I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Advanced IPsec VPNs

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Advanced IPsec VPNs

Advanced IPsec on the SRX means route-based tunnels, IKEv2, and hub-and-spoke designs that must survive peer failures. The exam pushes on why Phase 2 fails when Phase 1 is up, and on ADVPN shortcut behaviour.

Core rules

  • Route-based VPN: bind the IPsec VPN to an st0 unit (set security ipsec vpn v1 bind-interface st0.0), zone st0.0, route the remote subnet to it, and permit traffic between the tunnel zone and the LAN zone. Policy-based VPNs bind to a gateway and scale poorly.
  • Phase 1 uses an ike policy (authentication, encryption, DH group) and an ike gateway (addresses, identities, version); Phase 2 uses an ipsec policy (proposals plus PFS group). Any mismatch in proposal or PFS leaves show security ike sa up while show security ipsec sa stays empty.
  • establish-tunnels immediately brings a tunnel up without traffic; the default is on-traffic, which breaks designs relying on tunnel monitoring.
  • DPD detects dead peers; vpn-monitor can withdraw routes or trigger failover when the peer stops responding.
  • IKEv2 negotiates traffic selectors; when an IKEv1 gateway must serve several subnets, multi-proxy-id lets the gateway carry multiple proxy-ID pairs.
  • ADVPN: spokes build tunnels to a hub; the hub runs Next-Hop Tunnel Binding so it can send a shortcut suggestion, after which spokes establish a direct tunnel for spoke-to-spoke traffic. It requires dynamic routing over the tunnels and NHTB on the hub.

Worked example

Spoke-1 sends traffic to Spoke-2's LAN. Its default route points into the hub tunnel, so packets reach the hub, which recognises the destination as another spoke and, with NHTB, sends a redirect suggestion. Spoke-1 establishes a new IKE/IPsec SA directly to Spoke-2 and installs a route via that tunnel, so later packets bypass the hub. Verify with show security ike sa, show security ipsec sa, and show route for the new next hop.

Traps

  • PFS mismatch: Phase 1 green, Phase 2 dead.
  • No route for the remote subnet pointing at st0.
  • Policy written between the wrong zones; the tunnel zone must be the from/to zone.
  • MTU black holes - set tcp-mss ipsec-vpn mss 1350.
  • Expecting ADVPN shortcuts without NHTB and a dynamic routing protocol.