How to config ike gateway external-interface with multiple IP

[kebson]

Hi,

I am configuring  4 IPsec tunnels st0.1, st0.2, st0.3, st0.3. all the tunnel are using different public IP.

I have difined a loopback interface lo0.1 where I put the 4 public IP for each tennel:

lo0.1 family inet address "IP_1"

lo0.1 family inet address "IP_2"

lo0.1 family inet address "IP_3"

lo0.1 family inet address "IP_4"

The tunnel interfaces are unnumbered..

the ike gateway  external-interface is pointing the lo0.1.

Question: how to make the ike gateway external-interface to choice lo0.1 "IP_1" for st0.1, lo0.1 "IP_2" for st0.2,....

Configuration:

set interfaces lo0 unit 1 family inet address IP_1
set interfaces lo0 unit 1 family inet address IP_2
set interfaces lo0 unit 1 family inet address IP_3
set interfaces lo0 unit 1 family inet address IP_4

set security ike gateway tunnel_1 address 1.1.1.1
set security ike gateway tunnel_1 external-interface lo0.1 
set security ike gateway tunnel_2 address 2.2.2.2
set security ike gateway tunnel_2 external-interface lo0.1
set security ike gateway tunnel_3 address 3.3.3.3
set security ike gateway tunnel_3 external-interface lo0.1
set security ike gateway tunnel_4 address 4.4.4.4
set security ike gateway tunnel_4 external-interface lo0.1

[JunOS_Fan]

Hi,

As per the following KB, If we terminate IPSec VPN on an interface with multiple IP addresses,the tunnel will not come up, as it is something that is not supported.

KB19475

Though, there is a hidden option to make this work .

[Visitor]

Hi ,

You can use the following command to tell the device which ip-address to use for vpn negotiation

#set security ike gateway tunnel_1 local-address IP_1

This is a hidden command .

Hope this helps.
 
Regards,
Visitor
-------------------------------------------------------------------------------------------------------
If this post was helpful, please mark this post as an "Accepted Solution".Kudos are always appreciated

[Screenie]

Let's start a thread to list all hidden commands!

[Visitor]

Sure Screenie

Regards,

Visitor

--------------------------------------------------​--------------------------------------------------​---

If this post was helpful, please mark this post as an "Accepted Solution".Kudos are always appreciated