Sunday, August 27, 2017

Configuring a QFX5100 two-members Virtual Chassis with a Preprovisioned Configuration

QFX Virtual Chassis Overview
----------------------------------------
A QFX Series Virtual Chassis is a flexible, scaling switch solution for supported combinations of QFX3500, QFX3600, QFX5100, and QFX5110 switches. EX4300 switches can also be included in some configurations of a QFX Series Virtual Chassis..

In a QFX Series Virtual Chassis, you can interconnect up to ten standalone switches in the following
combinations into one logical device, and manage the logical device as a single chassis:

QFX5110 switches or a combination of QFX5110 and QFX5100 switches (a non-mixed Virtual Chassis)
QFX5100 switches (a non-mixed Virtual Chassis)
QFX5100 switches with any combination of QFX3500, QFX3600, or EX4300 switches (a mixed mode Virtual Chassis)
QFX3500 switches or QFX3600 switches, or a combination of QFX3500 and QFX3600 switches (a non-mixed Virtual Chassis)
QFX3500 or QFX3600 switches with EX4300 switches, or a combination of all three types of switches (a mixed mode Virtual Chassis)

The advantages of connecting multiple switches into a Virtual Chassis include better-managed bandwidth at a network layer, simplified configuration and maintenance because multiple devices can be managed as a single device, increased fault tolerance and high availability(HA) because a Virtual Chassis can remain active and network traffic can be redirected to other member switches when a single member switch fails, and a flatter, simplified Layer 2 network topology that minimizes or eliminates the need for loop prevention protocols such as Spanning Tree Protocol (STP).

You set up a Virtual Chassis by configuring Virtual Chassis ports (VCPs) on the member switches, and interconnecting the switches using the VCPs . VCPs are responsible for passing all data and control traffic between member switches in the Virtual Chassis. The following ports on QFX Series switches that support Virtual Chassis can be configured into VCPs to form a QFX Series Virtual Chassis:

Any 100-Gbps or 40-Gbps QSFP28 ports on QFX5110 switches
Any non-channelized 40-Gbps QSFP+ ports on QFX3500, QFX3600, QFX5100, or QFX5110 switches
Any fixed 10-Gbps SFP+ ports on QFX Series switches with these ports

You can increase VCP bandwidth between member switches by configuring multiple interfaces between the same two switches into VCPs. When multiple VCPs interconnect the same two member switches, a Link Aggregation Group (LAG) or bundle is automatically formed when the VCPs are on interfaces supporting identical speeds. For example, if you have two 40-Gbps QSFP+ interfaces configured as VCPs between member switches, a LAG with two member links with 80Gbps of total bandwidth is formed. However, 10-Gbps SFP+ and 40-Gbps QSFP+ interfaces configured as VCPs
will not become members of the same VCP LAG.

----------------------------------
Before configuration note
----------------------------------
1. IF the new member switch is running a version of Junos OS that is different than the version of
Junos OS running on the Virtual Chassis, then ensure that the correct version of Junos OS is or
will be installed on the new member switch by performing software update or automatic software update enable.

root> request system software add ftp://ip address/jinstall-qfx-5-14.1X53-D42.3-domestic-signed.tgz no-validate no-copy
user@device# set virtual-chassis auto-sw-update package-name ftp://hostname/pathname/package-name

--------------------------------------------------------------------------------------------------------------------------
Configuring a QFX5100 two-member Virtual Chassis with a Preprovisioned Configuration File:
--------------------------------------------------------------------------------------------------------------------------

1.Make a list of the serial numbers of all the switches to be connected in a
  Virtual Chassis configuration.

S/N: TR02171XXXXX
S/N: TR021712XXXX

2.Note the desired role (routing-engine or line-card) of each switch. If you
  configure the member with a routing-engine role, it is eligible to function in
  the master or backup role. If you configure the member with a line-card role, it
  is not eligible to function in the master or backup role.

3.Power on only the switch with S/N: TR02171XXXXX that you plan to use as the master switch.


