ื™ืฆื™ืจืช ืžื ื”ืจื” IPSec GRE ื‘ื™ืŸ Mikrotik hEX S ืœ-Juniper SRX ื‘ืืžืฆืขื•ืช ืžื•ื“ื USB

ื™ืขื“

ื™ืฉ ืฆื•ืจืš ืœืืจื’ืŸ ืžื ื”ืจืช VPN ื‘ื™ืŸ ืฉื ื™ ืžื›ืฉื™ืจื™ื, ื›ื’ื•ืŸ Mikrotik ื•-Juniper SRX line.

ืžื” ื™ืฉ ืœื ื•

ืž-Mikrotik, ื‘ื—ืจื ื• ื“ื’ื ื‘ืืชืจ Mikrotik wiki ืฉื™ื›ื•ืœ ืœืชืžื•ืš ื‘ื”ืฆืคื ืช ื—ื•ืžืจื” ืฉืœ IPSec; ืœื“ืขืชื ื•, ื”ื•ื ื”ืชื‘ืจืจ ื›ืงื•ืžืคืงื˜ื™ ื•ื–ื•ืœ ืœืžื“ื™, ื›ืœื•ืžืจ Mikrotik hEXS.

ืžื•ื“ื ื”-USB ื ืจื›ืฉ ืžื”ืžืคืขื™ืœ ื”ืกืœื•ืœืจื™ ื”ืงืจื•ื‘; ื”ื“ื’ื ื”ื™ื” Huawei E3370. ืœื ื‘ื™ืฆืขื ื• ืคืขื•ืœื•ืช ืœื”ืชื ืชืงื•ืช ืžื”ืžืคืขื™ืœ. ื”ื›ืœ ืกื˜ื ื“ืจื˜ื™ ื•ืชืคื•ืจ ืขืœ ื™ื“ื™ ื”ืžืคืขื™ืœ ืขืฆืžื•.

ืœืœื™ื‘ื” ื™ืฉ ื ืชื‘ ืžืจื›ื–ื™ ืฉืœ Juniper SRX240H.

ืžื” ืงืจื”

ื ื™ืชืŸ ื”ื™ื” ืœื™ื™ืฉื ืกื›ื™ืžืช ืขื‘ื•ื“ื” ื”ืžืืคืฉืจืช ืœื™ืฆื•ืจ ื—ื™ื‘ื•ืจ IPsec ื“ืจืš ืžืคืขื™ืœ ืกืœื•ืœืจื™, ืœืœื ื›ืชื•ื‘ืช ืกื˜ื˜ื™ืช, ื‘ืืžืฆืขื•ืช ืžื•ื“ื, ืฉืืœื™ื• ืขื•ื˜ืคื™ื ืืช ืžื ื”ืจืช GRE.

ื“ื™ืื’ืจืžืช ื—ื™ื‘ื•ืจ ื–ื• ืžืฉืžืฉืช ื•ืขื•ื‘ื“ืช ืขืœ ืžื•ื“ืžื™ USB ืฉืœ Beeline ื•-Megafon.

ื”ืชืฆื•ืจื” ื”ื™ื ื›ื“ืœืงืžืŸ:

Juniper SRX240H ืžื•ืชืงืŸ ื‘ืœื™ื‘ื”
ื›ืชื•ื‘ืช ืžืงื•ืžื™ืช: 192.168.1.1/24
ื›ืชื•ื‘ืช ื—ื™ืฆื•ื ื™ืช: 1.1.1.1/30
GW: 1.1.1.2

ื ืงื•ื“ื” ืžืจื•ื—ืงืช

Mikrotik hEX S
ื›ืชื•ื‘ืช ืžืงื•ืžื™ืช: 192.168.152.1/24
ื›ืชื•ื‘ืช ื—ื™ืฆื•ื ื™ืช: ื“ื™ื ืžื™ืช

