SRX

last person joined: yesterday 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  OSPF of IPSEC between vSRX and SRX

     
    Posted 03-15-2016 06:03

    Trying my best to get ospf up between SRX and cloud vSRX. Below my config

     

    vSRX:

     

    set interfaces st0 unit 2 multipoint
    set interfaces st0 unit 2 family inet mtu 1500
    set interfaces st0 unit 2 family inet address 192.168.50.1/24


    set security zones security-zone VPN interfaces st0.2 host-inbound-traffic system-services all

     

    set security flow tcp-mss ipsec-vpn mss 1350

     

    set protocols ospf area 0.0.0.0 interface st0.2 interface-type p2mp
    set protocols ospf area 0.0.0.0 interface st0.2 hello-interval 10
    set protocols ospf area 0.0.0.0 interface st0.2 dead-interval 10
    set protocols ospf area 0.0.0.0 interface st0.2 neighbor 192.168.50.2

     

    PING 192.168.50.2 (192.168.50.2): 56 data bytes
    64 bytes from 192.168.50.2: icmp_seq=0 ttl=64 time=33.843 ms
    64 bytes from 192.168.50.2: icmp_seq=1 ttl=64 time=30.103 ms

     

    SRX:

     

    set interfaces st0 unit 2 multipoint
    set interfaces st0 unit 2 family inet mtu 1500
    set interfaces st0 unit 2 family inet address 192.168.50.2/24

     

    set security zones security-zone VPN interfaces st0.2 host-inbound-traffic system-services all

     

    set security flow tcp-mss ipsec-vpn mss 1350

     

    set protocols ospf area 0.0.0.0 interface st0.2 interface-type p2mp
    set protocols ospf area 0.0.0.0 interface st0.2 hello-interval 10
    set protocols ospf area 0.0.0.0 interface st0.2 dead-interval 10
    set protocols ospf area 0.0.0.0 interface st0.2 neighbor 192.168.50.1

     

    run ping 192.168.50.1
    PING 192.168.50.1 (192.168.50.1): 56 data bytes
    64 bytes from 192.168.50.1: icmp_seq=0 ttl=64 time=29.472 ms
    64 bytes from 192.168.50.1: icmp_seq=1 ttl=64 time=35.694 ms

     

    IPSEC tunnel is up as you can see i can ping between the ST interfaces. There is not static routing added over the tunnnel intefaces.

     

    run show ospf neighbor
    Address Interface State ID Pri Dead
    192.168.50.1 st0.2 Down 0.0.0.0 0 0

     

     

     

     

     

     



  • 2.  RE: OSPF of IPSEC between vSRX and SRX
    Best Answer

    Posted 03-15-2016 07:41
    ospf is a protocol, not a sys services: so this line:
    set security zones security-zone VPN interfaces st0.2 host-inbound-traffic system-services all
    is not enough. You also need set security zones security-zone VPN interfaces st0.2 host-inbound-traffic protocols all.


  • 3.  RE: OSPF of IPSEC between vSRX and SRX

     
    Posted 03-15-2016 11:27

    Balls you right.Most probably the issue. Will let you know the outcome.