0

I'm trying to setup an IPsec vpn to AWS from an SRX 110 and am having some trouble getting it to work. I've download the config file and my tunnels seem to be up, but I can't seem to ping anything in AWS.

show security ipsec security-associations                                                      
  Total active tunnels: 2
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway   
  <131073 ESP:aes-cbc-128/sha1 9e84c351 3427/ unlim - root 500 52.55.170.166   
  >131073 ESP:aes-cbc-128/sha1 62e0325 3427/ unlim - root 500 52.55.170.166   
  <131074 ESP:aes-cbc-128/sha1 2128ae3d 3431/ unlim - root 500 52.207.67.71    
  >131074 ESP:aes-cbc-128/sha1 3d29fbfe 3431/ unlim - root 500 52.207.67.71  

show security ike security-associations                                                        
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address   
6550418 UP     81a741b305932303  5cded1ed9120865f  Main           52.207.67.71    
6550417 UP     028df2e8bf768421  0f0010a4a0fe461a  Main           52.55.170.166   

on the aws side, I see this:

VPN Tunnel  IP Address     Status   Status Last Changed     Details
Tunnel 1    52.55.170.166   DOWN    2016-11-02 23:04 UTC-4  IPSEC IS UP
Tunnel 2    52.207.67.71    DOWN    2016-11-02 23:04 UTC-4  IPSEC IS UP

I think I don't have something configured in my zones correctly but am not sure, I have two zones that are:

zone1

Name: Internal
Type: Security
Interface: vlan.1

Zone2:

Name: Internet
Type: Security
Interfaces: fe-0/0/0.0

when I ran my config, it created two more zones as follows:

Name: trust
Type: Security
Protocals: bgp
interfaces: st0.1,st0.2

and this one:

Name: untrust
Type: Security
Services: ike
Interfaces: blank

how come the tunnels seem to be up but I can't seem to ping anything inside the vpc?

Also, I'm very new to this as well.....

------------------EDIT----------------

On the aws side, its now showing this:

VPN Tunnel  IP Address  Status  Status Last Changed     Details
Tunnel 1    52.55.170.166   UP  2016-11-02 23:04 UTC-4  1 
Tunnel 2    52.207.67.71    UP  2016-11-02 23:04 UTC-4  1 

what my current config looks like now:

