Π‘ΠΎΠ·Π΄Π°Π½ΠΈΠ΅ IPSec GRE туннСля ΠΌΠ΅ΠΆΠ΄Ρƒ Mikrotik hEX S ΠΈ Juniper SRX Ρ‡Π΅Ρ€Π΅Π· USB МодСм

ЦСль

НСобходимо ΠΎΡ€Π³Π°Π½ΠΈΠ·ΠΎΠ²Π°Ρ‚ΡŒ VPN Tunnel ΠΌΠ΅ΠΆΠ΄Ρƒ двумя устройствами, Ρ‚Π°ΠΊΠΈΡ… ΠΊΠ°ΠΊ Mikrotik ΠΈ Juniper Π»ΠΈΠ½Π΅ΠΉΠΊΠΈ SRX.

Π§Ρ‚ΠΎ ΠΈΠΌΠ΅Π΅ΠΌ

Из ΠΌΠΈΠΊΡ€ΠΎΡ‚ΠΈΠΊΠΎΠ² Π²Ρ‹Π±Ρ€Π°Π»ΠΈ Π½Π° сайтС ΠΌΠΈΠΊΡ€ΠΎΡ‚ΠΈΠΊΠ° Π²ΠΈΠΊΠΈ, модСль которая смоТСт ΠΏΠΎΠ΄Π΄Π΅Ρ€ΠΆΠΈΠ²Π°Ρ‚ΡŒ Π°ΠΏΠΏΠ°Ρ€Π°Ρ‚Π½ΠΎΠ΅ ΡˆΠΈΡ„Ρ€ΠΎΠ²Π°Π½ΠΈΠ΅ IPSec, Π½Π° наш взгляд ΠΎΠ½Π° оказалась достаточно компактная ΠΈ нСдорогая, Π° ΠΈΠΌΠ΅Π½Π½ΠΎ Mikrotik hEXS.

USB Modem Π±Ρ‹Π» ΠΊΡƒΠΏΠ»Π΅Π½ Π² блиТайшСм сотовом ΠΎΠΏΠ΅Ρ€Π°Ρ‚ΠΎΡ€Π΅, модСль Π±Ρ‹Π»Π° Huawei E3370. НикакиС ΠΎΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΈ ΠΏΠΎ отвязки ΠΎΡ‚ ΠΎΠΏΠ΅Ρ€Π°Ρ‚ΠΎΡ€Π° ΠΌΡ‹ Π½Π΅ ΠΏΡ€ΠΎΠ²ΠΎΠ΄ΠΈΠ»ΠΈ. ВсС ΡˆΡ‚Π°Ρ‚Π½ΠΎΠ΅ ΠΈ ΠΏΡ€ΠΎΡˆΠΈΡ‚ΠΎ самим ΠΎΠΏΠ΅Ρ€Π°Ρ‚ΠΎΡ€ΠΎΠΌ.

Π’ ядрС установлСн Ρ†Π΅Π½Ρ‚Ρ€Π°Π»ΡŒΠ½Ρ‹ΠΉ ΠΌΠ°Ρ€ΡˆΡ€ΡƒΡ‚ΠΈΠ·Π°Ρ‚ΠΎΡ€ Juniper SRX240H.

Π§Ρ‚ΠΎ ΡƒΠ΄Π°Π»ΠΎΡΡŒ

Удалось Ρ€Π΅Π°Π»ΠΈΠ·ΠΎΠ²Π°Ρ‚ΡŒ схСму Ρ€Π°Π±ΠΎΡ‚Ρ‹, которая позволяСт Ρ‡Π΅Ρ€Π΅Π· сотового ΠΎΠΏΠ΅Ρ€Π°Ρ‚ΠΎΡ€Π°, Π½Π΅ имСя статичСского адрСса, посрСдством ΠΌΠΎΠ΄Π΅ΠΌΠ° ΡΠΎΠ·Π΄Π°Ρ‚ΡŒ IPsec соСдинСниС Π² ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΉ заворачиваСтся GRE Tunnel.

Данная схСма ΠΏΠΎΠ΄ΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΡ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠ΅Ρ‚ΡΡ ΠΈ Ρ€Π°Π±ΠΎΡ‚Π°Π΅Ρ‚ Π½Π° USB ΠΌΠΎΠ΄Π΅ΠΌΠ°Ρ… Π‘ΠΈΠ»Π°ΠΉΠ½ ΠΈ ΠœΠ΅Π³Π°Ρ„ΠΎΠ½.

