4

I would really appreciate some clarification in the following matter.

What I'm seeing

I'm looking at two different SRX210 firewalls and specifically at their ipsec stanza. I'm seeing the following which makes me wonder about proxy-identity:

admin@firewall> show configuration security ipsec vpn <vpn-name>
bind-interface st0.1;
ike {
    gateway <gateway>;
    proxy-identity;
    ipsec-policy <policy-name>;
}

If I make a questionmark after ike, the following is produced which is of no help to me in understanding this:

admin@firewall# set security ipsec vpn <vpn-name> ike ?
Possible completions:
> proxy-identity       IPSec proxy-id to use in IKE negotiations

The question

What are the effects, if any, by entering nothing after proxy-identity in the configuration of a SRX?

Mark: all names and identites have been replaced for security sakes

Thanks in advance!

3

Proxy-identity defaults to whatever you have set on the policy (in case of policy-based VPN). In case of route-based VPN, it defaults to:

proxy-identity {
   local 0.0.0.0/0;
   remote 0.0.0.0/0;
   service any;
}

Proxy-identity is used only for negotiating the IKE phase of the VPN, and has to mirror the proxy-identity that is set on the other site of the VPN tunnel. It has no effect on actually routing or permitting traffic through the tunnel once it has been established, that has to be done with routes and/or policies.

This is easily verified if you have access to Juniper routers where you can mess around with the VPN settings.

no proxy-identity settings

Testing default settings without mentioning proxy-identity.

vpn ike-vpn {
    bind-interface st0.0;
    ike {
        gateway gw-vpn;
        ipsec-policy ipsec-phase2-policy;
    }
}

The VPN is established, using 0.0.0.0/0 as local and remote subnets:

root@srx-01> show security ipsec security-associations detail
  ID: 131073 Virtual-system: root, VPN Name: ike-vpn
  Local Gateway: 192.168.159.133, Remote Gateway: 192.168.159.128
  Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
  Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0

real proxy-identity settings

As a second test, I've added real proxy-identity settings to match my remote and local subnets:

vpn ike-vpn {
    bind-interface st0.0;
    ike {
        gateway gw-vpn;
        proxy-identity {
            local 10.2.1.0/24;
            remote 10.1.1.0/24;
        }
        ipsec-policy ipsec-phase2-policy;
    }
}

As expected, the tunnel is established using the proper local and remote subnet information:

root@srx-01# run show security ipsec security-associations detail
  ID: 131073 Virtual-system: root, VPN Name: ike-vpn
  Local Gateway: 192.168.159.133, Remote Gateway: 192.168.159.128
  Local Identity: ipv4_subnet(any:0,[0..7]=10.2.1.0/24)
  Remote Identity: ipv4_subnet(any:0,[0..7]=10.1.1.0/24)

blank proxy-identity

Now I'll remove the local and remote subnets from the proxy-identity stanza:

vpn ike-vpn {
    bind-interface st0.0;
    ike {
        gateway gw-vpn;
        proxy-identity;
        ipsec-policy ipsec-phase2-policy;
    }
}

The tunnel is reastablished using 0.0.0.0/0 as local and remote subnets.

root@srx-02# run show security ipsec security-associations detail
  ID: 131073 Virtual-system: root, VPN Name: ike-vpn
  Local Gateway: 192.168.159.128, Remote Gateway: 192.168.159.133
  Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
  Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)

In other words, my assumption is correct and leaving the stanza blank means the router uses its default settings.

| improve this answer | |
  • Thanks for your answer. I'm explicitly interested in whether entering nothing after the proxy-identity stanza has any effect at all or simply produces the same effect as leaving the proxy-identity out of the configuration. To clarify, there is no configuration further down(within) the tree of proxy-identity. – Anton Flärd Jan 28 '15 at 10:03
  • I would assume that no configuration would result in default values, but since that's an assumption I've tried to verify in my lab. I'll edit my answer to include the results. – RobinG Jan 29 '15 at 12:52
0

I had to migrate a P2P VPN link between a Cisco ASA5515 and an SRX220 to a new FortiGate 500D and the same SRX220.

The SRX VPN was configured in routing based mode but because it had to talk to the old ASA, it contained the proxy-identity with local and remote subnets defined.

At first I thought I had to update the SRX to the beta 12.1x46 firmware that would allow me to specify more than 1 entry for the proxy-identity in order to pass traffic on more than 1 subnets. However, FortiNet support clarifyed that the FortiGate does not require the proxy-identity field and I simply removed it from the SRX config.

I can confirm that the answer by RobinG is correct. If you omit the proxy-identity option, the local and remote identity will be 0.0.0.0/0. This is the expected behavior as well on the FortiGate. Thank you for posting this question as it has helped my greatly in migrating my VPN.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.