Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - IP SERVICES CONFIGURATION GUIDE 2010-10-01 Configuration Manual page 183

Copyright © 2010, Juniper Networks, Inc.
erx2(config-manual-key)#key customerASecret
erx2(config-manual-key)#exit
erx2(config)#ipsec key manual pre-share 5.1.0.2
erx2(config-manual-key)#key customerBSecret
erx2(config-manual-key)#exit
erx2(config)#ipsec key manual pre-share 5.3.0.2
erx2(config-manual-key)#key customerBSecret
erx2(config-manual-key)#exit
erx3(config)#ipsec key manual pre-share 5.1.0.1
erx3(config-manual-key)#key customerASecret
erx3(config-manual-key)#exit
erx3(config)#ipsec key manual pre-share 5.2.0.1
erx3(config-manual-key)#key customerASecret
erx3(config-manual-key)#exit
erx3(config)#ipsec key manual pre-share 5.1.0.2
erx3(config-manual-key)#key customerBSecret
erx3(config-manual-key)#exit
erx3(config)#ipsec key manual pre-share 5.2.0.2
erx3(config-manual-key)#key customerBSecret
erx3(config-manual-key)#exit
On erx1, create two IPSec tunnels, one to carry customer A's traffic and another to
3.
carry customer B's traffic. You must create each pair of tunnels in the virtual routers
where the IP interfaces reaching those customers are defined. Create the endpoints
for the tunnels in the ISP default virtual router.
Virtual router A:
erx1(config)#virtual-router vrA
erx1:vrA(config)#
Tunnel from Ottawa to Boston on virtual router A:
erx1:vrA(config)#interface tunnel ipsec:Aottawa2boston transport-virtual-router
default
erx1:vrA(config-if)#tunnel transform-set customerAprotection
erx1:vrA(config-if)#tunnel local-identity subnet 10.1.0.0 255.255.0.0
erx1:vrA(config-if)#tunnel peer-identity subnet 10.3.0.0 255.255.0.0
erx1:vrA(config-if)#tunnel source 5.1.0.1
erx1:vrA(config-if)#tunnel destination 5.3.0.1
erx1:vrA(config-if)#ip address 10.3.0.0 255.255.0.0
erx1:vrA(config-if)#exit
Tunnel from Ottawa to Boca on virtual router A:
erx1:vrA(config)#interface tunnel ipsec:Aottawa2boca transport-virtual-router default
erx1:vrA(config-if)#tunnel transform-set customerAprotection
erx1:vrA(config-if)#tunnel local-identity subnet 10.1.0.0 255.255.0.0
erx1:vrA(config-if)#tunnel peer-identity subnet 10.2.0.0 255.255.0.0
erx1:vrA(config-if)#tunnel source 5.1.0.1
erx1:vrA(config-if)#tunnel destination 5.2.0.1
erx1:vrA(config-if)#ip address 10.2.0.0 255.255.0.0
erx1:vrA(config-if)#exit
Virtual router B:
erx1(config)#virtual-router vrB
erx1:vrB(config)#
Chapter 5: Configuring IPSec
157