CloudLabBox
Try the free demo

Multi-vendor troubleshooting lab 6 of 12

IPsec quick fixes across vendors

Larkfield's head office has three branch tunnels, on Juniper, FortiGate and MikroTik, and none of them passes traffic. Work through the faults engineers meet most often between vendors: selectors, host-inbound traffic, a tunnel with no policy, default proposals, and NAT getting there before IPsec does.

Run this lab

It needs Standard: its 9 nodes are set to 10 vCPU and 9,472 MB in total.

In your workspace: Shared, then Multi-vendor interoperability and troubleshooting guided labs, then 06 - IPsec quick fixes across vendors

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 9,472 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
10 vCPU, 9,472 MB
Smallest plan
Standard

The scenario

Larkfield's security team has re-keyed head office's three branch tunnels after an audit, and none of them works. This isn't a build: every tunnel existed before, and the settings below are agreed with the branches. Each fault is one you'll meet on real tickets, and each shows up differently on each vendor. For a longer look at each pairing, see the Firewalls and VPNs multi-vendor course.

SiteDevicePublic addressLANPC
HQHQ (IOS)203.0.113.210.1.0.0/24HQ-PC 10.1.0.10
HullSRX-HULL (vSRX)198.51.100.210.2.0.0/24HULL-PC 10.2.0.10
YorkFGT-YORK (FortiGate)192.0.2.210.3.0.0/24YORK-PC 10.3.0.10
GooleCHR-GOOLE (RouterOS)198.18.0.210.4.0.0/24GOOLE-PC 10.4.0.10
TunnelType at HQIKEv2ESPKey
HullVTI Tunnel1, 169.254.10.0/30AES-256, SHA-256, group 20AES-256, SHA-256Larkfield-Hull-27
YorkVTI Tunnel2, 169.254.20.0/30DES, SHA-256, group 14DES, SHA-256Larkfield-York-27
GooleCrypto map, 10.1.0.0/24 to 10.4.0.0/24AES-256, SHA-256, group 19AES-256, SHA-256Larkfield-Goole-27

Evaluation licence. The FortiGate runs with low-strength encryption only, so its IPsec offers DES and nothing stronger. That is a limit of this image, not a recommendation: production tunnels use AES-256-GCM with DH 19, 20 or 21.

What you’ll practise

  • Read IKE and IPsec state on IOS, Junos, FortiOS and RouterOS
  • Tell an IKE failure from a CHILD SA failure
  • Fix a traffic-selector mismatch between a route-based and a policy-style peer
  • Allow IKE to a vSRX, and explain host-inbound traffic
  • Explain why a FortiGate tunnel with no firewall policy never negotiates
  • Exempt VPN traffic from NAT on IOS and on RouterOS
  • Read ESP counters to find an SA that is up but fails its integrity checks

The tasks

  1. Prepare the Linux hosts
  2. Which phase failed?
  3. Hull, nothing answers
  4. Hull, no CHILD SA
  5. York, a tunnel nobody uses
  6. Goole, defaults at the far end
  7. Goole, NAT got there first
  8. Goole, up at both ends and still nothing

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IPsec quick fixes across vendors9 nodes, 8 links. Every link is listed as text below the diagram.ISPHQSRX-HULLFGT-YORKCHR-GOOLEHQ-PCHULL-PCYORK-PCGOOLE-PCether2eth0Gi0/1eth0ge-0/0/1eth0port2eth0Gi0/0Gi0/0Gi0/1ge-0/0/0Gi0/2port1Gi0/3ether1
9 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HQ Gi0/0
  • ISP Gi0/1 to SRX-HULL ge-0/0/0
  • ISP Gi0/2 to FGT-YORK port1
  • ISP Gi0/3 to CHR-GOOLE ether1
  • HQ Gi0/1 to HQ-PC eth0
  • SRX-HULL ge-0/0/1 to HULL-PC eth0
  • FGT-YORK port2 to YORK-PC eth0
  • CHR-GOOLE ether2 to GOOLE-PC eth0
Nodes in IPsec quick fixes across vendors, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRX-HULLJuniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
FGT-YORKFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
CHR-GOOLEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
HULL-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
YORK-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
GOOLE-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Multi-vendor interoperability and troubleshooting guided labs.

  3. Open 06 - IPsec quick fixes across vendors and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Multi-vendor troubleshooting labs

All Multi-vendor troubleshooting labs

Related labs in other courses

CloudLabBox is independent of Arista Networks, Cisco, CompTIA, Fortinet, HPE, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.