-------------------------------------------------
For SW with S/N: TR02171XXXXX
-------------------------------------------------


4.After the reboot is complete, specify the preprovisioned configuration mode:

[edit virtual-chassis]
user@switch# set preprovisioned

5.Specify all the members that you want included in the Virtual Chassis, listing each switch’s
serial number with the desired member ID and role:

[edit virtual-chassis]

user@switch# set member 0 serial-number TR02171XXXXX role routing-engine
user@switch# set member 1 serial-number TR021712XXXX role routing-engine


6.(Recommended for a two-member Virtual Chassis) Disable the split and merge
feature:

[edit virtual-chassis]
user@switch# set no-split-detection

-------------------------------------------------
For SW with S/N: TR021712XXXX 
-------------------------------------------------

7. Power on only the switch with S/N: TR021712XXXX that you plan to use as the Backup switch.

After the boot is complete, specify the preprovisioned configuration mode:

[edit virtual-chassis]
user@switch# set preprovisioned

8.Specify all the members that you want included in the Virtual Chassis, listing each switch’s serial number with the desired member ID and role:
[edit virtual-chassis]

user@switch# set member 0 serial-number TR02171XXXXX role routing-engine
user@switch# set member 1 serial-number TR021712XXXX role routing-engine

9.(Recommended for a two-member Virtual Chassis) Disable the split and merge
feature:

[edit virtual-chassis]
user@switch# set no-split-detection

10.Finaly connect the qsfp+ cable to the et-0/0/53 for both switch according to the picture.

N.B. Now wait for 5 mintues. Changing any configuration from master sw do "commit synchronous" command. 

-------------------
Verifying VC:
-------------------

##From SW with S/N: TR02171XXXXX

root> show virtual-chassis

Preprovisioned Virtual Chassis
Virtual Chassis ID: 9b18.70fb.c786
Virtual Chassis Mode: Enabled
                                                Mstr           Mixed Route Neighbor List
Member ID  Status       Serial No              Model           prio  Role       Mode  Mode  ID  Interface
0 (FPC 0)    Prsnt    TR02171XXXXX qfx5100-48t-6q 129   Master*     N      VC      1   vcp-255/0/53
1 (FPC 1)    Prsnt    TR021712XXXX qfx5100-48t-6q  129  Backup      N      VC      0   vcp-255/0/53

##From SW with S/N: TR021712XXXX

root> show virtual-chassis

Preprovisioned Virtual Chassis
Virtual Chassis ID: 9b18.70fb.c786
Virtual Chassis Mode: Enabled
                                                Mstr           Mixed Route Neighbor List
Member ID  Status   Serial No    Model          prio  Role      Mode  Mode ID  Interface
0 (FPC 0)  Prsnt    TR02171XXXXX qfx5100-48t-6q 129   Master*      N  VC   1  vcp-255/0/53
1 (FPC 1)  Prsnt    TR021712XXXX qfx5100-48t-6q 129   Backup       N  VC   0  vcp-255/0/53

------------------------------------------------------------------
login to the member switch of the Virtual Chassis:
------------------------------------------------------------------
root>request session member <member-id>
>>>Here member ID '0' is for master and '1' for Backup<<<


------------------------------------------------------------
Mastership switching of the Virtual Chassis:
------------------------------------------------------------

{master:member0-re0}
root> request virtual-chassis routing-engine master switch
Do you want to continue ? [yes,no] (no)yes

{backup:member0-re0}
root>

NOTE:Before you issue the request virtual-chassis routing-engine master switch command from the master router or switch in the Virtual Chassis, make sure that the system configuration is synchronized between the master and backup router or switch. If the configuration is not synchronized, or if you attempt to issue the request virtual-chassis routing-engine master switch command from the backup router or switch instead of from the master router or switch, the device displays an error message and rejects the command.If you issue the request virtual-chassis routing-engine master switch command when the Virtual Chassis is in a transition state (for example, the backup router or switch is disconnecting from the Virtual Chassis),
the device does not process the command.

Wednesday, August 23, 2017

Route based IPSEC Multiple site to site VPN Configuration with two Junipers SRX340 & CISCO 2900 Routers


-----------------------------------------------------------------------------------------------------------
IPSEC Multiple site to site VPN Configuration with two Junipers & CISCO Routers:
-----------------------------------------------------------------------------------------------------------

SRX340-HQ   : Untrust IP- 1.1.1.1/30, Trust IP-10.1.1.1/24, st0.0 IP: 172.16.0.1/30
                          Untrust IP- 2.2.2.1/30,                                    st0.1 IP: 172.16.1.1/30

SRX340-West : Untrust IP- 2.2.2.2/30, Trust IP-10.3.3.1/24, st0.0 IP: 172.16.1.2/30
CISCO-East    : Untrust IP- 1.1.1.2/30, Trust IP-10.2.2.1/24, tunnel 0 IP:172.16.0.2/30

