Juniper SRX Route-Based Site-to-Site IPsec VPN

Route-based VPNs on a Juniper SRX put all tunneled traffic into a logical st0 (secure tunnel) interface: anything routed into st0.x is encrypted and sent to the peer, provided the security policy permits it. Unlike policy-based VPNs there is no per-traffic "interesting traffic" list, which makes route-based tunnels easier to scale and to combine with dynamic routing. This guide walks through a complete route-based site-to-site IPsec configuration between two SRX firewalls, including the security zones and policies that are easy to forget.

Topology and Building Blocks

SRX-A (WAN 1.1.1.1/30, LAN 10.1.1.0/24) peers with SRX-B (WAN 2.2.2.2/30, LAN 10.2.2.0/24). Both LANs use st0.0 with addresses 192.168.0.1/30 and 192.168.0.2/30. The pieces to configure on both sides: IKE proposal, IKE policy, IKE gateway, IPsec proposal, IPsec policy, IPsec VPN (bound to st0.0), zone membership for st0.0, security policies, and a static route pointing the remote LAN into st0.0.

Phase 1 (IKE) Configuration

set security ike proposal IKE-PROP authentication-method pre-shared-keys
set security ike proposal IKE-PROP dh-group group14
set security ike proposal IKE-PROP encryption-algorithm aes-256-cbc
set security ike proposal IKE-PROP authentication-algorithm sha-256
set security ike policy IKE-POL mode main
set security ike policy IKE-POL proposals IKE-PROP
set security ike policy IKE-POL pre-shared-key ascii-text MySecretKey
set security ike gateway IKE-GW ike-policy IKE-POL
set security ike gateway IKE-GW address 2.2.2.2
set security ike gateway IKE-GW external-interface ge-0/0/0.0

On SRX-B mirror the same commands with the peer address 1.1.1.1 and its own external interface. The security level of the proposals must match on both ends.

Phase 2 (IPsec) Configuration

set security ipsec proposal IPSEC-PROP protocol esp
set security ipsec proposal IPSEC-PROP encryption-algorithm aes-256-cbc
set security ipsec proposal IPSEC-PROP authentication-algorithm hmac-sha-256-128
set security ipsec policy IPSEC-POL proposals IPSEC-PROP
set security ipsec vpn IPSEC-VPN bind-interface st0.0
set security ipsec vpn IPSEC-VPN ike gateway IKE-GW
set security ipsec vpn IPSEC-VPN ike ipsec-policy IPSEC-POL
set security ipsec vpn IPSEC-VPN establish-tunnels immediately

establish-tunnels immediately brings the tunnel up as soon as the configuration commits instead of waiting for traffic; with it you can verify Phase 2 right away.

Zones, Policies and Routing

set interfaces st0 unit 0 family inet address 192.168.0.1/30
set security zones security-zone VPN host-inbound-traffic system-services ike
set security zones security-zone VPN interfaces st0.0
set security zones security-zone UNTRUST host-inbound-traffic system-services ike
set security zones security-zone UNTRUST interfaces ge-0/0/0.0
set security policies from-zone TRUST to-zone VPN policy lan-to-vpn match source-address 10.1.1.0/24
set security policies from-zone TRUST to-zone VPN policy lan-to-vpn match destination-address 10.2.2.0/24
set security policies from-zone TRUST to-zone VPN policy lan-to-vpn match application any
set security policies from-zone TRUST to-zone VPN policy lan-to-vpn then permit
set routing-options static route 10.2.2.0/24 next-hop st0.0

Create the return policy from-zone VPN to-zone TRUST with the source/destination reversed, plus an any-any tunnel policy between VPN and VPN zones if needed. The static route toward st0.0 is what makes this a route-based VPN: the remote LAN prefix is reached through the tunnel interface and IKE is allowed as a host-inbound service on the untrust interface.

Verification

show security ike security-associations
show security ipsec security-associations
show security ipsec statistics
show security flow session | match "10.1.1|10.2.2"
ping 10.2.2.1 source 10.1.1.1

The IPsec SA table shows the tunnel with its SPI and lifetime; a healthy pair shows Phase 1 (IKE) and Phase 2 (IPsec) SAs up in both directions. If the tunnel stays down, check the IKE proposal match, pre-shared key, external interface, and that the peer's LAN prefix in the static route points at the right st0 unit — the discipline is the same as for the SRX basics in our SRX internet configuration guide and SRX security policy guide.

原文链接：https://letsconfig.com/how-to-configure-site-to-site-route-based-ipsec-vpn-on-juniper-srx