/0/0 mtu 1614
set interfaces ge-0/0/0 encapsulation ethernet-ccc
set interfaces ge-0/0/0 unit 0 family ccc filter input CCC-PACKET-MODE

Layer 3 interface configuration:
set interfaces ge-0/0/1 unit 0 family inet address 10.0.0.1/30

GRE tunnel interface configuration:
set interfaces gr-0/0/0 unit 0 tunnel source 10.2.2.1
set interfaces gr-0/0/0 unit 0 tunnel destination 10.2.2.2
set interfaces gr-0/0/0 unit 0 family inet mtu 9000
set interfaces gr-0/0/0 unit 0 family inet address 10.0.0.9/30
set interfaces gr-0/0/0 unit 0 family mpls filter input MPLS-PACKET-MODE

Loopback interface configuration:
set interfaces lo0 unit 0 family inet address 192.168.0.1/30

IPSec tunnel interface configuration:
set interfaces st0 unit 0 family inet address 10.2.2.1/30

Protocols configuration:
set protocols mpls interface gr-0/0/0.0
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface gr-0/0/0.0
set protocols ldp interface gr-0/0/0.0
set protocols ldp interface lo0.0
set protocols l2circuit neighbor 192.168.0.2 interface ge-0/0/0.0 virtual-circuit-id 100000
set protocols l2circuit neighbor 192.168.0.2 interface ge-0/0/0.0 encapsulation-type ethernet

IPSec VPN configuration:
set security ike policy 1 mode main
set security ike policy 1 proposal-set standard
set security ike policy 1 pre-shared-key ascii-text Juniper1
set security ike gateway 1 ike-policy 1
set security ike gateway 1 address 10.0.0.2
set security ike gateway 1 external-interface ge-0/0/1.0
set security ipsec policy 1 proposal-set standard
set security ipsec vpn 1 bind-interface st0.0
set security ipsec vpn 1 ike gateway 1
set security ipsec vpn 1 ike ipsec-policy 1
set security ipsec vpn 1 establish-tunnels immediately

For simplicity's sake, I put all interfaces except for my WAN interface in the TRUST zone:
set security zones security-zone TRUST host-inbound-traffic system-services all
set security zones security-zone TRUST host-inbound-traffic protocols all
set security zones security-zone TRUST interfaces ge-0/0/0.0
set security zones security-zone TRUST interfaces lo0.0
set security zones security-zone TRUST interfaces gr-0/0/0.0
set security zones security-zone TRUST interfaces st0.0
set security zones security-zone UNTRUST host-inbound-traffic system-services all
set security zones security-zone UNTRUST host-inbound-traffic protocols all
set security zones security-zone UNTRUST interfaces ge-0/0/1.0

Security policy configuration:
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST match source-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST match destination-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST match application any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST then permit
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST match source-address any
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST match destination-address any
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST match application any
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST then permit
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST match source-address any
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST match destination-address any
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST match application any
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST then permit

SRX2:

Firewall Filters:
set firewall family mpls filter MPLS-PACKET-MODE term ALL-TRAFFIC then packet-mode
set firewall family mpls filter MPLS-PACKET-MODE term ALL-TRAFFIC then accept
set firewall family ccc filter CCC-PACKET-MODE term ALL-TRAFFIC then packet-mode
set firewall family ccc filter CCC-PACKET-MODE term ALL-TRAFFIC then accept

Layer 2 interface configuration:
set interfaces ge-0/0/0 mtu 1614
set interfaces ge-0/0/0 encapsulation ethernet-ccc
set interfaces ge-0/0/0 unit 0 family ccc filter input CCC-PACKET-MODE

Layer 3 interface configuration:
set interfaces ge-0/0/1 unit 0 family inet address 10.0.0.2/30