----------------------
##Juniper HQ:
----------------------
set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.1/30
set interfaces ge-0/0/1 unit 0 family inet address 2.2.2.1/30
set interfaces ge-0/0/3 unit 0 family inet address 10.1.1.1/24
set interfaces st0 unit 0 family inet address 172.16.0.1/30
set interfaces st0 unit 0 family inet mtu 1400
set interfaces st0 unit 1 family inet address 172.16.1.1/30
set interfaces st0 unit 1 family inet mtu 1400

set security zones security-zone trust interfaces st0.0
set security zones security-zone trust interfaces st0.1
set security zones security-zone trust interfaces ge-0/0/3.0

set security zones security-zone untrust interfaces ge-0/0/0.0
set security zones security-zone untrust interfaces ge-0/0/1.0

Phase 01 for Site "A":
----------------------
## IKE proposal
set security ike proposal IKE-Proposal lifetime-seconds 28800
set security ike proposal IKE-Proposal authentication-method pre-shared-keys
set security ike proposal IKE-Proposal authentication-algorithm sha1
set security ike proposal IKE-Proposal encryption-algorithm aes-128-cbc
set security ike proposal IKE-Proposal dh-group group2

## IKE policy
set security ike policy IKE-Poly mode main
set security ike policy IKE-Poly proposals IKE-Proposal
set security ike policy IKE-Poly pre-shared-key ascii-text tawfique

##(For cisco-East)IKE gateway with peer IP address, IKE policy and outgoing interfac
set security ike gateway IKE-GW ike-policy IKE-Poly
set security ike gateway IKE-GW address 1.1.1.2
set security ike gateway IKE-GW external-interface ge-0/0/0.0

##(For SRX340-west)IKE gateway with peer IP address, IKE policy and outgoing interfac
set security ike gateway IKE-GW2 ike-policy IKE-Poly
set security ike gateway IKE-GW2 address 2.2.2.2
set security ike gateway IKE-GW2 external-interface ge-0/0/1.0


## Security zones, assign interfaces to the zones & host-inbound services for each zone
set security zones security-zone Untrust host-inbound-traffic system-services ike


Phase 02 for Site "A":
----------------------
## IPSec proposal
set security ipsec proposal IPSEC-Proposal lifetime-seconds 3600
set security ipsec proposal IPSEC-Proposal protocol esp
set security ipsec proposal IPSEC-Proposal authentication-algorithm hmac-sha1-96
set security ipsec proposal IPSEC-Proposal encryption-algorithm aes-128-cbc

## IPSec Policy
set security ipsec policy IPSEC-Poly proposals IPSEC-Proposal

##(For cisco-East) IPSec VPN
set security ipsec vpn IPSEC-VPN bind-interface st0.0
set security ipsec vpn IPSEC-VPN ike ipsec-policy IPSEC-Poly
set security ipsec vpn IPSEC-VPN ike gateway IKE-GW
set security ipsec vpn IPSEC-VPN establish-tunnels immediately

##(For SRX340-west) IPSec VPN
set security ipsec vpn IPSEC-VPN2 bind-interface st0.1
set security ipsec vpn IPSEC-VPN2 ike ipsec-policy IPSEC-Poly
set security ipsec vpn IPSEC-VPN2 ike gateway IKE-GW2
set security ipsec vpn IPSEC-VPN2 establish-tunnels immediately


#Routing Option(For cisco-East)
set routing-options static route 10.2.2.0/24 next-hop st0.0

#Routing Option(For SRX340-west)
set routing-options static route 10.3.3.0/24 next-hop st0.1

-------------------------
####CISCO East:
-------------------------

Router(config)#interface GigabitEthernet0/0
Router(config-if)#ip add 1.1.1.2 255.255.255.252
Router(config-if)#no sh

Router(config)#interface GigabitEthernet0/1
Router(config-if)#ip add 10.2.2.1 255.255.255.0
Router(config-if)#no sh

Phase 01(IKE isakmp configuration)
----------------------------------
Router(config)#crypto isakmp policy 1
Router(config-isakmp)#authentication pre-share
Router(config-isakmp)#encryption aes 128
Router(config-isakmp)#hash sha
Router(config-isakmp)#lifetime 28800
Router(config-isakmp)#group 2
Router(config-isakmp)#exit
Router(config)#crypto isakmp key tawfique address 1.1.1.1


