Juniper SSG5 NHTB(Next-Hop Tunnel Binding) VPN設定

Juniper SSG5 NHTB(Next-Hop Tunnel Binding) VPN設定

NHTB是一台網路設備僅使用一個VPN通道要來跟數台網路設備彼此之間建立起VPN連線。

Multi-proxy與NHTB的差異在於：Multi-proxy是兩台建立VPN連線的設備其下各有數個子網段要透過一個VPN通道來相互溝通。

 
使用HNTB的好處：

能減少系統開銷，降低設定及維護成本。在大型網路上，設定vpn若能搭配NHTB設定加上OSPF設定的方案，則會有更明顯的效果。

就拿我們接下來要介紹的案例來說，四個防火牆要建立VPN連線，而其各自有三個子網段，並且彼此之間各網段都要能互通，其拓墣如下圖VPN設定拓墣圖所示，若不使用NHTB設定，則每個防火牆都要為其建立27條通道，27個VPN設定才行，而若使用了NHTB設定，則每個防火牆只要為其建立1條通道，3個VPN設定即可，這能讓設定少掉許多煩瑣重複的程序，而在維護上也明顯更輕鬆簡單的多。

ps：上述VPN通道計算方式：1台防火牆內含3個子網段，兩台防火牆之間要建立VPN連線則需要3*3=9條通道，若要跟另外三台防火牆建立連線總共就要9*3=27條VPN通道。

您也可以參考相關連結：

JuniperSRX NHTB(Next-Hop Tunnel Binding) VPN設定

設定案例請參考以下JUNIPER原廠相關連結：

[ScreenOS]Configure Full Mesh VPN with OSPF using Single Tunnel Interface Version 1.0.pdf

[ScreenOS]Configuring OSPF on firewall

[ScreenOS]Configuring Route-based VPNs with Dynamic Routing Routing (OSPF) with JuniperNetScreen-ISG-SSG Products

Hub-and-SpokeVPNs Using Next-Hop Tunnel Binding Overview

Example:Configuring Hub-and-Spoke VPNs using Next-Hop Tunnel Binding

nce-hub-spoke-vpn-nhtb.pdf

Next-HopTunnel Binding Table

通常您必須為每一個VPN連線綁定到個別的隧道介面，也就是說您若有5個VPN連線，就必須建立5個隧道介面來給VPN連線使用。但您也可以將多個 IPSec VPN 隧道綁定到單個隧道介面。為了將多個 IPSec VPN 隧道綁定到單個隧道介面，安全設備要使用兩個表: 路由表和下一躍點隧道綁定表(NHTB)。其目的是要將安全設備(Security Devices)路由表項中指定的下一躍點閘道 IP 位址映射到 NHTB 表中指定的特定VPN隧道。而通過這種技術，單通道介面就可以支援許多 VPN 隧道。

例如：路由表條目 192.168.2.0/24 可能指定1.1.100.2 作為下一躍點閘道Next-Hop，其中1.1.100.2 是遠端 IKE 對等方的隧道介面的IP位址，其CLI命令設定如下：

set vrouter trust-vr route 192.168.2.0/24 interface tunnel.1 gateway 1.1.100.2  ==> SSG5命令

set route 192.168.2.0/24 interface tunnel.1 gateway 1.1.100.2  ==> SSG5命令

set routing-options static route 192.168.2.0/24 next-hop st0.0        ==> SRX命令

當安全設備接收到的通信量為 192.168.2.0/24，路由表指定隧道介面-tunnel.1，但在這種情況下它並沒有指定要使用哪個 VPN 隧道。如果只有一個 VPN 隧道綁定到tunnel.1，則指定隧道介面就足夠了。如果有多個 VPN 隧道綁定到該介面，則需要在路由和特定隧道之間有一個連結。而NHTB表就提供了該連結。此示例的 NHTB 表CLI命令設定如下：

set interface tunnel.1 nhtb 1.1.100.2 vpn "Site4-Site2"                      ==> SSG5命令

set interfaces st0 unit 0 family inet next-hop-tunnel 1.1.100.2 ipsec-vpn Site4-to-Site2   ==> SRX命令

其中 "vpn1" 是連線到遠端IKE對等方的vpn隧道的名稱，其內部子網為192.168.2.0/24，使用唯一的 IP 位址1.1.100.2，即路由表條目和NHTB表條目有共同之處，因此安全設備就可以將目的地為192.168.2.0/24的通信轉發到tunnel.1，並且明確指定要使用VPN通道" Site4-Site2"。

