3

I am trying to set up a Group VPN between a cisco GC/KS and 3 vMX router (14.1R1.10) and another cisco router as a member. I've managed to get the Group VPN working between the two cisco router, but I have dificulties configuring the vMX routers an maybe someone here can help.

Config for GM-1 (juniper vMX router as a group member):

rokk@GM-1# show | display set 
set version 14.1R1.10
set system host-name GM-1
set system root-authentication encrypted-password "$1$vNnFWAM2$KurYUSasAGoxR1rmE.48w0"
set system login user rokk uid 2000
set system login user rokk class super-user
set system login user rokk authentication encrypted-password "$1$boEud/xr$pkEPaLOAREI2jZwzMSZp7/"
set system syslog user * any emergency
set system syslog file messages any notice
set system syslog file messages authorization info
set chassis fpc 0 pic 0 tunnel-services
set chassis fpc 0 pic 0 inline-services bandwidth 1g
set chassis fpc 0 pic 0 adaptive-services service-package layer-3
set services service-set SER-SET interface-service service-interface si-0/0/0
set services service-set SER-SET ipsec-group-vpn ABC
set security group-vpn member ike proposal IKE-PROPOSAL authentication-method pre-shared-keys
set security group-vpn member ike proposal IKE-PROPOSAL dh-group group2
set security group-vpn member ike proposal IKE-PROPOSAL encryption-algorithm 3des-cbc
set security group-vpn member ike policy IKE-POLICY mode main
set security group-vpn member ike policy IKE-POLICY proposals IKE-PROPOSAL
set security group-vpn member ike policy IKE-POLICY pre-shared-key ascii-text "$9$-cws4HkPQ39YgPQ"
set security group-vpn member ike gateway IKE-GW ike-policy IKE-POLICY
set security group-vpn member ike gateway IKE-GW server-address 4.4.4.2
set security group-vpn member ike gateway IKE-GW local-address 1.1.1.2
set security group-vpn member ipsec vpn ABC ike-gateway IKE-GW
set security group-vpn member ipsec vpn ABC group 1412
set security group-vpn member ipsec vpn ABC match-direction output
set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.2/24
set interfaces si-0/0/0 unit 0 family inet
set interfaces ge-0/0/1 unit 0 family inet address 192.168.1.1/24
set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1

Config for GC/KS:

GC_KS-1#show running-config 
Building configuration...

Current configuration : 2093 bytes
!
! Last configuration change at 18:42:37 EET Wed Jan 2 2019
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname GC_KS-1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
bsd-client server url https://cloudsso.cisco.com/as/token.oauth2
clock timezone EET 2 0
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
!
!


!
!
!
!         
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
cts logging verbose
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
! 
!         
!
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 1.1.1.2        
crypto isakmp key cisco address 2.2.2.2        
crypto isakmp key cisco address 3.3.3.2        
crypto isakmp key cisco address 6.6.6.2        
!
!
crypto ipsec transform-set TR-SET esp-3des 
 mode tunnel
!
crypto ipsec profile PROFILE
 set transform-set TR-SET 
!
!
crypto gdoi group ABC
 identity number 1412
 server local
  sa ipsec 1
   profile PROFILE
   match address ipv4 199
   replay counter window-size 64
   no tag
  address ipv4 4.4.4.2
!
!
!
!
!
!
interface Ethernet0/0
 ip address 4.4.4.2 255.255.255.0
!
interface Ethernet0/1
 ip address 192.168.4.1 255.255.255.0
!
interface Ethernet0/2
 no ip address
 shutdown
!
interface Ethernet0/3
 no ip address
 shutdown
!
interface Ethernet1/0
 no ip address
 shutdown
!
interface Ethernet1/1
 no ip address
 shutdown
!
interface Ethernet1/2
 no ip address
 shutdown
!
interface Ethernet1/3
 no ip address
 shutdown
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 4.4.4.1
!
!
!
access-list 199 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
!
control-plane
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
!
end

Config for GM-6:

GM-6#show running-config 
Building configuration...

Current configuration : 1730 bytes
!
! Last configuration change at 19:25:28 EET Wed Jan 2 2019
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname GM-6
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
bsd-client server url https://cloudsso.cisco.com/as/token.oauth2
clock timezone EET 2 0
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
!
!