GRE tunnel interface configuration:
set interfaces gr-0/0/0 unit 0 tunnel source 10.2.2.2
set interfaces gr-0/0/0 unit 0 tunnel destination 10.2.2.1
set interfaces gr-0/0/0 unit 0 family inet mtu 9000
set interfaces gr-0/0/0 unit 0 family inet address 10.0.0.10/30
set interfaces gr-0/0/0 unit 0 family mpls filter input MPLS-PACKET-MODE

Loopback interface configuration:
set interfaces lo0 unit 0 family inet address 192.168.0.2/30

IPSec tunnel interface configuration:
set interfaces st0 unit 0 family inet address 10.2.2.2/30

Protocols configuration:
set protocols mpls interface gr-0/0/0.0
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface gr-0/0/0.0
set protocols ldp interface gr-0/0/0.0
set protocols ldp interface lo0.0
set protocols l2circuit neighbor 192.168.0.1 interface ge-0/0/0.0 virtual-circuit-id 100000
set protocols l2circuit neighbor 192.168.0.1 interface ge-0/0/0.0 encapsulation-type ethernet

IPSec VPN configuration:
set security ike policy 1 mode main
set security ike policy 1 proposal-set standard
set security ike policy 1 pre-shared-key ascii-text Juniper1
set security ike gateway 1 ike-policy 1
set security ike gateway 1 address 10.0.0.1
set security ike gateway 1 external-interface ge-0/0/1.0
set security ipsec policy 1 proposal-set standard
set security ipsec vpn 1 bind-interface st0.0
set security ipsec vpn 1 ike gateway 1
set security ipsec vpn 1 ike ipsec-policy 1
set security ipsec vpn 1 establish-tunnels immediately

For simplicity's sake, I put all interfaces except for my WAN interface in the TRUST zone:
set security zones security-zone TRUST host-inbound-traffic system-services all
set security zones security-zone TRUST host-inbound-traffic protocols all
set security zones security-zone TRUST interfaces ge-0/0/0.0
set security zones security-zone TRUST interfaces lo0.0
set security zones security-zone TRUST interfaces gr-0/0/0.0
set security zones security-zone TRUST interfaces st0.0
set security zones security-zone UNTRUST host-inbound-traffic system-services all
set security zones security-zone UNTRUST host-inbound-traffic protocols all
set security zones security-zone UNTRUST interfaces ge-0/0/1.0

Security policy configuration:
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST match source-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST match destination-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST match application any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-to-UNTRUST then permit
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST match source-address any
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST match destination-address any
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST match application any
set security policies from-zone UNTRUST to-zone TRUST policy UNTRUST-to-TRUST then permit
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST match source-address any
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST match destination-address any
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST match application any
set security policies from-zone TRUST to-zone TRUST policy TRUST-to-TRUST then permit

Monday, March 31, 2014

Juniper BGP Over IPSec Multipoint

In my lab, I wanted to utilize a dynamic routing protocol for my hub and spoke VPN topology. I decided to try it with BGP. The requirements were to utilize only one tunnel interface on the hub device for all IPSec tunnels, as well as deny all traffic between spoke sites. Below is the configuration, and it is based on the topology below:

SRX 1 (Hub Device):

Interface configuration (please note that the tunnel interface is configured as multipoint, which allows for the termination of multiple IPSec tunnels to a single logical interface.):
interfaces {
ge-0/0/0 {
unit 0 {
description "*** TRUST ***";
family inet {
address 10.1.1.1/24;
}
}
}
ge-0/0/1 {
unit 0 {
description "*** UNTRUST ***";
family inet {
address 172.16.1.1/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 1.1.1.1/32;
}
}
}
st0 {
unit 0 {
description "*** VPN ***";
multipoint;
family inet {
address 192.168.1.1/24;
}
}
}
}

Default route configuration:

routing-options {
static {
route 0.0.0.0/0 next-hop 172.16.1.2;
}
router-id 1.1.1.1;
autonomous-system 65001;
}

