[j-nsp] srx ipsec tunnel over mpls l3vpn
Aaron Gould
aaron1 at gvtc.com
Thu Jul 11 16:34:26 EDT 2019
Thanks Emille, Ummm, I may be misunderstanding you , but I don't think I
have change from SRX flow-mode default. But I do have ldp neighbor up and
mpls forwarding is occurring via mpls l3vpn vrf . ....and I do believe the
ike phase 1 and phase 2 is working over this mpls l3vpn within the srx....
but I just don't seem to be able to ping from one side of the st0 tunnel
interface to the other.
See...
root at demo-srx300> show security flow status
Flow forwarding mode:
Inet forwarding mode: flow based
Inet6 forwarding mode: drop
MPLS forwarding mode: drop
ISO forwarding mode: drop
Enhanced route scaling mode: Disabled
Flow trace status
Flow tracing status: off
Flow session distribution
Distribution mode: RR-based
GTP-U distribution: Disabled
Flow ipsec performance acceleration: off
Flow packet ordering
Ordering mode: Hardware
root at demo-srx300> show route table mpls.0
mpls.0: 524 destinations, 524 routes (524 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0 *[MPLS/0] 04:51:07, metric 1
Receive
1 *[MPLS/0] 04:51:07, metric 1
Receive
2 *[MPLS/0] 04:51:07, metric 1
Receive
13 *[MPLS/0] 04:51:07, metric 1
Receive
16 *[VPN/0] 04:51:07
to table one.inet.0, Pop
345552 *[LDP/9] 04:43:04, metric 3, tag 0
> to 10.101.14.197 via ge-0/0/0.0, Swap 16507
345568 *[LDP/9] 04:43:04, metric 4, tag 0
> to 10.101.14.197 via ge-0/0/0.0, Swap 16508
345584 *[LDP/9] 04:43:04, metric 2, tag 0
> to 10.101.14.197 via ge-0/0/0.0, Swap 16512
345600 *[LDP/9] 04:43:04, metric 3, tag 0
> to 10.101.14.197 via ge-0/0/0.0, Swap 16513
345616 *[LDP/9] 04:43:04, metric 3, tag 0
> to 10.101.14.197 via ge-0/0/0.0, Swap 16516
345632 *[LDP/9] 04:43:04, metric 4, tag 0
> to 10.101.14.197 via ge-0/0/0.0, Swap 16517
345648 *[LDP/9] 04:43:04, metric 3, tag 0
> to 10.101.14.197 via ge-0/0/0.0, Swap 16518
root at demo-srx300> show route table mpls.0 terse
mpls.0: 524 destinations, 524 routes (524 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
A V Destination P Prf Metric 1 Metric 2 Next hop AS path
* ? 0 M 0 1 Receive
* ? 1 M 0 1 Receive
* ? 2 M 0 1 Receive
* ? 13 M 0 1 Receive
* ? 16 V 0 Table
* ? 345552 L 9 3 >10.101.14.197
* ? 345568 L 9 4 >10.101.14.197
* ? 345584 L 9 2 >10.101.14.197
* ? 345600 L 9 3 >10.101.14.197
* ? 345616 L 9 3 >10.101.14.197
* ? 345632 L 9 4 >10.101.14.197
* ? 345648 L 9 3 >10.101.14.197
* ? 345664 L 9 7 >10.101.14.197
* ? 345680 L 9 6 >10.101.14.197
* ? 345696 L 9 7 >10.101.14.197
* ? 345712 L 9 7 >10.101.14.197
* ? 345728 L 9 6 >10.101.14.197
* ? 345744 L 9 7 >10.101.14.197
root at demo-srx300> show route table mpls.0 terse | count
Count: 528 lines
root at demo-srx300> show ldp neighbor
Address Interface Label space ID Hold time
10.101.14.197 ge-0/0/0.0 10.101.0.254:0 10
root at demo-srx300>
-----Original Message-----
From: Emille Blanc [mailto:emille at abccommunications.com]
Sent: Thursday, July 11, 2019 3:04 PM
To: Aaron Gould; juniper-nsp at puck.nether.net
Subject: RE: [j-nsp] srx ipsec tunnel over mpls l3vpn
Based on what you described, it sounds like you already got your MPLS/LDP
running in a packet-mode routing-instance, as otherwise MPLS is dropped on
an SRX in flow mode.
No obvious ideas with the output provided otherwise.
Do the flows in your IPSEC instance get created?
-----Original Message-----
From: juniper-nsp [mailto:juniper-nsp-bounces at puck.nether.net] On Behalf Of
Aaron Gould
Sent: Thursday, July 11, 2019 12:27 PM
To: juniper-nsp at puck.nether.net
Subject: [j-nsp] srx ipsec tunnel over mpls l3vpn
Anyone ever done it ? To be clear, I have mpls/ldp/ospf/bgp enabled the SRX
such that I have an l3vpn functional into the SRX.
I have a lo0.99 interface as the external interface used for ike/ipsec.
Seems that I'm pretty close to getting this done, as i have ike phase 1 up
and ike phase 2 up, but only seeing encrypted packets as I try to ping
between the st0.0 interface and the ms-0/0/0.1 inside interface on the other
side (mx104 with ms-mic-16g)
Let me know what I'm missing.
I'm seeing drops in these to show outputs. which seems to coincide with a
100-packet ping test...
root at demo-srx300> show security flow statistics
Current sessions: 9
Packets forwarded: 417926
Packets dropped: 15604
Fragment packets: 0
Pre fragments generated: 0
Post fragments generated: 0
root at demo-srx300> show security flow status
Flow forwarding mode:
Inet forwarding mode: flow based
Inet6 forwarding mode: drop
MPLS forwarding mode: drop
ISO forwarding mode: drop
Enhanced route scaling mode: Disabled
Flow trace status
Flow tracing status: off
Flow session distribution
Distribution mode: RR-based
GTP-U distribution: Disabled
Flow ipsec performance acceleration: off
Flow packet ordering
Ordering mode: Hardware
root at demo-srx300> show security ipsec statistics
ESP Statistics:
Encrypted bytes: 252264
Decrypted bytes: 0
Encrypted packets: 1618
Decrypted packets: 0
AH Statistics:
Input bytes: 0
Output bytes: 0
Input packets: 0
Output packets: 0
Errors:
AH authentication failures: 0, Replay errors: 0
ESP authentication failures: 0, ESP decryption failures: 0
Bad headers: 0, Bad trailers: 0
root at demo-srx300> show security flow statistics | grep rop
Packets dropped: 15650
root at demo-srx300> ping 10.102.199.66 routing-instance one rapid interval .1
count 100
PING 10.102.199.66 (10.102.199.66): 56 data bytes
............................................................................
........................
--- 10.102.199.66 ping statistics ---
100 packets transmitted, 0 packets received, 100% packet loss
root at demo-srx300> show security ipsec statistics
ESP Statistics:
Encrypted bytes: 267864
Decrypted bytes: 0
Encrypted packets: 1718
Decrypted packets: 0
AH Statistics:
Input bytes: 0
Output bytes: 0
Input packets: 0
Output packets: 0
Errors:
AH authentication failures: 0, Replay errors: 0
ESP authentication failures: 0, ESP decryption failures: 0
Bad headers: 0, Bad trailers: 0
root at demo-srx300> show security flow statistics | grep rop
Packets dropped: 15755
-Aaron
_______________________________________________
juniper-nsp mailing list juniper-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp
More information about the juniper-nsp
mailing list