ΠšΠΎΠ½Ρ„ΠΈΠ³ΡƒΡ€Π°Ρ†ΠΈΡ ΡΠ»Π΅Π΄ΡƒΡŽΡ‰Π°Ρ:

Π’ ядрС установлСн Juniper SRX240H
Local Address: 192.168.1.1/24
External Address: 1.1.1.1/30
GW: 1.1.1.2

УдалСнная Ρ‚ΠΎΡ‡ΠΊΠ°

Mikrotik hEX S
Local Address: 192.168.152.1/24
External Address: Dynamic

НСбольшая Π΄ΠΈΠ°Π³Ρ€Π°ΠΌΠΌΠ° для понимания Ρ€Π°Π±ΠΎΡ‚Ρ‹:

Π‘ΠΎΠ·Π΄Π°Π½ΠΈΠ΅ IPSec GRE туннСля ΠΌΠ΅ΠΆΠ΄Ρƒ Mikrotik hEX S ΠΈ Juniper SRX Ρ‡Π΅Ρ€Π΅Π· USB МодСм

ΠšΠΎΠ½Ρ„ΠΈΠ³ΡƒΡ€Π°Ρ†ΠΈΡ Juniper SRX240:

ВСрсия ПО JUNOS Software Release [12.1X46-D82]

ΠšΠΎΠ½Ρ„ΠΈΠ³ΡƒΡ€Π°Ρ†ΠΈΡ Juniper

interfaces {
    ge-0/0/0 {
        description Internet-1;
        unit 0 {
            family inet {
                address 1.1.1.1/30;
            }
        }
    }
    gr-0/0/0 {
        unit 1 {
            description GRE-Tunnel;
            tunnel {
                source 172.31.152.2;
                destination 172.31.152.1;
            }
            family inet;    
    vlan {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    st0 {
        unit 5 {
            description "Area - 192.168.152.0/24";
            family inet {
                mtu 1400;
            }
        }
routing-options {
    static {
        route 0.0.0.0/0 next-hop 1.1.1.2;
        route 192.168.152.0/24 next-hop gr-0/0/0.1;
        route 172.31.152.0/30 next-hop st0.5;
    }
    router-id 192.168.1.1;
}
security {
    ike {
        traceoptions {
            file vpn.log size 256k files 5;
            flag all;
        }
        policy ike-gretunnel {
            mode aggressive;
            description area-192.168.152.0;
            proposal-set standard;
            pre-shared-key ascii-text "mysecret"; ## SECRET-DATA
        }
        gateway gw-gretunnel {
            ike-policy ike-gretunnel;
            dynamic inet 172.31.152.1;
            external-interface ge-0/0/0.0;
            version v2-only;
        }
    ipsec {
        }
        policy vpn-policy0 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposal-set standard;
        }
        vpn vpn-gretunnel {
            bind-interface st0.5;
            df-bit copy;
            vpn-monitor {
                optimized;
                source-interface st0.5;
                destination-ip 172.31.152.1;
            }
            ike {
                gateway gw-gretunnel;
                no-anti-replay;
                ipsec-policy vpn-policy0;
                install-interval 10;
            }
            establish-tunnels immediately;
        }
    }
    policies {  
        from-zone vpn to-zone vpn {
            policy st-vpn-vpn {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                    log {
                        session-init;   
                        session-close;
                    }
                    count;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy st-trust-to-vpn {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {                  
                    permit;
                    log {
                        session-init;
                        session-close;
                    }
                    count;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy st-vpn-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                    log {
                        session-init;
                        session-close;
                    }
                    count;
                }
            }
        }
    zones {                             
        security-zone trust {
                vlan.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
        security-zone vpn {
            interfaces {
                st0.5 {
                    host-inbound-traffic {
                        protocols {
                            ospf;
                        }
                    }
                }
                gr-0/0/0.1 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;        
                        }
                    }
                }
        security-zone untrust {
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            ssh;
                            ike;
                        }
                    }
                }
            }
        }
vlans {                                 
    vlan-local {
        vlan-id 5;
        l3-interface vlan.1;
    }

ΠšΠΎΠ½Ρ„ΠΈΠ³ΡƒΡ€Π°Ρ†ΠΈΡ Mikrotik hEX S:

ВСрсия ПО RouterOS [6.44.3]

ΠšΠΎΠ½Ρ„ΠΈΠ³ΡƒΡ€Π°Ρ†ΠΈΡ Mikrotik

/ip address
add address=172.31.152.1/24 comment=GRE-Tunnel interface=gre-srx network=172.31.152.0
add address=192.168.152.1/24 comment=Local-Area interface=bridge network=192.168.152.0