BGP configuration:

protocols {
bgp {
group 1 {
type external;
neighbor 192.168.1.3 {
hold-time 30;
export 1;
peer-as 65003;
local-as 65001;
}
neighbor 192.168.1.4 {
hold-time 30;
export 1;
peer-as 65004;
local-as 65001;
}
}
}
}

Routing policy configuration:
policy-options {
policy-statement 1 {
term 1 {
from {
route-filter 10.1.1.0/24 exact;
}
then accept;
}
term 2 {
from {
route-filter 192.168.1.0/24 exact;
}
then accept;
}
term 3 {
then reject;
}
}

}

VPN configuration:
security {
ike {
policy 1-3 {
mode main;
proposal-set standard;
pre-shared-key ascii-text "$9$rV4KWXVwgUjq7-jqmfn6revW7-"; ## SECRET-DATA
}
policy 1-4 {
mode main;
proposal-set standard;
pre-shared-key ascii-text "$9$ZCDH.QF/0BEP5BEcyW8ZUjHP5"; ## SECRET-DATA
}
gateway 3 {
ike-policy 1-3;
address 172.16.3.1;
external-interface ge-0/0/1.0;
}
gateway 4 {
ike-policy 1-4;
address 172.16.4.1;
external-interface ge-0/0/1.0;
}
}
ipsec {
policy 1-3 {
proposal-set standard;
}
policy 1-4 {
proposal-set standard;
}
vpn 1-3 {
bind-interface st0.0;
ike {
gateway 3;
ipsec-policy 1-3;
}
establish-tunnels immediately;
}
vpn 1-4 {
bind-interface st0.0;
ike {
gateway 4;
ipsec-policy 1-4;
}
establish-tunnels immediately;
}
}

}

Security zone configuration (please note that for my lab testing, I am allowing almost everything. In a production environment it is required to enable the necessary services and protocols at the zone level in order for things to function properly (i.e. BGP, IKE, etc.)):

zones {

security-zone trust {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

interfaces {

lo0.0;

ge-0/0/0.0;

}

security-zone untrust {

screen untrust-screen;

host-inbound-traffic {

system-services {

ike;

}

interfaces {

ge-0/0/1.0;

}

security-zone vpn {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

interfaces {

st0.0;

}

Security policy configuration (please note that there is a policy which denies traffic from spoke to spoke):

policies {

from-zone trust to-zone trust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone trust to-zone untrust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone untrust to-zone trust {

policy default-deny {

match {

source-address any;

destination-address any;

application any;

}

then {

deny;

}

from-zone vpn to-zone vpn {

policy deny-intra-spoke-traffic {

match {

source-address any;

destination-address any;

application any;

}

then {

deny;

}

from-zone vpn to-zone trust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone trust to-zone vpn {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

SRX 3 (Spoke Device):

Interface configuration:

interfaces {

ge-0/0/0 {

unit 0 {

description "*** TRUST ***";

family inet {

address 10.3.3.1/24;

}

ge-0/0/1 {

unit 0 {

description "*** UNTRUST ***";

family inet {

address 172.16.3.1/30;

}

lo0 {

unit 0 {

family inet {

address 3.3.3.3/32;

}

st0 {

unit 0 {

description "*** VPN ***";

family inet {

address 192.168.1.3/24;

}

Default route configuration:

routing-options {
static {
route 0.0.0.0/0 next-hop 172.16.3.2;
}
router-id 3.3.3.3;
autonomous-system 65003;
}

BGP configuration:

protocols {
bgp {
group 1 {
type external;
neighbor 192.168.1.1 {
hold-time 30;
export 1;
peer-as 65001;
local-as 65003;
}
}
}
}

Routing policy configuration:
policy-options {
policy-statement 1 {
term 1 {
from {
route-filter 10.3.3.0/24 exact;
}
then accept;
}
term 2 {
from {
route-filter 192.168.1.0/24 exact;
}
then accept;
}
term 3 {
then reject;
}
}