!
!
!
!         
no ip domain lookup
ip domain name cisco.com
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
cts logging verbose
!
!
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!         
!
!
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 4.4.4.2        
!
!
!
!
crypto gdoi group ABC
 identity number 1412
 server address ipv4 4.4.4.2
!
!
crypto map MAP 10 gdoi 
 set group ABC
!
!
!         
!
!
interface Ethernet0/0
 no ip address
 shutdown
!
interface Ethernet0/1
 ip address 192.168.6.1 255.255.255.0
!
interface Ethernet0/2
 no ip address
 shutdown
!
interface Ethernet0/3
 ip address 6.6.6.2 255.255.255.0
 crypto map MAP
!
interface Ethernet1/0
 no ip address
 shutdown
!
interface Ethernet1/1
 no ip address
 shutdown
!
interface Ethernet1/2
 no ip address
 shutdown
!
interface Ethernet1/3
 no ip address
 shutdown
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 6.6.6.1
!
!
!
!
control-plane
!
!         
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
 transport input none
!
!
end

enter image description here

The connection between GM-6 and GC-KS is up:

GM-6#show crypto session detail

Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
R - IKE Auto Reconnect
Interface: Ethernet0/3
Session status: UP-ACTIVE
Peer: 0.0.0.0 port 848 fvrf: (none) ivrf: (none)
Phase1_id: 4.4.4.2
Desc: (none)
Session ID: 0
IKEv1 SA: local 6.6.6.2/848 remote 4.4.4.2/848 Active
Capabilities:(none) connid:1001 lifetime:23:22:03
IPSEC FLOW: permit ip 192.168.0.0/255.255.0.0 192.168.0.0/255.255.0.0
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/1964
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/1964****

The problem is at the vMX configuration under edit services service-set, when I try the si interfaces it gives me the following error:

rokk@GM-1# show | compare
[edit]
+  services {
+      service-set SER-SET {
+          interface-service {
+              service-interface si-0/0/0;
+          }
+          ipsec-group-vpn ABC;
+      }
+  }
[edit interfaces]
+   si-0/0/0 {
+       unit 0 {
+           family inet;
+       }
+   }

[edit]
rokk@GM-1# commit check      
[edit services]
  'service-set SER-SET'
    nat-rules or nat-rule-sets or softwire-rules or softwire-rule-sets or ip-reassembly-rule or ip-reassembly-rule-sets must be configured when si is the service-interface
error: configuration check-out failed

So, has anyone tryed to configure Group VPN on the vMX router? and if yes, can you give me an example? or can you show me what else I must do? because I see that I can configure the router as a member under security group-vpn member .

See topology attached.

2
  • Thx Ron for editing the post. It looks very good now. Thx. – rokk1412 Jan 2 '19 at 18:24
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 14 '19 at 18:20
2

Disclaimer: My Juniper days are long gone, and I only ever worked on SRXs.

But this strikes me:

set security group-vpn member ike gateway IKE-GW local-address 1.1.1.2

That would implicitely define ge-0/0/0 as the "IPSec talking interface", by virtue of the IPv4 address configured on ge-0/0/0, as given here:

set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.2/24

In contrast, si-0/0/0 doesn't seem to have an IP configuration:

set interfaces si-0/0/0 unit 0 family inet

Now, if you intend to make the si-0/0/0 your IPSec endpoint, as you do in ...

set services service-set SER-SET interface-service service-interface si-0/0/0

... that cannot work unless there is some sort of relationship between that si-0/0/0 and the IP address 1.1.1.2/24 (alternatively: between si-0/0/0 and ge-0/0/0). I think that's what the error message is trying to convey:

nat-rules or nat-rule-sets or softwire-rules or softwire-rule-sets or ip-reassembly-rule or ip-reassembly-rule-sets must be configured when si is the service-interface

I think these are paths towards a solution:

  • si-0/0/0 must be somehow "linked" to ge-0/0/0, e.g. by a NAT or softwire configuration, as the error-message suggests; si-0/0/0 might still need an IP address of its own to make that work.
  • move the IPSec endpoint to ge-0/0/0, by set services service-set SER-SET interface-service service-interface ge-0/0/0, I should think.
2
  • Thank you for the reply. But I tried to set the interface to ge-0/0/0 as the service-set interface, but I receive an error that this interface cannot be used as a service-set interface. Also even if I put an IP address on the interface si-0/0/0 I still receive the error: ""nat-rules or nat-rule-sets or softwire-rules or softwire-rule-sets or ip-reassembly-rule or ip-reassembly-rule-sets must be configured when si is the service-interface"" – rokk1412 Jan 5 '19 at 6:37
  • I think this happens only for the vMX. I read on the juniper website and the MX router has a special card for the si-0/0/0 interface. I am doing this only for the learning purposes. Thank you. – rokk1412 Jan 5 '19 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.