Phase 02(IPsec VPN configuration)
----------------------------------
Router(config)#crypto ipsec transform-set MY-VPN esp-aes 128 esp-sha-hmac
Router(cfg-crypto-trans)# mode transport

#create IPsec profile
Router(config)#crypto ipsec profile VPNPROFILE
Router(ipsec-profile)# set transform-set MY-VPN

#create tunnel interface with IP and give IPsec protection
Router(config)#interface tunnel 0
Router(config-if)#ip add 172.16.0.2 255.255.255.252
Router(config-if)#tunnel source 1.1.1.2
Router(config-if)#tunnel destinations 1.1.1.1
Router(config-if)#tunnel mode ipsec ipv4
Router(config-if)#tunnel protection ipsec profile VPNPROFILE
Router(config-if)#ip mtu 1400

#create static route
Router(config)#ip route 10.1.1.0 255.255.255.0 tunnel 0

----------------------
##Juniper West:
----------------------

set interfaces ge-0/0/0 unit 0 family inet address 2.2.2.2/30
set interfaces ge-0/0/3 unit 0 family inet address 10.3.3.1/24
set interfaces st0 unit 0 family inet address 172.16.1.2/30
set interfaces st0 unit 0 family inet mtu 1400


set security zones security-zone trust interfaces st0.0
set security zones security-zone trust interfaces ge-0/0/3.0

set security zones security-zone untrust interfaces ge-0/0/0.0


Phase 01 for Site "A":
----------------------
## IKE proposal
set security ike proposal IKE-Proposal lifetime-seconds 28800
set security ike proposal IKE-Proposal authentication-method pre-shared-keys
set security ike proposal IKE-Proposal authentication-algorithm sha1
set security ike proposal IKE-Proposal encryption-algorithm aes-128-cbc
set security ike proposal IKE-Proposal dh-group group2

## IKE policy
set security ike policy IKE-Poly mode main
set security ike policy IKE-Poly proposals IKE-Proposal
set security ike policy IKE-Poly pre-shared-key ascii-text tawfique

##(For SRX340-HQ)IKE gateway with peer IP address, IKE policy and outgoing interfac
set security ike gateway IKE-GW ike-policy IKE-Poly
set security ike gateway IKE-GW address 2.2.2.1
set security ike gateway IKE-GW external-interface ge-0/0/0.0




## Security zones, assign interfaces to the zones & host-inbound services for each zone
set security zones security-zone Untrust host-inbound-traffic system-services ike


Phase 02 for Site "A":
----------------------
## IPSec proposal
set security ipsec proposal IPSEC-Proposal lifetime-seconds 3600
set security ipsec proposal IPSEC-Proposal protocol esp
set security ipsec proposal IPSEC-Proposal authentication-algorithm hmac-sha1-96
set security ipsec proposal IPSEC-Proposal encryption-algorithm aes-128-cbc

## IPSec Policy
set security ipsec policy IPSEC-Poly proposals IPSEC-Proposal

##(For SRX340-HQ) IPSec VPN
set security ipsec vpn IPSEC-VPN bind-interface st0.0
set security ipsec vpn IPSEC-VPN ike ipsec-policy IPSEC-Poly
set security ipsec vpn IPSEC-VPN ike gateway IKE-GW
set security ipsec vpn IPSEC-VPN establish-tunnels immediately


#Routing Option(For SRX340-HQ)
set routing-options static route 10.1.1.0/24 next-hop st0.0


------------------------------------------
#Verifying the VPN for Juniper:
------------------------------------------
1) show security ike security-associations
2) show security ipsec security-associations
3) show security ipsec statistics
4) show route

------------------------------------------
#Verifying the VPN for Cisco:
------------------------------------------
1) show crypto isakmp sa
2) show crypto ipsec sa
3) show crypto ipsec statistics
4) show route

Tuesday, August 22, 2017

IPSEC VPN (Route based) Configuration between Juniper SRX340 & CISCO 2900 Router LAB-02


----------------------------------------------------------------------------
IPSEC VPN Configuration between Juniper & CISCO Router:
----------------------------------------------------------------------------

SRX340-A: Untrust IP- 1.1.1.1/30, Trust IP-10.1.1.1/24, st0.0 IP: 172.16.0.1/30
CISCO-B: Untrust IP- 1.1.1.2/30, Trust IP-10.2.2.1/24, tunnel 0 IP:172.16.0.2/30

