Discussion

Next, define a rule for the IKE SA. This recipe creates the rule named ike-rule. The
rule in this recipe has two set term commands that are similar in syntax to a policy or
firewall then statement. The first command sends matching packets to the remote
end point of the IPSec tunnel (here, 10.0.15.2), and the second command associates
the IKE policy with the SA so that matching packets can be sent across the IPSec tunnel.
The final command in the IKE SA rule, set match-direction, specifies a match
direction for marking which traffic to encrypt or decrypt. This statement is a bit confusing
in the IPSec configuration because all IKE-enabled IPSec VPNs are bidirectional
by default. However, you need to issue either this command or the set matchdirection
command. The IKE SA rule is effectively a firewall filter, directing traffic
into and out of the IPSec tunnel, so you don’t need to configure a separate firewall
filter as you do when configuring the ES PIC.
Next, configure IPSec. You do this by creating a service set that defines IPSec-specific
information. (You can configure multiple services on a single AS PIC, each in its own
service set.) The service set in this recipe is called ipsec-dynamic. The first command
associates the IKE SA rule with IPSec, and the second command defines the address
of the local end of the IPSec security tunnel. The last two commands configure the
logical interfaces that participate in the IPSec services. The set next-hop-service
inside-service-interface command configures the inward-facing interfaces, and the
set next-hop-service outside-service-interface command configures the interface
that faces the remote IPSec site. You configure these interfaces at the [edit
interfaces] level. The final part of the IPSec configuration is to define an IPSec proposal
and policy. This recipe uses the default values (see Table 3-1), so no configuration
commands are required.
For IPSec to work, you need to configure the interfaces on the AS PIC, which are services
(sp-) interfaces. For J-series routers, configure the sp-0/0/0 interface. You also
configure the physical interface that carries the IPSec tunnel.
For the services interface, you configure logical interfaces. Each service interface has
three logical interfaces. The first, unit 0, has no special configuration. You just set it
to support IPv4 traffic (family inet). The other two logical interfaces handle the
IPSec traffic. The first one, unit 1 in this recipe, is for inward-facing traffic (servicedomain
inside); it is the logical interface you include in the set next-hop-service
inside-service-interface command. The second logical interface, unit 2, is for
outward-facing traffic; it is the one you include in the service outside-serviceinterface
command.
This recipe uses the so-0/0/1 interface to carry the IPSec tunnel.
To direct traffic from the local domain into the IPSec tunnel, include the services
interface when configuring the IGP. This recipe uses OSPF and adds the services
interface with the set interface sp-1/2/1 command.
118 | Chapter 3: IPSec
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.