/interface gre
add comment=GRE-Tunnel-SRX-HQ !keepalive local-address=172.31.152.1 name=gre-srx remote-address=172.31.152.2

/ip ipsec policy group
add name=srx-gre

/ip ipsec profile
add dh-group=modp1024 dpd-interval=10s name=profile1

/ip ipsec peer
add address=1.1.1.1/32 comment=GRE-SRX exchange-mode=aggressive local-address=172.31.152.1 name=peer2 profile=profile1

/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-128-cbc,3des
add enc-algorithms=aes-128-cbc,3des name=proposal1

/ip route
add distance=10 dst-address=192.168.0.0/16 gateway=gre-srx

/ip ipsec identity
add comment=IPSec-GRE my-id=address:172.31.152.1 peer=peer2 policy-template-group=srx-gre secret=mysecret

/ip ipsec policy
set 0 disabled=yes
add dst-address=0.0.0.0/0 proposal=proposal1 sa-dst-address=1.1.1.1 sa-src-address=172.31.152.1 src-address=172.31.152.0/30 tunnel=yes

/ip address
add address=172.31.152.1/24 comment=GRE-Tunnel interface=gre-srx network=172.31.152.0
add address=192.168.152.1/24 comment=Local-Area interface=bridge network=192.168.152.0

Π Π΅Π·ΡƒΠ»ΡŒΡ‚Π°Ρ‚:
Π‘ΠΎ стороны Juniper SRX

netscreen@srx240> ping 192.168.152.1  
PING 192.168.152.1 (192.168.152.1): 56 data bytes
64 bytes from 192.168.152.1: icmp_seq=0 ttl=64 time=29.290 ms
64 bytes from 192.168.152.1: icmp_seq=1 ttl=64 time=28.126 ms
64 bytes from 192.168.152.1: icmp_seq=2 ttl=64 time=26.775 ms
64 bytes from 192.168.152.1: icmp_seq=3 ttl=64 time=25.401 ms
^C
--- 192.168.152.1 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 25.401/27.398/29.290/1.457 ms

Π‘ΠΎ стороны Mikrotik

net[admin@GW-LTE-] > ping 192.168.1.1 
  SEQ HOST                                     SIZE TTL TIME  STATUS                                                                                                                                               
    0 192.168.1.1                                56  64 34ms 
    1 192.168.1.1                                56  64 40ms 
    2 192.168.1.1                                56  64 37ms 
    3 192.168.1.1                                56  64 40ms 
    4 192.168.1.1                                56  64 51ms 
    sent=5 received=5 packet-loss=0% min-rtt=34ms avg-rtt=40ms max-rtt=51ms 

Π’Ρ‹Π²ΠΎΠ΄Ρ‹

ПослС ΠΏΡ€ΠΎΠ΄Π΅Π»Π°Π½Π½ΠΎΠΉ Ρ€Π°Π±ΠΎΡ‚Ρ‹ ΠΌΡƒ ΠΏΠΎΠ»ΡƒΡ‡ΠΈΠ»ΠΈ ΡΡ‚Π°Π±ΠΈΠ»ΡŒΠ½Ρ‹ΠΉ VPN Tunnel, ΠΈΠ· ΡƒΠ΄Π°Π»Π΅Π½Π½ΠΎΠΉ сСти Π½Π°ΠΌ доступна всС ΡΠ΅Ρ‚ΡŒ которая Π½Π°Ρ…ΠΎΠ΄ΠΈΡ‚ΡŒΡΡ Π·Π° juniper, ΠΈ соотвСтствСнно ΠΎΠ±Ρ€Π°Ρ‚Π½ΠΎ.

НС Ρ€Π΅ΠΊΠΎΠΌΠ΅Π½Π΄ΡƒΡŽ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ Π² Π΄Π°Π½Π½ΠΎΠΉ схСмС IKE2, Π²ΠΎΠ·Π½ΠΈΠΊΠ°Π»Π° ситуация Ρ‡Ρ‚ΠΎ послС ΠΏΠ΅Ρ€Π΅Π·Π°Π³Ρ€ΡƒΠ·ΠΊΠΈ Ρ‚ΠΎΠ³ΠΎ ΠΈΠ»ΠΈ ΠΈΠ½ΠΎΠ³ΠΎ устройства Π½Π΅ поднимаСтся IPSec.

Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: habr.com

Π”ΠΎΠ±Π°Π²ΠΈΡ‚ΡŒ ΠΊΠΎΠΌΠΌΠ΅Π½Ρ‚Π°Ρ€ΠΈΠΉ