ืชืจืฉื™ื ืงื˜ืŸ ืฉื™ืขื–ื•ืจ ืœืš ืœื”ื‘ื™ืŸ ืื™ืš ื–ื” ืขื•ื‘ื“:

ื™ืฆื™ืจืช ืžื ื”ืจื” IPSec GRE ื‘ื™ืŸ Mikrotik hEX S ืœ-Juniper SRX ื‘ืืžืฆืขื•ืช ืžื•ื“ื USB

ืชืฆื•ืจืช Juniper SRX240:

ืžื”ื“ื•ืจืช ืชื•ื›ื ืช JUNOS [12.1X46-D82]

ืชืฆื•ืจืช ื’'ื•ื ื™ืคืจ

interfaces {
    ge-0/0/0 {
        description Internet-1;
        unit 0 {
            family inet {
                address 1.1.1.1/30;
            }
        }
    }
    gr-0/0/0 {
        unit 1 {
            description GRE-Tunnel;
            tunnel {
                source 172.31.152.2;
                destination 172.31.152.1;
            }
            family inet;    
    vlan {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
    st0 {
        unit 5 {
            description "Area - 192.168.152.0/24";
            family inet {
                mtu 1400;
            }
        }
routing-options {
    static {
        route 0.0.0.0/0 next-hop 1.1.1.2;
        route 192.168.152.0/24 next-hop gr-0/0/0.1;
        route 172.31.152.0/30 next-hop st0.5;
    }
    router-id 192.168.1.1;
}
security {
    ike {
        traceoptions {
            file vpn.log size 256k files 5;
            flag all;
        }
        policy ike-gretunnel {
            mode aggressive;
            description area-192.168.152.0;
            proposal-set standard;
            pre-shared-key ascii-text "mysecret"; ## SECRET-DATA
        }
        gateway gw-gretunnel {
            ike-policy ike-gretunnel;
            dynamic inet 172.31.152.1;
            external-interface ge-0/0/0.0;
            version v2-only;
        }
    ipsec {
        }
        policy vpn-policy0 {
            perfect-forward-secrecy {
                keys group2;
            }
            proposal-set standard;
        }
        vpn vpn-gretunnel {
            bind-interface st0.5;
            df-bit copy;
            vpn-monitor {
                optimized;
                source-interface st0.5;
                destination-ip 172.31.152.1;
            }
            ike {
                gateway gw-gretunnel;
                no-anti-replay;
                ipsec-policy vpn-policy0;
                install-interval 10;
            }
            establish-tunnels immediately;
        }
    }
    policies {  
        from-zone vpn to-zone vpn {
            policy st-vpn-vpn {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                    log {
                        session-init;   
                        session-close;
                    }
                    count;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy st-trust-to-vpn {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {                  
                    permit;
                    log {
                        session-init;
                        session-close;
                    }
                    count;
                }
            }
        }
        from-zone vpn to-zone trust {
            policy st-vpn-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                    log {
                        session-init;
                        session-close;
                    }
                    count;
                }
            }
        }
    zones {                             
        security-zone trust {
                vlan.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
        security-zone vpn {
            interfaces {
                st0.5 {
                    host-inbound-traffic {
                        protocols {
                            ospf;
                        }
                    }
                }
                gr-0/0/0.1 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;        
                        }
                    }
                }
        security-zone untrust {
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            ssh;
                            ike;
                        }
                    }
                }
            }
        }
vlans {                                 
    vlan-local {
        vlan-id 5;
        l3-interface vlan.1;
    }

ืชืฆื•ืจืช Mikrotik hEX S:

ื’ืจืกืช ืชื•ื›ื ืช RouterOS [6.44.3]

ืชืฆื•ืจืช ืžื™ืงืจื•ื˜ื™ืง

/ip address
add address=172.31.152.1/24 comment=GRE-Tunnel interface=gre-srx network=172.31.152.0
add address=192.168.152.1/24 comment=Local-Area interface=bridge network=192.168.152.0

