You may want to customize it as you need. Only one traffic selector is needed in this case:ĭue to the traffic forwarding ideology of F5 BIG-IP (basically, it does not forward anything unless configured), we also need a forwarding virtual server for the tunneled traffic to work through BIG-IP: The final IPsec-related configuration is the traffic selector. 1440 minutes = 86400 seconds.Īgain, the time-based lifetime is entered in minutes, not in seconds.

Lifetime: This is minutes, not seconds.

See for example Internet Key Exchange (IKE) Attributes from IANA for the full list of DH groups.

Perfect Forward Secrecy: F5 uses the MODP syntax for specifying the DH groups.

Some specific comments about these configurations: Now let’s continue with the F5 BIG-IP on Site 2.

So this is just a basic routing configuration. This static route directs it to the BIG-IP for IPsec encapsulation. Why is this needed? Because the traffic coming from 172.17.73.0/24 and going to 172.31.31.0/24 would otherwise be routed to the Internet (via the default route) on SRX240. It is not participating in the IPsec tunnel (other than allowing IKE+ESP through) but a static route is needed on it for the routing to work in Site 2: set routing-options static route 172.31.31.0/24 next-hop 198.51.100.10 In the second site there is SRX240 as a firewall. This IPsec configuration uses traffic selectors as described in my earlier post. Set security ipsec vpn F5 establish-tunnels immediately Set security ipsec vpn F5 traffic-selector TS_1 remote-ip 172.17.73.0/24 Set security ipsec vpn F5 traffic-selector TS_1 local-ip 172.31.31.0/24 Set security ipsec vpn F5 ike ipsec-policy VPN_POLICY_F5 Set security ipsec vpn F5 ike gateway GW_F5 Set security ipsec vpn F5 bind-interface st0.2 Set security ipsec policy VPN_POLICY_F5 proposals F5 Set security ipsec policy VPN_POLICY_F5 perfect-forward-secrecy keys group14 Set security ipsec proposal F5 lifetime-seconds 3600 Set security ipsec proposal F5 encryption-algorithm aes-256-cbc Set security ipsec proposal F5 authentication-algorithm hmac-sha1-96

Set security ipsec proposal F5 protocol esp Set security ike gateway GW_F5 external-interface fe-0/0/2.0 Set security ike gateway GW_F5 no-nat-traversal Set security ike gateway GW_F5 address 198.51.100.10 Set security ike gateway GW_F5 ike-policy F5_TEST Set security ike policy F5_TEST pre-shared-key ascii-text ThisIsSecret Set security ike policy F5_TEST proposals IKE_SHA256_AES256_DH14 Set security ike policy F5_TEST mode main

Set security ike proposal IKE_SHA256_AES256_DH14 lifetime-seconds 86400 Set security ike proposal IKE_SHA256_AES256_DH14 encryption-algorithm aes-256-cbc Set security ike proposal IKE_SHA256_AES256_DH14 authentication-algorithm sha-256 Set security ike proposal IKE_SHA256_AES256_DH14 dh-group group14 Set security ike proposal IKE_SHA256_AES256_DH14 authentication-method pre-shared-keys Let’s first complete the SRX210 configuration on Site 1: set interfaces st0 unit 2 description 'IPsec tunnel to F5' F5 BIG-IP uses SRX240 as the default route next hop. The public IP address of the F5 BIG-IP (198.51.100.10) is routed normally in the SRX240, there is no NAT for that connectivity. It is just a firewall and a router in the site LAN. The SRX240 is not “an interesting device” in this demonstration. In the diagram below the IPsec tunnel is configured between SRX210 (Junos 12.1X47-D20.7) and F5 BIG-IP (11.6.0 HF5-ENG11).į5 BIG-IP is connected here in one-arm setup. This post is an example of configuring an IPsec tunnel with F5 BIG-IP.

Juniper vpn monitor nat traversal