下圖為VPN設定拓墣圖：

-------- SSG5 HNTB設定 Site 2 --------

## SSG本身為Site2，WAN IP: 192.168.188.11，tunnel.1 IP: 1.1.100.2/32

set interface tunnel.1 nhtb 1.1.100.1 vpn "Site2-Site1"  ## (Site1 wan ip 192.168.188.10)，指定要往Site1的目標ip與vpn name

set interface tunnel.1 nhtb 1.1.100.3 vpn "Site2-Site3"  ## (Site3 wan ip 192.168.188.12，此ip隱藏在vpn的gateway設定中，所以此處看不到)

set interface tunnel.1 nhtb 1.1.100.4 vpn "Site2-Site4"  ## (Site4 wan ip 192.168.188.13)

set route 192.168.1.0/24 interface tunnel.1 gateway 1.1.100.1  ## 遠端的網段指定要走tunnel.1並送往Site1之tunnel.1 IP

set route 192.168.3.0/24 interface tunnel.1 gateway 1.1.100.1

set route 192.168.4.0/24 interface tunnel.1 gateway 1.1.100.1

set route 192.168.7.0/24 interface tunnel.1 gateway 1.1.100.3

set route 192.168.8.0/24 interface tunnel.1 gateway 1.1.100.3

set route 192.168.9.0/24 interface tunnel.1 gateway 1.1.100.3

set route 192.168.10.0/24 interface tunnel.1 gateway 1.1.100.4

set route 192.168.11.0/24 interface tunnel.1 gateway 1.1.100.4

set route 192.168.12.0/24 interface tunnel.1 gateway 1.1.100.4

以下這條命令非必要，只是說明而已。SRX st0.0通道預設mtu 9192，而SSG5 tunnel.1通道預設mtu 1500，所以當兩者互相建立vpn通道成功時，您會發現SRX到SSG5是正常的，而SSG5到SRX則不通，原因是當對方的mtu小於等於你時，你能接受，但是當對方的mtu大於你時，你就無法接受了。所以當SRX設備與非JunOS設備建立vpn通道時，建議要加上這條命令，而若能清楚知道對端設備的mtu值則就完美了。

set interface tunnel.1 mtu 1500

ssg5-serial-> set interface tunnel.1 mtu ?

<number>             mtu size, <1280-1500>

ssg5-serial->

-------- SSG5 HNTB設定 Site 2 END --------

以下為SRX的HNTB設定。

-------- SRX HNTB設定 Site 4 ---------

## SRX本身為Site4，WAN IP: 192.168.188.13，st0.0 IP: 1.1.100.4/32

set interfaces st0 unit 0 multipoint     ##將多個 IPSec VPN 隧道綁定到單個隧道介面

set interfaces st0 unit 0 family inet next-hop-tunnel 1.1.100.1 ipsec-vpn Site4-to-Site1  ##(Site1 wan ip 192.168.188.10)指定next-hop ip與vpn tunnel

set interfaces st0 unit 0 family inet next-hop-tunnel 1.1.100.2 ipsec-vpn Site4-to-Site2  ## (Site2 wan ip 192.168.188.11，此IP隱藏在VPN的gateway設定之中，所以此處看不到)

set interfaces st0 unit 0 family inet next-hop-tunnel 1.1.100.3 ipsec-vpn Site4-to-Site3  ## (Site3 wan ip 192.168.188.12)

set routing-options static route 192.168.1.0/24 next-hop st0.0  ##遠端的網段指定要從通道st0.0傳送

set routing-options static route 192.168.3.0/24 next-hop st0.0

set routing-options static route 192.168.5.0/24 next-hop st0.0

set routing-options static route 192.168.2.0/24 next-hop st0.0

set routing-options static route 192.168.4.0/24 next-hop st0.0

set routing-options static route 192.168.6.0/24 next-hop st0.0

set routing-options static route 192.168.7.0/24 next-hop st0.0

set routing-options static route 192.168.8.0/24 next-hop st0.0

set routing-options static route 192.168.9.0/24 next-hop st0.0

以下這條命令非必要，但是建議要加。SRX st0.0通道預設mtu 9192，而SSG5 tunnel.1通道預設mtu 1500，所以當兩者互相建立vpn通道成功時，您會發現SRX到SSG5是正常的，而SSG5到SRX則不通，原因是當對方的mtu小於等於你時，你能接受，但是當對方的mtu大於你時，你就無法接受了。所以當SRX設備與非JunOS設備建立vpn通道時，建議要加上這條命令，而若能清楚知道對端設備的mtu值則就完美了。

