1

As i know, the st0 interface is used when the gateways are configured with route based VPN.

But my question is, say below is the topology

A<---->B<---->C<---->D

A and D are hosts, B and C are the routers/gateways.

Now, if we want to reach D from A, we can directly have a route from B with the next hop being C.

The same is being done when using st0. st0 is configured on B and C and when A has to reach D, the next hop for B will be st0. And the same is when D has to reach A, the next hop will be st0 for C.

So, cant we just have their gateway IP address added as the next-hop instead of mapping them to st0? Aren't we doing the same thing?

If not, can anyone please help me understand it better.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 14, 2019 at 21:11

1 Answer 1

Reset to default
4

Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the tunnel interface and encrypting the traffic.

Usually when using an IPSEC tunnel, the link between B and C will be more hops and/or controlled by a third party, so you will route via the tunnel.

Improve this answer
2
  • Im still confused. Instead of having st0.0 interface, cant we just say that "if the outbound interface is so and so, have a tunnel and encrypt it". Isnt it the same as having st0 interface and mapping it to that interface? Im very much lost here, why do we have to have an virtual tunnel interface(st0.0), if we have an interface with an IP address like how we have it for Policy-based VPN. Cant we make do without that interface? Please help me out here.
    – RRHS
    Mar 10, 2019 at 17:47
  • What you're describing is policy-based VPN, which the SRX supports. Route-based VPN which is what we're discussing above. Policy-based VPN allows you to tunnel traffic based on the application (as matched by the security policy) but is inflexible in so far as the routing to the far end is static and any changes require the tunnel configuration at both ends to be change and the tunnel to be re-created. Route-based VPN (with next-hop st0.x) on the other hand allows dynamic routing protocols to be run across the tunnel, but routing specific applications down the tunnel is more involved.
    – Benjamin Dale
    Mar 10, 2019 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.