CloudLabBox
Try the free demo

Firewalls and VPNs lab 2 of 16

IOS VTI to a vSRX st0 interface with OSPF over the tunnel

Build a route-based IKEv2 tunnel between a Cisco IOS router and a Juniper vSRX, bind it to st0 in its own security zone, run OSPF across it, and learn the SRX pieces an IOS engineer forgets: zones, host-inbound traffic, policies and the tunnel MTU.

Run this lab

It needs Lite: its 5 nodes are set to 6 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 02 - IOS VTI to a vSRX st0 interface with OSPF over the tunnel

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 90 minutes
Nodes need
6 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Brightwater Labs runs Cisco at head office. Its new branch came with a Juniper SRX (here a vSRX), already set up for internet access with source NAT. Join the branch to HQ with a route-based IKEv2 tunnel and run OSPF across it, so new subnets at either end are learned automatically.

DeviceInterfaceAddressNotes
ISPGi0/0 / Gi0/1203.0.113.1/30 / 198.51.100.1/30
HQGi0/0 / Gi0/1203.0.113.2/30 / 10.1.0.1/24Default route to the ISP
HQTunnel0172.16.12.1/30VTI to the SRX (you create it)
HQ-PCGi0/010.1.0.10/24
SRX-BRge-0/0/0 (zone untrust)198.51.100.2/30Default route to the ISP
SRX-BRge-0/0/1 (zone trust)10.2.0.1/24Source NAT trust to untrust
SRX-BRst0.0 (zone vpn)172.16.12.2/30You create it
BR-PCGi0/010.2.0.10/24
SettingValue
IKE SAIKEv2, AES-256-CBC, SHA-256, DH group 20, 28,800 s, key Brightwater-27
IPsec SAESP AES-256-CBC with HMAC-SHA-256-128, PFS group 20, 3,600 s
RoutingOSPF area 0 on the tunnel and both LANs (LANs passive)

What you’ll practise

  • Configure SRX IKE and IPsec proposals, policies, a gateway and a route-based VPN bound to st0
  • Place st0 in a security zone and allow IKE and OSPF as host-inbound traffic
  • Write SRX security policies between the trust and VPN zones
  • Match the SRX with an IOS IKEv2 VTI
  • Run OSPF over the tunnel and fix an MTU mismatch between vendors
  • Verify on both vendors: show security ike security-associations, show security ipsec security-associations, show crypto ikev2 sa, show ospf neighbor

The tasks

  1. Check the underlay
  2. IKE and IPsec on the SRX
  3. Zones, host-inbound traffic and policies
  4. The IOS end
  5. OSPF over the tunnel

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IOS VTI to a vSRX st0 interface with OSPF over the tunnel5 nodes, 4 links. Every link is listed as text below the diagram.ISPHQHQ-PCSRX-BRBR-PCGi0/1Gi0/0ge-0/0/1Gi0/0Gi0/0Gi0/0Gi0/1ge-0/0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HQ Gi0/0
  • ISP Gi0/1 to SRX-BR ge-0/0/0
  • HQ Gi0/1 to HQ-PC Gi0/0
  • SRX-BR ge-0/0/1 to BR-PC Gi0/0
Nodes in IOS VTI to a vSRX st0 interface with OSPF over the tunnel, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQ-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRX-BRJuniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
BR-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 02 - IOS VTI to a vSRX st0 interface with OSPF over the tunnel and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.