system {
    host-name RonakLab;
    time-zone EST;
    root-authentication {
        encrypted-password "xxxxxxxxx"; ## SECRET-DATA
    }
    name-server {
        208.67.222.222;
        208.67.220.220;
    }
    name-resolution {
        no-resolve-on-input;
    }
    services {
        ssh;
        telnet;
        web-management {
            http {
                interface vlan.1;
            }
            https {
                system-generated-certificate;
                interface vlan.1;
            }
            session {
                idle-timeout 60;
            }
        }
        dhcp {
            pool 192.168.2.0/24 {
                address-range low 192.168.2.1 high 192.168.2.254;
                router {
                    192.168.2.1;
                }
            }
            propagate-settings fe-0/0/0;
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    ntp {
        server us.ntp.pool.org;
    }
}
interfaces {
    fe-0/0/0 {
        unit 0 {
            family inet {
                dhcp;
            }
        }
    }
    fe-0/0/1 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan1;
                }
            }
        }
    }
    fe-0/0/2 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan1;
                }
            }
        }
    }
    st0 {
        unit 1 {
            family inet {
                mtu 1436;
                address 169.254.47.18/30;
            }
        }
        unit 2 {
            family inet {
                mtu 1436;
                address 169.254.45.38/30;
            }
        }
    }
    vlan {
        unit 1 {
            family inet {
                address 192.168.2.1/24;
            }
        }
    }
}
protocols {
    stp;
}
security {
    ike {
        proposal ike-prop-vpn-f7584996-1 {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm aes-128-cbc;
            lifetime-seconds 28800;
        }
        proposal ike-prop-vpn-f7584996-2 {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm aes-128-cbc;
            lifetime-seconds 28800;
        }
        policy ike-pol-vpn-f7584996-1 {
            mode main;
            proposals ike-prop-vpn-f7584996-1;
            pre-shared-key ascii-text "xxxxxxx"; ## SECRET-DATA
        }
        policy ike-pol-vpn-f7584996-2 {
            mode main;
            proposals ike-prop-vpn-f7584996-2;
            pre-shared-key ascii-text "xxxxxx"; ## SECRET-DATA
        }
        gateway gw-vpn-f7584996-1 {
            ike-policy ike-pol-vpn-f7584996-1;
            address 52.45.108.91;
            dead-peer-detection;
            no-nat-traversal;
            external-interface fe-0/0/0.0;
        }
        gateway gw-vpn-f7584996-2 {
            ike-policy ike-pol-vpn-f7584996-2;
            address 52.54.120.173;
            dead-peer-detection;
            no-nat-traversal;
            external-interface fe-0/0/0.0;
        }
    }
    ipsec {
        proposal ipsec-prop-vpn-f7584996-1 {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm aes-128-cbc;
            lifetime-seconds 3600;
        }
        proposal ipsec-prop-vpn-f7584996-2 {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm aes-128-cbc;
            lifetime-seconds 3600;
        }
        policy ipsec-pol-vpn-f7584996-1 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposals ipsec-prop-vpn-f7584996-1;
        }
        policy ipsec-pol-vpn-f7584996-2 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposals ipsec-prop-vpn-f7584996-2;
        }
        vpn vpn-f7584996-1 {
            bind-interface st0.1;
            df-bit clear;
            vpn-monitor {
                source-interface st0.1;
                destination-ip 169.254.47.17;
            }
            ike {
                gateway gw-vpn-f7584996-1;
                ipsec-policy ipsec-pol-vpn-f7584996-1;
            }
        }
        vpn vpn-f7584996-2 {
            bind-interface st0.2;
            df-bit clear;
            vpn-monitor {
                source-interface st0.2;
                destination-ip 169.254.45.37;
            }
            ike {
                gateway gw-vpn-f7584996-2;
                ipsec-policy ipsec-pol-vpn-f7584996-2;
            }
        }
    }
    flow {
        tcp-mss {
            ipsec-vpn {
                mss 1387;
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    nat {
        source {
            rule-set nsw_srcnat {
                from zone Internal;
                to zone Internet;
                rule nsw-src-interface {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone Internal to-zone Internet {
            policy All_Internal_Internet {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone Internal to-zone aws {
            policy TO-aws {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone aws to-zone Internal {
            policy FROM-aws {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone Internal {
            interfaces {
                vlan.1 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            dhcp;
                            http;
                            https;
                            ssh;
                            telnet;
                        }
                    }
                }
            }
        }
        security-zone Internet {
            interfaces {
                fe-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                        }
                    }
                }
            }
        }
        security-zone aws {
            host-inbound-traffic {
                protocols {
                    bgp;
                }
            }
            interfaces {
                st0.1;
                st0.2;
            }
        }
        security-zone untrust {
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
        }
    }
}
vlans {
    vlan1 {
        vlan-id 3;
        l3-interface vlan.1;
    }
}
  • You do realize that the 169.254.0.0/16 network is the Link-Local network, and you cannot route with it. Why are you trying to with BGP? – Ron Maupin Nov 7 '16 at 2:51
  • Why are you using, actually misusing, Link-Local addresses? You are not allowed to statically configure addresses in the 169.254.0.0/16 range, subnet that range, or route with that range. See RFC 3927 for all the rules surrounding the Link-Local address range. – Ron Maupin Nov 8 '16 at 2:53
  • Since you are using your fe-0/0/0.0 interface as your ipsec termination interface, you should add the "system-services ike" under "zones security-zone Internet interfaces fe-0/0/0.0 host-inbound-traffic" – John K. Nov 8 '16 at 14:58
  • @JohnK. gave that a shot but didn't seem to help....the tunnels are up though... – lightweight Nov 8 '16 at 16:05
  • Are you able to ping from your st interface IP to the IP address at the other end of the tunnel? – John K. Nov 9 '16 at 21:14
1

From your output, it looks like there are a couple of things wrong:

  1. The st0.0 and st0.1 interfaces are what you connect to AWS over, however they are currently located in a zone trust which has no security policies bound to it.

