Comprehensive Detailed Step-by-Step Explanation with All Juniper Security Reference
Understanding the Scenario:
Objective: Deploy OSPF over IPsec between an SRX Series device and a third-party device using GRE
tunnels.
Components Involved:
GRE (Generic Routing Encapsulation): Encapsulates packets to allow routing protocols like OSPF to
run over IPsec tunnels.
IPsec: Provides security for the GRE tunnels.
OSPF: Dynamic routing protocol used over the GRE tunnel.
Option A: The GRE interface should use lo0 as endpoints.
Using the loopback interface (lo0) as the source and destination endpoints for GRE tunnels is a
common best practice.
Advantages:
Stability: Loopback interfaces are always up, ensuring the GRE tunnel remains operational even if
physical interfaces fail.
Reachability: Provides consistent endpoint IP addresses for GRE tunnels.
Configuration:
Assign IP addresses to lo0 interfaces on both devices.
Configure GRE tunnels to use these lo0 IP addresses as source and destination.
Reference:
Juniper Networks Documentation:
"Using loopback interfaces as GRE tunnel endpoints ensures stability and consistent reachability for
routing protocols over GRE tunnels."
Source: Configuring GRE Tunnels
Option D: The GRE interface must be configured under the OSPF protocol.
To run OSPF over the GRE tunnel, the GRE interface must be included in the OSPF configuration.
Configuration Steps:
Create GRE Interface:
Example: set interfaces gr-0/0/0 unit 0 tunnel source tunnel destination
Assign IP Address to GRE Interface:
Example: set interfaces gr-0/0/0 unit 0 family inet address
Include GRE Interface in OSPF:
Example: set protocols ospf area interface gr-0/0/0.0
Result:
OSPF will establish adjacencies over the GRE interface and exchange routing information.
Reference:
Juniper Networks Documentation:
"To enable OSPF over GRE tunnels, you must include the GRE interfaces in the OSPF configuration."
Source: OSPF over GRE Configuration
Why Options B and C are Incorrect:
Option B: The OSPF protocol must be enabled under the VPN zone.
Since OSPF is running over the GRE tunnel, which is encapsulated over IPsec, the OSPF packets are
encapsulated within GRE and IPsec.
The SRX device does not need to allow OSPF in the security policies or enable OSPF under the VPN
zone for GRE-encapsulated traffic.
Security Policies:
The GRE traffic (IP protocol 47) must be permitted through the security policies.
OSPF runs inside the GRE tunnel and does not require additional configuration under the VPN zone.
Reference:
Juniper Networks Documentation:
"When using GRE over IPsec, routing protocols run over GRE and do not require separate security
policies for their control traffic."
Source: Security Policies for GRE over IPsec
Option C: Overlapping addresses are allowed between remote networks.
Overlapping IP addresses can cause routing conflicts and are generally not recommended.
In a GRE over IPsec scenario, overlapping addresses can lead to issues in routing protocol adjacency
and data forwarding.
Best Practice:
Ensure unique IP addressing schemes between remote networks to prevent routing issues.
Reference:
Juniper Networks Documentation:
"Overlapping IP address spaces can lead to routing ambiguities and should be avoided when
configuring GRE tunnels."
Source: Avoiding Overlapping IP Addresses
Conclusion:
Correct Answers: A and D
Rationale:
Option A is correct because using lo0 as endpoints for GRE provides stability and reliability.
Option D is correct because the GRE interface must be included in the OSPF configuration to enable
OSPF over the tunnel.