}

VPN configuration:

security {

ike {

policy 3-1 {

mode main;

proposal-set standard;

pre-shared-key ascii-text "$9$QATV3/ABIcvWxp0WxNdg4QFn/p0"; ## SECRET-DATA

}

gateway 3-1 {

ike-policy 3-1;

address 172.16.1.1;

external-interface ge-0/0/1.0;

}

ipsec {

policy 3-1 {

proposal-set standard;

}

vpn 3-1 {

bind-interface st0.0;

ike {

gateway 3-1;

ipsec-policy 3-1;

}

establish-tunnels immediately;

}

Security zone configuration:

zones {

security-zone untrust {

screen untrust-screen;

host-inbound-traffic {

system-services {

ike;

}

interfaces {

ge-0/0/1.0;

}

security-zone trust {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

interfaces {

lo0.0;

ge-0/0/0.0;

}

security-zone vpn {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

interfaces {

st0.0;

}

Security policy configuration:

policies {

from-zone trust to-zone trust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone trust to-zone untrust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone untrust to-zone trust {

policy default-deny {

match {

source-address any;

destination-address any;

application any;

}

then {

deny;

}

from-zone trust to-zone vpn {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone vpn to-zone trust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone vpn to-zone vpn {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

SRX 4 (Spoke Device):

Interface configuration:

interfaces {

ge-0/0/0 {

unit 0 {

description "*** TRUST ***";

family inet {

address 10.4.4.1/24;

}

ge-0/0/1 {

unit 0 {

description "*** UNTRUST ***";

family inet {

address 172.16.4.1/30;

}

lo0 {

unit 0 {

family inet {

address 4.4.4.4/32;

}

st0 {

unit 0 {

description "*** VPN ***";

family inet {

address 192.168.1.4/24;

}

Default route configuration:

routing-options {
static {
route 0.0.0.0/0 next-hop 172.16.4.2;
}
router-id 4.4.4.4;
autonomous-system 65004;
}

BGP configuration:

protocols {
bgp {
group 1 {
type external;
neighbor 192.168.1.1 {
hold-time 30;
export 1;
peer-as 65001;
local-as 65004;
}
}
}
}

Routing policy configuration:
policy-options {
policy-statement 1 {
term 1 {
from {
route-filter 10.4.4.0/24 exact;
}
then accept;
}
term 2 {
from {
route-filter 192.168.1.0/24 exact;
}
then accept;
}
term 3 {
then reject;
}
}

}

VPN configuration:

security {

ike {

policy 4-1 {

mode main;

proposal-set standard;

pre-shared-key ascii-text "$9$QATV3/ABIcvWxp0WxNdg4QFn/p0"; ## SECRET-DATA

}

gateway 4-1 {

ike-policy 4-1;

address 172.16.1.1;

external-interface ge-0/0/1.0;

}

ipsec {

policy 4-1 {

proposal-set standard;

}

vpn 4-1 {

bind-interface st0.0;

ike {

gateway 4-1;

ipsec-policy 4-1;

}

establish-tunnels immediately;

}

Security zone configuration:

zones {

security-zone untrust {

screen untrust-screen;

host-inbound-traffic {

system-services {

ike;

}

interfaces {

ge-0/0/1.0;

}

security-zone trust {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

interfaces {

lo0.0;

ge-0/0/0.0;

}

security-zone vpn {

host-inbound-traffic {

system-services {

all;

}

protocols {

all;

}

interfaces {

st0.0;

}

Security policy configuration:

policies {

from-zone trust to-zone trust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone trust to-zone untrust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone untrust to-zone trust {

policy default-deny {

match {

source-address any;

destination-address any;

application any;

}

then {

deny;

}

from-zone trust to-zone vpn {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone vpn to-zone trust {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

from-zone vpn to-zone vpn {

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

Verification:

Here are some commands that can be run from operational mode for verification purposes:
show security ike security-associations
show security ipsec security-associations
show bgp neighbor
show bgp summary
show route