To resolve these, I would recommend the following changes (as a starting point):

rename security zones security-zone trust to AWS
set security policy from-zone Internal to-zone AWS policy TO-AWS match source-address any
set security policy from-zone Internal to-zone AWS policy TO-AWS match destination-address any
set security policy from-zone Internal to-zone AWS policy TO-AWS match application any
set security policy from-zone Internal to-zone AWS policy TO-AWS then permit
set security policy from-zone AWS to-zone Internal policy FROM-AWS match source-address any
set security policy from-zone AWS to-zone Internal policy FROM-AWS match destination-address any
set security policy from-zone AWS to-zone Internal policy FROM-AWS match application any
set security policy from-zone AWS to-zone Internal policy FROM-AWS then permit
  1. In your appended output, BGP is up, but you don't appear to be receiving any routes from AWS. I'm not sure that you want to be sending a default route into AWS either.

I would start with something simpler like just advertising the attached vlan.1 prefix:

set policy-options policy-statement DIRECT term DIRECT-INTERFACES from protocol direct
set policy-options policy-statement DIRECT term DIRECT-INTERFACES from interface vlan.1
set policy-options policy-statement DIRECT term DIRECT-INTERFACES then accept
set policy-options policy-statement DIRECT term REJECT then reject
delete protocols bgp group ebgp neighbor 169.254.44.65 export EXPORT-DEFAULT
delete protocols bgp group ebgp neighbor 169.254.47.145 export EXPORT-DEFAULT
set protocols bgp group ebgp neighbor 169.254.44.65 export DIRECT
set protocols bgp group ebgp neighbor 169.254.47.145 export DIRECT

After that, you'll need to make sure you're propagating routes from your VPC within AWS (so that you receive them via BGP) - the rough process for this is:

  1. In the navigation pane, choose Route Tables, and then select the route table (usually the main route table for the VPC).
  2. Click on the Route Propagation tab in the Details pane, click Edit, pick the gateway and then Save.
| improve this answer | |
  • I set the security zones like you mentioned above but still no luck. I also changed it from BGP to Static and on the AWS side, both tunnels are showing up, the address of the local network (192.168.2.0/24) is showing as a propagated route in aws too. Tunnels are up on the SRX side too. My SRX router sits behind an ISP modem so I turned on nat-traversal too but that didnt' seem to have any effect either. I tried to do a traceroute from SRX to AWS and the first hop goes to 192.168.0.1 (modem) but then is all *s. I also updated what my config looks like now as well in the edit. – lightweight Nov 8 '16 at 2:42
  • Okay, if you've changed the AWS side to BGP, do the same on the SRX - add a static route to 192.168.2.0/24 with a next-hop of st0.0. Also, try pinging the AWS end of each of your tunnels eg: 169.254.47.17 and 169.254.45.37 – Benjamin Dale Nov 8 '16 at 4:40
  • Hey Ben, I changed the AWS side to static routing, not BGP. I also but in a static route on the SRX side that looks like this now routing-options { static { route 192.168.2.0/24 next-hop [ st0.1 st0.2 ]; } }.....I tried to ping 169.254.47.17 from a laptop inside the local lan but couldn't, but I could ping it from the SRX router, but when I do a traceroute, all the hops come back as *. From AWS, nothing pings to the local lan – lightweight Nov 8 '16 at 16:00
  • shouldn't 108.205.0.0/16 route to st0.1 and st0.2? – lightweight Nov 8 '16 at 16:07
  • No idea - what is 108.205.0.0/16? – Benjamin Dale Nov 8 '16 at 21:36
0

Did you propagate the route table on AWS? If not, go to the VPC, Route Table go to the route table for your VPC then under route propagate hit edit and mark as YES. The VPN is up because both peers established phase 1 and phase 2, I think your problem is that when you send traffic from your Juniper device to AWS, the AWS device will reply back, but the AWS doesn't know that IP needs to traverse through the VPN tunnel. You can also do this test; create a linux instance on AWS and run tcpdump. With tcpdump, you should be able to see the traffic coming from your branch.

| improve this answer | |
  • Yep, the propagate route is checked yes and I read the tcpdump and saw a bunch of packets coming from Cox (which is the ISP) but couldn't understand it – lightweight Nov 5 '16 at 12:28
  • I think what you have is a route issue. You seem to have VPN up, but you have to have routes to tell the device that the traffic si for the VPN Tunnels. What happens now is that are routing your traffic to the internet and because of that is not going to work. Do this, go to your branch and try to ping your AWS instance and then go to your instance and do this tcpdump ICMP . Paste the output in here. – David Nov 7 '16 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.