Just to let you all know. I got this working by creating individual units on the st0 interface and setting static routes accordingly. From what I have read it looks like to use multipoint you have to configure next-hop tunnels, which I did not want to do in this case. Now I'm seeing traffic going through the tunnels as expected.
The configuration change I made is below:
[edit]
Devin@SRX210-2# show routing-options
static {
route 50.0.0.0/16 next-hop 10.10.1.2;
route 60.0.0.0/16 next-hop 10.100.7.2;
route 0.0.0.0/0 next-hop 10.10.1.2;
route 40.0.1.0/24 next-hop st0.1;
route 40.0.2.0/24 next-hop st0.2;
route 40.0.3.0/24 next-hop st0.3;
route 40.0.4.0/24 next-hop st0.4;
route 40.0.5.0/24 next-hop st0.5;
route 40.0.6.0/24 next-hop st0.6;
route 40.0.7.0/24 next-hop st0.7;
route 40.0.8.0/24 next-hop st0.8;
route 40.0.9.0/24 next-hop st0.9;
route 40.0.10.0/24 next-hop st0.10;
}
autonomous-system 65000;
[edit]
Devin@SRX210-2# show interfaces st0
unit 1 {
family inet;
}
unit 2 {
family inet;
}
unit 3 {
family inet;
}
unit 4 {
family inet;
}
unit 5 {
family inet;
}
unit 6 {
family inet;
}
unit 7 {
family inet;
}
unit 8 {
family inet;
}
unit 9 {
family inet;
}
unit 10 {
family inet;
}
[edit]
Devin@SRX210-2# show security ike
proposal ike-phase1-proposal {
authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm md5;
encryption-algorithm aes-256-cbc;
}
policy ike-phase1-policy {
mode main;
proposals ike-phase1-proposal;
pre-shared-key ascii-text "$9$7FdwgGDkTz6oJz69A1INdb"; ## SECRET-DATA
}
gateway test1 {
ike-policy ike-phase1-policy;
address 50.0.0.1;
external-interface ge-0/0/1;
}
gateway test2 {
ike-policy ike-phase1-policy;
address 50.0.0.2;
external-interface ge-0/0/1;
}
gateway test3 {
ike-policy ike-phase1-policy;
address 50.0.0.3;
external-interface ge-0/0/1;
}
gateway test4 {
ike-policy ike-phase1-policy;
address 50.0.0.4;
external-interface ge-0/0/1;
}
gateway test5 {
ike-policy ike-phase1-policy;
address 50.0.0.5;
external-interface ge-0/0/1;
}
gateway test6 {
ike-policy ike-phase1-policy;
address 50.0.0.6;
external-interface ge-0/0/1;
}
gateway test7 {
ike-policy ike-phase1-policy;
address 50.0.0.7;
external-interface ge-0/0/1;
}
gateway test8 {
ike-policy ike-phase1-policy;
address 50.0.0.8;
external-interface ge-0/0/1;
}
gateway test9 {
ike-policy ike-phase1-policy;
address 50.0.0.9;
external-interface ge-0/0/1;
}
gateway test10 {
ike-policy ike-phase1-policy;
address 50.0.0.10;
external-interface ge-0/0/1;
}
[edit]
Devin@SRX210-2# show security ipsec
inactive: vpn-monitor-options {
interval 15;
threshold 15;
}
proposal ipsec-phase2-proposal {
protocol esp;
authentication-algorithm hmac-md5-96;
encryption-algorithm 3des-cbc;
}
policy ipsec-phase2-policy {
proposals ipsec-phase2-proposal;
}
vpn test1 {
bind-interface st0.1;
ike {
gateway test1;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test2 {
bind-interface st0.2;
ike {
gateway test2;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test3 {
bind-interface st0.3;
ike {
gateway test3;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test4 {
bind-interface st0.4;
ike {
gateway test4;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test5 {
bind-interface st0.5;
ike {
gateway test5;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test6 {
bind-interface st0.6;
ike {
gateway test6;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test7 {
bind-interface st0.7;
ike {
gateway test7;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test8 {
bind-interface st0.8;
ike {
gateway test8;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test9 {
bind-interface st0.9;
ike {
gateway test9;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
vpn test10 {
bind-interface st0.10;
ike {
gateway test10;
ipsec-policy ipsec-phase2-policy;
}
establish-tunnels immediately;
}
Devin Kennedy
