Настройка Juniper SRX

1. Создаём Secure Tunnel interface st0.7, и назначаем ему адрес.
   

   set interfaces st0 unit 7 description "To ciscoloc Tunnel"
   set interfaces st0 unit 7 family inet address 10.2.252.5/30

2. Создаём ike policy

   set security ike policy ike-policy-ciscoloc mode aggressive
   set security ike policy ike-policy-ciscoloc proposal-set compatible
   set security ike policy ike-policy-ciscoloc pre-shared-key ascii-text ciscoloc_secretKF2

3. Создаём IKE gateway
   

   set security ike gateway ike-gate-ciscoloc ike-policy ike-policy-ciscoloc
   set security ike gateway ike-gate-ciscoloc address 195.60.246.8
   set security ike gateway ike-gate-ciscoloc external-interface lo0.0
   set security ike gateway ike-gate-ciscoloc local-address 95.29.14.1

4. Создаём IPSec policy

   set security ipsec policy ipsec-policy-ciscoloc proposal-set compatible

5. Создаём IPsec VPN, с использованием IKE gateway, IPsec policy

   set security ipsec vpn ipsec-vpn-ciscoloc bind-interface st0.7
   set security ipsec vpn ipsec-vpn-ciscoloc ike gateway ike-gate-ciscoloc
   set security ipsec vpn ipsec-vpn-ciscoloc ike ipsec-policy ipsec-policy-ciscoloc
   set security ipsec vpn ipsec-vpn-ciscoloc establish-tunnels immediately
   

6. Создаём минимум политик:

   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn match source-address any
   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn match destination-address any
   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn match application any
   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn match source-identity any
   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn then permit
   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn then log session-init
   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn then log session-close
   set security policies from-zone vpn to-zone vpn policy vpn-to-vpn then count
   
   set security zones security-zone vpn address-book address net-ciscoloc_10_5_56_0-24 10.5.56.0/24
   
   set security policies from-zone vpn to-zone trust policy vpn-trust-ciscoloc match source-address net-ciscoloc_10_5_56_0-24
   set security policies from-zone vpn to-zone trust policy vpn-trust-ciscoloc match destination-address net-img
   set security policies from-zone vpn to-zone trust policy vpn-trust-ciscoloc match application any
   set security policies from-zone vpn to-zone trust policy vpn-trust-ciscoloc then permit
   
   set routing-options static route 10.5.56.0/24 next-hop st0.7
   
   set security zones security-zone vpn address-book address net-vpn_10_2_0_0-16 10.2.0.0/16
   set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn match source-address net-vpn_10_2_0_0-16
   set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn match destination-address net-img
   set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn match application any
   set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn then permit
   

Настройка Cisco Router

crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2

crypto ipsec transform-set ipsec-policy-met esp-3des esp-sha-hmac 
 mode tunnel

crypto ipsec df-bit clear


crypto keyring PMG-KEYRING
  pre-shared-key address 95.29.14.1 key ciscoloc_secretKF2

crypto isakmp profile PMG
   keyring PMG-KEYRING
   match identity address 95.29.14.1 255.255.255.255

crypto ipsec profile ipsec-profile-PMG
 set transform-set ipsec-policy-met 
 set isakmp-profile PMG

interface Tunnel15
 description IPSec_PMG
 bandwidth 100000
 ip address 10.2.252.6 255.255.255.252
 ip mtu 1446
 ip tcp adjust-mss 1404
 tunnel source FastEthernet0
 tunnel mode ipsec ipv4
 tunnel destination 95.29.14.1
 tunnel protection ipsec profile ipsec-profile-PMG

Проверка

JuniperSRX> ping 10.2.252.6    
PING 10.2.252.6 (10.2.252.6): 56 data bytes
64 bytes from 10.2.252.6: icmp_seq=0 ttl=255 time=64.985 ms
64 bytes from 10.2.252.6: icmp_seq=1 ttl=255 time=66.045 ms
^C
--- 10.2.252.6 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 64.985/65.515/66.045/0.530 ms

JuniperSRX> ping 10.2.252.5    
PING 10.2.252.5 (10.2.252.5): 56 data bytes
64 bytes from 10.2.252.5: icmp_seq=0 ttl=64 time=0.824 ms
64 bytes from 10.2.252.5: icmp_seq=1 ttl=64 time=0.250 ms
64 bytes from 10.2.252.5: icmp_seq=2 ttl=64 time=1.127 ms
^C
--- 10.2.252.5 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.250/0.734/1.127/0.364 ms

10_5_56_1#ping 10.2.252.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.252.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 64/64/64 ms
10_5_56_1#ping 10.2.252.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.252.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
10_5_56_1#

Туннель на чистом GRE

set interfaces gr-0/0/0 unit 3 description "To ciscoloc Tunnel"
set interfaces gr-0/0/0 unit 3 tunnel source 95.29.14.1
set interfaces gr-0/0/0 unit 3 tunnel destination 195.60.246.8
set interfaces gr-0/0/0 unit 3 family inet address 10.2.252.5/30

set security zones security-zone vpn interfaces gr-0/0/0.3

set security zones security-zone vpn address-book address net-nktele_10_5_56_0-24 10.5.56.0/24

set security policies from-zone vpn to-zone trust policy vpn-trust-nktele match source-address net-nktele_10_5_56_0-24
set security policies from-zone vpn to-zone trust policy vpn-trust-nktele match destination-address net-imh
set security policies from-zone vpn to-zone trust policy vpn-trust-nktele match application any
set security policies from-zone vpn to-zone trust policy vpn-trust-nktele then permit

set routing-options static route 10.5.56.0/24 next-hop gr-0/0/0.3

set security zones security-zone vpn address-book address net-vpn_10_2_0_0-16 10.2.0.0/16
set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn match source-address net-vpn_10_2_0_0-16
set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn match destination-address net-imh
set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn match application any
set security policies from-zone vpn to-zone trust policy vpn-trust-netvpn then permit

interface Tunnel15
description IPSec_PMH
bandwidth 100000
ip address 10.2.252.6 255.255.255.252
ip mtu 1446
ip tcp adjust-mss 1404
tunnel source FastEthernet0
tunnel mode gre ip
tunnel destination 95.29.14.1

ip route 10.10.0.0 255.255.0.0 10.2.252.5