##Juniper Site-A:
set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.1/30
set interfaces ge-0/0/3 unit 0 family inet address 10.1.1.1/24
set interfaces st0 unit 0 family inet address 172.16.0.1/30
set interfaces st0 unit 0 family inet mtu 1400

set security zones security-zone trust interfaces st0.0
set security zones security-zone trust interfaces ge-0/0/3.0

set security zones security-zone untrust interfaces ge-0/0/0.0

Phase 01 for Site "A":
---------------------------------
## IKE proposal
set security ike proposal IKE-Proposal lifetime-seconds 28800
set security ike proposal IKE-Proposal authentication-method pre-shared-keys
set security ike proposal IKE-Proposal authentication-algorithm sha1
set security ike proposal IKE-Proposal encryption-algorithm aes-128-cbc
set security ike proposal IKE-Proposal dh-group group2

## IKE policy
set security ike policy IKE-Poly mode main
set security ike policy IKE-Poly proposals IKE-Proposal
set security ike policy IKE-Poly pre-shared-key ascii-text tawfique

## IKE gateway with peer IP address, IKE policy and outgoing interfac
set security ike gateway IKE-GW ike-policy IKE-Poly
set security ike gateway IKE-GW address 1.1.1.2
set security ike gateway IKE-GW external-interface ge-0/0/0.0


## Security zones, assign interfaces to the zones & host-inbound services for each zone
set security zones security-zone Untrust host-inbound-traffic system-services ike


Phase 02 for Site "A":
----------------------
## IPSec proposal
set security ipsec proposal IPSEC-Proposal lifetime-seconds 3600
set security ipsec proposal IPSEC-Proposal protocol esp
set security ipsec proposal IPSEC-Proposal authentication-algorithm hmac-sha1-96
set security ipsec proposal IPSEC-Proposal encryption-algorithm aes-128-cbc

## IPSec Policy
set security ipsec policy IPSEC-Poly proposals IPSEC-Proposal

## IPSec VPN
set security ipsec vpn IPSEC-VPN bind-interface st0.0
set security ipsec vpn IPSEC-VPN ike ipsec-policy IPSEC-Poly
set security ipsec vpn IPSEC-VPN ike gateway IKE-GW
set security ipsec vpn IPSEC-VPN establish-tunnels immediately


#Routing Option
set routing-options static route 10.2.2.0/24 next-hop st0.0


##CISCO Site-B:

Router(config)#interface GigabitEthernet0/0
Router(config-if)#ip add 1.1.1.2 255.255.255.252
Router(config-if)#no sh

Router(config)#interface GigabitEthernet0/1
Router(config-if)#ip add 10.2.2.1 255.255.255.0
Router(config-if)#no sh

Phase 01(IKE isakmp configuration)
----------------------------------
Router(config)#crypto isakmp policy 1
Router(config-isakmp)#authentication pre-share
Router(config-isakmp)#encryption aes 128
Router(config-isakmp)#hash sha
Router(config-isakmp)#lifetime 28800
Router(config-isakmp)#group 2
Router(config-isakmp)#exit
Router(config)#crypto isakmp key tawfique address 1.1.1.1


Phase 02(IPsec VPN configuration)
----------------------------------
Router(config)#crypto ipsec transform-set MY-VPN esp-aes 128 esp-sha-hmac
Router(cfg-crypto-trans)# mode transport

#create IPsec profile
Router(config)#crypto ipsec profile VPNPROFILE
Router(ipsec-profile)# set transform-set MY-VPN

#create tunnel interface with IP and give IPsec protection
Router(config)#interface tunnel 0
Router(config-if)#ip add 172.16.0.2 255.255.255.252
Router(config-if)#tunnel source 1.1.1.2
Router(config-if)#tunnel destinations 1.1.1.1
Router(config-if)#tunnel mode ipsec ipv4
Router(config-if)#tunnel protection ipsec profile VPNPROFILE
Router(config-if)#ip mtu 1400

#create static route
Router(config)#ip route 10.1.1.0 255.255.255.0 tunnel 0


------------------------------------------
#Verifying the VPN for Juniper:
------------------------------------------
1) show security ike security-associations
2) show security ipsec security-associations
3) show security ipsec statistics
4) show route

