{"id":78,"date":"2019-08-26T08:21:45","date_gmt":"2019-08-26T01:21:45","guid":{"rendered":"http:\/\/geeksops.com\/?p=78"},"modified":"2019-08-27T09:40:53","modified_gmt":"2019-08-27T02:40:53","slug":"how-to-create-ipsec-between-gcp-to-juniper-srx","status":"publish","type":"post","link":"https:\/\/rotreein.com\/?p=78","title":{"rendered":"Site to Site VPN IPSec Between GCP and Juniper SRX"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>The following scenario IPSec Tunnel Between GCP Cloud VPN to Juniper SRX<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"654\" height=\"317\" src=\"https:\/\/geeksops.com\/wp-content\/uploads\/2019\/08\/gcp.jpg\" alt=\"\" class=\"wp-image-168\" srcset=\"https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/gcp.jpg 654w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/gcp-300x145.jpg 300w\" sizes=\"(max-width: 654px) 100vw, 654px\" \/><\/figure>\n\n\n\n<p><br><br><br><br>Create VPN Connections -&gt; Classic VPN<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"785\" height=\"712\" src=\"https:\/\/geeksops.com\/wp-content\/uploads\/2019\/08\/image-1.png\" alt=\"\" class=\"wp-image-99\" srcset=\"https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-1.png 785w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-1-300x272.png 300w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-1-768x697.png 768w\" sizes=\"(max-width: 785px) 100vw, 785px\" \/><\/figure>\n\n\n\n<p><br><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"681\" src=\"https:\/\/geeksops.com\/wp-content\/uploads\/2019\/08\/image-4-1024x681.png\" alt=\"\" class=\"wp-image-150\" srcset=\"https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-4-1024x681.png 1024w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-4-300x199.png 300w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-4-768x511.png 768w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-4.png 1026w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"743\" height=\"505\" src=\"https:\/\/geeksops.com\/wp-content\/uploads\/2019\/08\/image-5.png\" alt=\"\" class=\"wp-image-151\" srcset=\"https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-5.png 743w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-5-300x204.png 300w\" sizes=\"(max-width: 743px) 100vw, 743px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"774\" height=\"836\" src=\"https:\/\/geeksops.com\/wp-content\/uploads\/2019\/08\/image-7.png\" alt=\"\" class=\"wp-image-156\" srcset=\"https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-7.png 774w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-7-278x300.png 278w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-7-768x830.png 768w\" sizes=\"(max-width: 774px) 100vw, 774px\" \/><\/figure>\n\n\n\n<p><br><br>No need to configure parameter phase 1 &amp; phase 2, because cloud VPN auto-negotiates the connection as long as the peer side uses a supported IKE cipher setting. Check <a href=\"https:\/\/cloud.google.com\/vpn\/docs\/concepts\/supported-ike-ciphers\">documentation<\/a><\/p>\n\n\n\n<p><br>The following Juniper SRX Configuration<\/p>\n\n\n\n<p>Create interface:<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set interfaces st0 unit 0 family inet mtu 1460<\/p>\n\n\n\n<p>Configure security zone:<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security zones security-zone VPN-GCP interfaces st0.0<\/p>\n\n\n\n<p>Configure security policy:<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST match source-address any<br> set security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST match destination-address any<br> set security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST match application any<br> set security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST then permit<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security policies from-zone TRUST to-zone VPN-GCP policy TRUST-VPNGCP match source-address any<br>\nset security policies from-zone TRUST to-zone VPN-GCP policy TRUST-VPNGCP match destination-address any<br>\nset security policies from-zone TRUST to-zone VPN-GCP policy TRUST-VPNGCP match application any<br>\nset security policies from-zone TRUST to-zone VPN-GCP policy TRUST-VPNGCP then permit<\/p>\n\n\n\n<p>Configure IKE:<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security ike proposal IKE_PROPOSAL_GCP_TRIAL authentication-method pre-shared-keys<br>set security ike proposal IKE_PROPOSAL_GCP_TRIAL dh-group group2<br>set security ike proposal IKE_PROPOSAL_GCP_TRIAL authentication-algorithm sha1<br>set security ike proposal IKE_PROPOSAL_GCP_TRIAL