Geekly Articles each Day
📜 ⬆️ ⬇️

Creating IPSec GRE tunnel between Mikrotik hEX S and Juniper SRX via USB Modem

purpose


You need to create a VPN Tunnel between two devices, such as the Mikrotik and Juniper SRX line.

What we have


Of the mikrotik chosen on the wiki mikrotik site, a model that can support IPSec hardware encryption, in our opinion, it turned out to be quite compact and inexpensive, namely Mikrotik hEXS.

USB Modem was purchased at the nearest cellular operator, the model was Huawei E3370. We did not carry out any operations for decoupling from the operator. All staffing and stitched by the operator.
')
The core has a Juniper SRX240H central router.

What did


It was possible to implement a scheme of work that allows a cellular operator, without having a static address, to create an IPsec connection through which a GRE Tunnel is wrapped up via a modem.

This connection scheme is used and works on Beeline and Megaphone USB modems.

The configuration is as follows:

Juniper SRX240H is installed in the kernel
Local Address: 192.168.1.1/24
External Address: 1.1.1.1/30
GW: 1.1.1.2

Remote point

Mikrotik hEX S
Local Address: 192.168.152.1/24
External Address: Dynamic

A small chart to understand the work:



Juniper SRX240 configuration:

JUNOS Software Release Software Version [12.1X46-D82]

Juniper configuration
interfaces { ge-0/0/0 { description Internet-1; unit 0 { family inet { address 1.1.1.1/30; } } } gr-0/0/0 { unit 1 { description GRE-Tunnel; tunnel { source 172.31.152.2; destination 172.31.152.1; } family inet; vlan { unit 0 { family inet { address 192.168.1.1/24; } } st0 { unit 5 { description "Area - 192.168.152.0/24"; family inet { mtu 1400; } } routing-options { static { route 0.0.0.0/0 next-hop 1.1.1.2; route 192.168.152.0/24 next-hop gr-0/0/0.1; route 172.31.152.0/30 next-hop st0.5; } router-id 192.168.1.1; } security { ike { traceoptions { file vpn.log size 256k files 5; flag all; } policy ike-gretunnel { mode aggressive; description area-192.168.152.0; proposal-set standard; pre-shared-key ascii-text "mysecret"; ## SECRET-DATA } gateway gw-gretunnel { ike-policy ike-gretunnel; dynamic inet 172.31.152.1; external-interface ge-0/0/0.0; version v2-only; } ipsec { } policy vpn-policy0 { perfect-forward-secrecy { keys group2; } proposal-set standard; } vpn vpn-gretunnel { bind-interface st0.5; df-bit copy; vpn-monitor { optimized; source-interface st0.5; destination-ip 172.31.152.1; } ike { gateway gw-gretunnel; no-anti-replay; ipsec-policy vpn-policy0; install-interval 10; } establish-tunnels immediately; } } policies { from-zone vpn to-zone vpn { policy st-vpn-vpn { match { source-address any; destination-address any; application any; } then { permit; log { session-init; session-close; } count; } } } from-zone trust to-zone vpn { policy st-trust-to-vpn { match { source-address any; destination-address any; application any; } then { permit; log { session-init; session-close; } count; } } } from-zone vpn to-zone trust { policy st-vpn-to-trust { match { source-address any; destination-address any; application any; } then { permit; log { session-init; session-close; } count; } } } zones { security-zone trust { vlan.0 { host-inbound-traffic { system-services { all; } protocols { all; } } } security-zone vpn { interfaces { st0.5 { host-inbound-traffic { protocols { ospf; } } } gr-0/0/0.1 { host-inbound-traffic { system-services { all; } protocols { all; } } } security-zone untrust { interfaces { ge-0/0/0.0 { host-inbound-traffic { system-services { ping; ssh; ike; } } } } } vlans { vlan-local { vlan-id 5; l3-interface vlan.1; }


Mikrotik hEX S configuration:

Software version RouterOS [6.44.3]

Mikrotik configuration
 /ip address add address=172.31.152.1/24 comment=GRE-Tunnel interface=gre-srx network=172.31.152.0 add address=192.168.152.1/24 comment=Local-Area interface=bridge network=192.168.152.0 /interface gre add comment=GRE-Tunnel-SRX-HQ !keepalive local-address=172.31.152.1 name=gre-srx remote-address=172.31.152.2 /ip ipsec policy group add name=srx-gre /ip ipsec profile add dh-group=modp1024 dpd-interval=10s name=profile1 /ip ipsec peer add address=1.1.1.1/32 comment=GRE-SRX exchange-mode=aggressive local-address=172.31.152.1 name=peer2 profile=profile1 /ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-128-cbc,3des add enc-algorithms=aes-128-cbc,3des name=proposal1 /ip route add distance=10 dst-address=192.168.0.0/16 gateway=gre-srx /ip ipsec identity add comment=IPSec-GRE my-id=address:172.31.152.1 peer=peer2 policy-template-group=srx-gre secret=mysecret /ip ipsec policy set 0 disabled=yes add dst-address=0.0.0.0/0 proposal=proposal1 sa-dst-address=1.1.1.1 sa-src-address=172.31.152.1 src-address=172.31.152.0/30 tunnel=yes /ip address add address=172.31.152.1/24 comment=GRE-Tunnel interface=gre-srx network=172.31.152.0 add address=192.168.152.1/24 comment=Local-Area interface=bridge network=192.168.152.0

Result:
Juniper SRX side

 netscreen@srx240> ping 192.168.152.1 PING 192.168.152.1 (192.168.152.1): 56 data bytes 64 bytes from 192.168.152.1: icmp_seq=0 ttl=64 time=29.290 ms 64 bytes from 192.168.152.1: icmp_seq=1 ttl=64 time=28.126 ms 64 bytes from 192.168.152.1: icmp_seq=2 ttl=64 time=26.775 ms 64 bytes from 192.168.152.1: icmp_seq=3 ttl=64 time=25.401 ms ^C --- 192.168.152.1 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max/stddev = 25.401/27.398/29.290/1.457 ms

From the Mikrotik

 net[admin@GW-LTE-] > ping 192.168.1.1 SEQ HOST SIZE TTL TIME STATUS 0 192.168.1.1 56 64 34ms 1 192.168.1.1 56 64 40ms 2 192.168.1.1 56 64 37ms 3 192.168.1.1 56 64 40ms 4 192.168.1.1 56 64 51ms sent=5 received=5 packet-loss=0% min-rtt=34ms avg-rtt=40ms max-rtt=51ms

findings


After this work, we received a stable VPN Tunnel, from a remote network we can access the entire network located behind the juniper, and accordingly back.

I do not recommend using IKE2 in this scheme, there was a situation that after a device is rebooted, IPSec does not rise.

Source: https://habr.com/ru/post/455425/

More articles:


All Articles