I have to setup IPSec with the following information with a remote router cisco ,
Given information from Cisco managed router support team,
IKE Phase 1 Proposal
IKE Version IKE V1
Encryption Algorithm Aes-256
Hash Algorithm SHA
Lifetime 86400 (seconds)
DH Group DH Group 2
IKE Phase 2 (IPSEC) Proposal
Mode IKE V1 Tunnel
ESP Encryption aes-256
ESP Hash Algorithm sha
AH Hash Algorithm
Perfect Forward Secrecy Disabled
Lifetime 28800 (seconds)
Have to use loopback interface to NAT,
interface Loopback1 - ip address 172.29.140.36 255.255.255.255
I setup all in juniper as below,
root@kt-srx110-fw# show security ike
traceoptions {
file iked;
flag all;
}
proposal ike-prop-1 {
authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm sha1;
encryption-algorithm aes-256-cbc;
lifetime-seconds 86400;
}
policy ike-policy-1 {
mode main;
proposals ike-prop-1;
pre-shared-key ascii-text "$9$Tz94JikP5Q6Ct"; ## SECRET-DATA
}
gateway ike-gw-1 {
ike-policy ike-policy-1;
address 202.4.ab.xy;
external-interface pp0.0;
}
root@kt-srx110-fw# show security ipsec
proposal ipsec-prop-1 {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm aes-256-cbc;
lifetime-seconds 28800;
}
policy ipsec-policy-1 {
proposals ipsec-prop-1;
}
vpn security-vpn-1 {
bind-interface st0.0;
vpn-monitor;
ike {
gateway ike-gw-1;
ipsec-policy ipsec-policy-1;
}
establish-tunnels immediately;
}
[Aug 19 21:06:58]---------> Received from 202.4.ab.xy:500 to 118.82.ab.xy:0, VR 0, length 304 on IF
[Aug 19 21:06:58]ike_sa_find: Found SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31 }
[Aug 19 21:06:58]ikev2_packet_v1_start: Passing IKE v1.0 packet to IKEv1 library
[Aug 19 21:06:58]ike_get_sa: Start, SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31 } / 00000000, remote = 202.4.ab.xy:500
[Aug 19 21:06:58]ike_sa_find: Found SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31 }
[Aug 19 21:06:58]ike_st_i_nonce: Start, nonce[0..20] = 90295556 ac81bf82 ...
[Aug 19 21:06:58]ike_st_i_ke: Ke[0..128] = 6f1c714c bb7d878b ...
[Aug 19 21:06:58]ike_st_i_cr: Start
[Aug 19 21:06:58]ike_st_i_cert: Start
[Aug 19 21:06:58]ike_st_i_vid: VID[0..16] = 12f5f28c 457168a9 ...
[Aug 19 21:06:58]ike_st_i_vid: VID[0..8] = 09002689 dfd6b712 ...
[Aug 19 21:06:58]ike_st_i_vid: VID[0..16] = 43f0cdcf a8330a31 ...
[Aug 19 21:06:58]ike_st_i_vid: VID[0..16] = 1f07f70e aa6514d3 ...
[Aug 19 21:06:58]ike_st_i_private: Start
[Aug 19 21:06:58]ike_st_o_id: Start
[Aug 19 21:06:58]ike_st_o_hash: Start
[Aug 19 21:06:58]ike_find_pre_shared_key: Find pre shared key key for 118.82.ab.xy:500, id = ipv4(any:0,[0..3]=118.82.ab.xy) -> 202.4.ab.xy:500, id = No Id
[Aug 19 21:06:58]ike_policy_reply_find_pre_shared_key: Start
[Aug 19 21:06:58]ike_calc_mac: Start, initiator = true, local = true
[Aug 19 21:06:58]ike_st_o_status_n: Start
[Aug 19 21:06:58]ike_st_o_private: Start
[Aug 19 21:06:58]ike_policy_reply_private_payload_out: Start
[Aug 19 21:06:58]ike_st_o_encrypt: Marking encryption for packet
[Aug 19 21:06:58]ike_send_packet: <-------- sending SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31}, len = 92, nego = -1, local ip= 118.82.ab.xy, dst = 202.4.ab.xy:500, routing table id = 0
[Aug 19 21:06:58]---------> Received from 202.4.ab.xy:500 to 118.82.ab.xy:0, VR 0, length 92 on IF
[Aug 19 21:06:58]ike_sa_find: Found SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31 }
[Aug 19 21:06:58]ikev2_packet_v1_start: Passing IKE v1.0 packet to IKEv1 library
[Aug 19 21:06:58]ike_get_sa: Start, SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31 } / 00000000, remote = 202.4.ab.xy:500
[Aug 19 21:06:58]ike_sa_find: Found SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31 }
[Aug 19 21:06:58]ike_st_i_encrypt: Check that packet was encrypted succeeded
[Aug 19 21:06:58]ike_st_i_id: Start
[Aug 19 21:06:58]ike_st_i_hash: Start, hash[0..20] = 302d7b57 6375ac4c ...
[Aug 19 21:06:58]ike_calc_mac: Start, initiator = true, local = false
[Aug 19 21:06:58]ike_st_i_cert: Start
[Aug 19 21:06:58]ike_st_i_vid: VID[0..16] = afcad713 68a1f1c9 ...
[Aug 19 21:06:58]ike_st_i_private: Start
[Aug 19 21:06:58]ike_st_o_wait_done: Marking for waiting for done
[Aug 19 21:06:58]ike_st_o_all_done: MESSAGE: Phase 1 { 0x5b9762ae fbe3f338 - 0xb6376ad2 a8320a31 } / 00000000, version = 1.0, xchg = Identity protect, auth_method = Pre shared keys, Initiator, cipher = aes-cbc, hash = sha1, prf = hmac-sha1,
[Aug 19 21:06:58]118.82.ab.xy:500 (Initiator) <-> 202.4.ab.xy:500 { 5b9762ae fbe3f338 - b6376ad2 a8320a31 [-1] / 0x00000000 } IP; MESSAGE: Phase 1 version = 1.0, auth_method = Pre shared keys, cipher = aes-cbc, hash = sha1, prf = hmac-sha1
[Aug 19 21:06:58]ike_send_notify: Connected, SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31}, nego = -1
[Aug 19 21:06:58]iked_pm_ike_sa_done: local:118.82.ab.xy, remote:202.4.ab.xy IKEv1
[Aug 19 21:06:58]IKE negotiation done for local:118.82.ab.xy, remote:202.4.ab.xy IKEv1 with status: Error ok
[Aug 19 21:06:58]ssh_ike_connect_ipsec: Start, remote_name = :500, flags = 00000000
[Aug 19 21:06:58]ssh_ike_connect_ipsec: SA = { 5b9762ae fbe3f338 - b6376ad2 a8320a31}, nego = 0
[Aug 19 21:06:58]ike_st_o_qm_hash_1: Start
[Aug 19 21:06:58]ike_st_o_qm_sa_proposals: Start
[Aug 19 21:06:58]ike_st_o_qm_nonce: Start
[Aug 19 21:06:58]ike_policy_reply_qm_nonce_data_len: Start
[Aug 19 21:06:58]ike_st_o_qm_optional_ke: Start
[Aug 19 21:06:58]ike_st_o_qm_optional_ids: Start
[Aug 19 21:06:58]ike_st_qm_optional_id: Start
[Aug 19 21:06:58]ike_st_qm_optional_id: Start
[Aug 19 21:06:58]ike_st_o_private: Start
waiting for your suggestion to bring the tunnel up.