encryption-algorithm aes-128-cbc<br>set security ike proposal IKE_PROPOSAL_GCP_TRIAL lifetime-seconds 3600<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security ike policy GCP-TRIAL-IPSEC-IKE mode main<br>set security ike policy GCP-TRIAL-IPSEC-IKE proposals IKE_PROPOSAL_GCP_TRIAL<br>set security ike policy GCP-TRIAL-IPSEC-IKE pre-shared-key ascii-text $9$t4OL0OIylMX7VCtyKMW-dik.Pfz0ORcyeAp87Vw4oJGDHmTn6AIEytu&#8221;<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security ike gateway GCP_TRIAL_IPSEC ike-policy GCP-TRIAL-IPSEC-IKE<br>set security ike gateway GCP_TRIAL_IPSEC address 35.234.42.X<br>set security ike gateway GCP_TRIAL_IPSEC local-identity inet 103.75.X.X<br>set security ike gateway GCP_TRIAL_IPSEC external-interface ge-0\/0\/0<br>set security ike gateway GCP_TRIAL_IPSEC local-address 103.75.X.X<br>set security ike gateway GCP_TRIAL_IPSEC version v2-only<\/p>\n\n\n\n<p>Configure IPSec:<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security ipsec proposal IPSEC_GCP_TRIAL protocol esp<br>set security ipsec proposal IPSEC_GCP_TRIAL authentication-algorithm hmac-sha1-96<br>set security ipsec proposal IPSEC_GCP_TRIAL encryption-algorithm aes-128-cbc<br>set security ipsec proposal IPSEC_GCP_TRIAL lifetime-seconds 3600<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST match source-address any<br>\nset security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST match destination-address any<br>\nset security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST match application any<br>\nset security policies from-zone VPN-GCP to-zone TRUST policy VPNGCP-TRUST then permit<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set security ipsec vpn VPN_GCP_TRIAL_IPSEC bind-interface st0.0<br>set security ipsec vpn VPN_GCP_TRIAL_IPSEC ike gateway GCP_TRIAL_IPSEC<br>set security ipsec vpn VPN_GCP_TRIAL_IPSEC ike proxy-identity local 192.168.38.0\/24<br>set security ipsec vpn VPN_GCP_TRIAL_IPSEC ike proxy-identity remote 10.140.0.0\/20<br>set security ipsec vpn VPN_GCP_TRIAL_IPSEC ike ipsec-policy IPSEC_POLICY_GCP_TRIAL<br>set security ipsec vpn VPN_GCP_TRIAL_IPSEC establish-tunnels immediately<\/p>\n\n\n\n<p>Configure static route:<\/p>\n\n\n\n<p class=\"has-background has-small-font-size has-very-light-gray-background-color\">set routing-options static route 10.140.0.0\/20 next-hop st0.0<\/p>\n\n\n\n<p><br>We can verify site to site connection between GCP to On-prem ( Juniper SRX )<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"674\" height=\"666\" src=\"https:\/\/geeksops.com\/wp-content\/uploads\/2019\/08\/image-12.png\" alt=\"\" class=\"wp-image-196\" srcset=\"https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-12.png 674w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-12-300x296.png 300w\" sizes=\"(max-width: 674px) 100vw, 674px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"525\" src=\"https:\/\/geeksops.com\/wp-content\/uploads\/2019\/08\/image-10-1024x525.png\" alt=\"\" class=\"wp-image-191\" srcset=\"https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-10-1024x525.png 1024w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-10-300x154.png 300w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-10-768x394.png 768w, https:\/\/rotreein.com\/wp-content\/uploads\/2019\/08\/image-10.png 1154w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The following scenario IPSec Tunnel Between GCP Cloud VPN to Juniper SRX Create VPN Connections -&gt; Classic VPN No need to configure parameter phase 1 &amp; phase 2, because cloud VPN auto-negotiates the connection as long as the peer side uses a supported IKE cipher setting. Check documentation The following Juniper SRX Configuration Create interface:&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/rotreein.com\/index.php?rest_route=\/wp\/v2\/posts\/78"}],"collection":[{"href":"https:\/\/rotreein.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rotreein.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rotreein.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rotreein.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=78"}],"version-history":[{"count":29,"href":"https:\/\/rotreein.com\/index.php?rest_route=\/wp\/v2\/posts\/78\/revisions"}],"predecessor-version":[{"id":225,"href":"https:\/\/rotreein.com\/index.php?rest_route=\/wp\/v2\/posts\/78\/revisions\/225"}],"wp:attachment":[{"href":"https:\/\/rotreein.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rotreein.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rotreein.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}