------------------------------------------
#Verifying the VPN for Cisco:
------------------------------------------
1) show crypto isakmp sa
2) show crypto ipsec sa
3) show crypto ipsec statistics
4) show route

Monday, August 21, 2017

IPSEC VPN Configuration between Juniper SRX340 & CISCO Router


-------------------------------------------------------------------------------

IPSEC VPN Configuration between Juniper & CISCO Router:
-------------------------------------------------------------------------------

SRX340-A: Untrust IP- 1.1.1.1/30, Trust IP-10.1.1.1/24, st0.0 IP: 172.16.0.1/30
CISCO-B: Untrust IP- 1.1.1.2/30, Trust IP-10.2.2.1/24, tunnel 0 IP:172.16.0.2/30

##Juniper END:
set interfaces ge-0/0/0.0 unit 0 family inet address 1.1.1.1/30
set interfaces ge-0/0/3.0 unit 0 family inet address 10.1.1.1/24
set interfaces st0 unit 0 family inet address 172.16.0.1/30
set interfaces st0 unit 0 family inet mtu 1400

set security zones security-zone trust interfaces st0.0
set security zones security-zone trust interfaces ge-0/0/3.0

set security zones security-zone untrust interfaces ge-0/0/0.0

Phase 01 for Site "A":
----------------------------
## IKE policy
set security ike policy IKE-Poly mode main
set security ike policy IKE-Poly proposal-set compatible
set security ike policy IKE-Poly pre-shared-key ascii-text tawfique

## IKE gateway with peer IP address, IKE policy and outgoing interfac
set security ike gateway IKE-GW ike-policy IKE-Poly
set security ike gateway IKE-GW address 1.1.1.2
set security ike gateway IKE-GW external-interface ge-0/0/0.0


## Security zones, assign interfaces to the zones & host-inbound services for each zone
set security zones security-zone Untrust host-inbound-traffic system-services ike


Phase 02 for Site "A":
----------------------------

set security ipsec policy IPSEC-Poly proposal-set standard

set security ipsec vpn IPSEC-VPN bind-interfaces st0.0
set security ipsec vpn IPSEC-VPN ike ipsec-policy IPSEC-Poly
set security ipsec vpn IPSEC-VPN ike gateway IKE-GW
set security ipsec vpn IPSEC-VPN establish-tunnels immeidately



#Routing Option
set routing-options static route 10.2.2.0/24 next-hop st0.0


##CISCO END:

Router(config)#interface GigabitEthernet0/0
Router(config-if)#ip add 1.1.1.2 255.255.255.252
Router(config-if)#no sh

Router(config)#interface GigabitEthernet0/1
Router(config-if)#ip add 10.2.2.1 255.255.255.0
Router(config-if)#no sh

Phase 01(IKE isakmp configuration)

----------------------------------------------
Router(config)#crypto isakmp policy 1
Router(config-isakmp)#authentication pre-share
Router(config-isakmp)#encryption 3des
Router(config-isakmp)#hash sha
Router(config-isakmp)#lifetime 288800
Router(config-isakmp)#group 2
Router(config-isakmp)#exit
Router(config)#crypto isakmp key tawfique address 1.1.1.1


Phase 02(IPsec VPN configuration)

---------------------------------------------
Router(config)#crypto ipsec transform-set MY-VPN esp-3des esp-sha-hmac
Router(cfg-crypto-trans)# mode transport

#create IPsec profile
Router(config)#crypto ipsec profile VPNPROFILE
Router(ipsec-profile)# set transform-set MY-VPN

#create tunnel interface with IP and give IPsec protection
Router(config)#interface tunnel 0
Router(config-if)#ip add 172.16.0.2 255.255.255.252
Router(config-if)#tunnel source 1.1.1.2
Router(config-if)#tunnel destinations 1.1.1.1
Router(config-if)#tunnel mode ipsec ipv4
Router(config-if)#tunnel protection ipsec profile VPNPROFILE
Router(config-if)#ip mtu 1400

#create static route
Router(config)#ip route 10.1.1.0 255.255.255.0 tunnel 0

------------------------------------------
#Verifying the VPN for Juniper:
------------------------------------------
1) show security ike security-associations
2) show security ipsec security-associations
3) show security ipsec statistics
4) show route

------------------------------------------
#Verifying the VPN for Cisco:
------------------------------------------
1) show crypto isakmp sa
2) show crypto ipsec sa
3) show crypto ipsec statistics
4) show route