/interface gre
add comment=GRE-Tunnel-SRX-HQ !keepalive local-address=172.31.152.1 name=gre-srx remote-address=172.31.152.2

/ip ipsec policy group
add name=srx-gre

/ip ipsec profile
add dh-group=modp1024 dpd-interval=10s name=profile1

/ip ipsec peer
add address=1.1.1.1/32 comment=GRE-SRX exchange-mode=aggressive local-address=172.31.152.1 name=peer2 profile=profile1

/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-128-cbc,3des
add enc-algorithms=aes-128-cbc,3des name=proposal1

/ip route
add distance=10 dst-address=192.168.0.0/16 gateway=gre-srx

/ip ipsec identity
add comment=IPSec-GRE my-id=address:172.31.152.1 peer=peer2 policy-template-group=srx-gre secret=mysecret

/ip ipsec policy
set 0 disabled=yes
add dst-address=0.0.0.0/0 proposal=proposal1 sa-dst-address=1.1.1.1 sa-src-address=172.31.152.1 src-address=172.31.152.0/30 tunnel=yes

/ip address
add address=172.31.152.1/24 comment=GRE-Tunnel interface=gre-srx network=172.31.152.0
add address=192.168.152.1/24 comment=Local-Area interface=bridge network=192.168.152.0

ืชื•ืฆืื”:
ืžื”ืฆื“ ืฉืœ ื’'ื•ื ื™ืคืจ SRX

netscreen@srx240> ping 192.168.152.1  
PING 192.168.152.1 (192.168.152.1): 56 data bytes
64 bytes from 192.168.152.1: icmp_seq=0 ttl=64 time=29.290 ms
64 bytes from 192.168.152.1: icmp_seq=1 ttl=64 time=28.126 ms
64 bytes from 192.168.152.1: icmp_seq=2 ttl=64 time=26.775 ms
64 bytes from 192.168.152.1: icmp_seq=3 ttl=64 time=25.401 ms
^C
--- 192.168.152.1 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 25.401/27.398/29.290/1.457 ms

ืžืžื™ืงืจื•ื˜ื™ืง

net[admin@GW-LTE-] > ping 192.168.1.1 
  SEQ HOST                                     SIZE TTL TIME  STATUS                                                                                                                                               
    0 192.168.1.1                                56  64 34ms 
    1 192.168.1.1                                56  64 40ms 
    2 192.168.1.1                                56  64 37ms 
    3 192.168.1.1                                56  64 40ms 
    4 192.168.1.1                                56  64 51ms 
    sent=5 received=5 packet-loss=0% min-rtt=34ms avg-rtt=40ms max-rtt=51ms 

ืžืžืฆืื™ื

ืœืื—ืจ ื”ืขื‘ื•ื“ื” ืงื™ื‘ืœื ื• ืžื ื”ืจืช VPN ื™ืฆื™ื‘ื”, ืžื”ืจืฉืช ื”ืžืจื•ื—ืงืช ื ื•ื›ืœ ืœื’ืฉืช ืœื›ืœ ื”ืจืฉืช ืฉื ืžืฆืืช ืžืื—ื•ืจื™ ื”ืขืจืขืจ, โ€‹โ€‹ื•ื‘ื”ืชืื, ื—ื–ืจื”.

ืื ื™ ืœื ืžืžืœื™ืฅ ืœื”ืฉืชืžืฉ ื‘- IKE2 ื‘ืกื›ื™ืžื” ื–ื•; ื ื•ืฆืจ ืžืฆื‘ ืฉืœืื—ืจ ืืชื—ื•ืœ ืžื›ืฉื™ืจ ืžืกื•ื™ื, IPSec ืœื ืขืœื”.

ืžืงื•ืจ: www.habr.com

ื”ื•ืกืคืช ืชื’ื•ื‘ื”