set interfaces st0 unit 0 family inet mtu 1500

-------- SRX HNTB設定 Site 4 END ---------

使用HNTB的好處：

能減少系統開銷，降低設定及維護成本。在大型網路上，設定vpn若能搭配NHTB設定加上OSPF設定的方案，則會有更明顯的效果。

設定案例請參考以下JUNIPER原廠相關連結：

Hub-and-SpokeVPNs Using Next-Hop Tunnel Binding Overview

Example:Configuring Hub-and-Spoke VPNs using Next-Hop Tunnel Binding

nce-hub-spoke-vpn-nhtb.pdf

以下用現成的檔案來作說明：

+++++++++++++++++++++++++++++++++++++++++++++++++++++++

下面為4顆SSG5的VPN設定範例。

在這裡我們可以參考相關的連結：

JuniperSRX OSPF設定

JuniperSSG5 OSPF設定

vpn-route_based- multi_lan_to_multi_lan - ospf - SSG - 4_router_of_router_d -  ok - lan_10_11_12.txt (此檔為Site2之設定)

## 帳號：netscreen 密碼：netscreen IP：192.168.2.1
##ethernet0/0 WAN , ethernet0/1 DMZ , ethernet0/2--ethernet0/4 LAN1 , ethernet0/5 LAN2 , ethernet0/6 LAN3
## 本地端網路-192.168.2.0 192.168.4.0 192.168.6.0   遠端網路1-192.168.1.0 192.168.3.0 192.168.5.0 
## 遠端網路2-192.168.7.0 192.168.8.0 192.168.9.0   遠端網路3-192.168.10.0 192.168.11.0 192.168.12.0 
## 本地端網路的3個子網路與另外3個遠端網路之各別的3個子網路，彼此皆可互通。
## 本設定檔開放wan端PING及web服務(方便測試)，為了資安考量可將其關閉。
## 在大型網路中，vpn設定採用OSPF方法，可減少維護成本及設定之困難度，以及防火牆資源之占用。
## 本設定使用OSPF設定，讓與遠端能與本地端溝通，可用於跟他廠牌router做vpn連結，而不同廠牌間之端口MTU預設值會不同，要設定一致才能互相溝通
## SSG tunnel.1端口預設MTU=1500，SRX ST0.0端口預設MTU=9192，故本例在ST0.0端口設定MTU=1500才能與SSG設備溝通。
## 本CD中之OSPF 4 ROUTER系列，router a b c d之間，SRX與SSG router皆可互為替換。
## 套用本設定檔時請自行調整以下IP： wan端IP-192.168.188.11 遠端VPN1 IP-192.168.188.10 遠端VPN1 IP-192.168.188.12 遠端VPN1 IP-192.168.188.13 預設閘道192.168.188.178
## VPN phase1 ike proposol pre-g2-3des-md5    phase2 ipsec proposol nopfs-esp-3des-md5
## 為測試只採用基本加密設定，請自行更改成高安全性設定，如以下：
## VPN phase1 ike proposol pre-g2-aes128-sha    phase2 ipsec proposol pfs_g2-esp-aes128-sha
## 或是在proposal中直接選擇Standard或是Compatible即可。
## pre-shared-key  "netscreen"

unset key protection enable

set clock dst-off

set clock ntp

set clock timezone 8

set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00

set vrouter trust-vr sharable

set vrouter "untrust-vr"

exit

set vrouter "trust-vr"

unset auto-route-export

set protocol ospf

set enable

exit

exit

set alg appleichat enable

unset alg appleichat re-assembly enable

set alg sctp enable

set auth-server "Local" id 0

set auth-server "Local" server-name "Local"

set auth default auth server "Local"

set auth radius accounting port 1646

set admin name "netscreen"

set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn"

set admin auth web timeout 60

set admin auth dial-in timeout 3

set admin auth server "Local"

set admin format dos

set zone "Trust" vrouter "trust-vr"

set zone "Untrust" vrouter "trust-vr"

set zone "DMZ" vrouter "trust-vr"

set zone "VLAN" vrouter "trust-vr"

set zone id 100 "VPN"

set zone "Untrust-Tun" vrouter "trust-vr"

set zone "Trust" tcp-rst

set zone "Untrust" block

unset zone "Untrust" tcp-rst

unset zone "V1-Trust" tcp-rst

unset zone "V1-Untrust" tcp-rst

set zone "DMZ" tcp-rst

unset zone "V1-DMZ" tcp-rst

unset zone "VLAN" tcp-rst

set zone "VPN" tcp-rst

set zone "Untrust" screen tear-drop

set zone "Untrust" screen syn-flood

set zone "Untrust" screen ping-death

set zone "Untrust" screen ip-filter-src

set zone "Untrust" screen land

set zone "V1-Untrust" screen tear-drop

set zone "V1-Untrust" screen syn-flood

set zone "V1-Untrust" screen ping-death

set zone "V1-Untrust" screen ip-filter-src

set zone "V1-Untrust" screen land

set interface "ethernet0/0" zone "Untrust"

set interface "ethernet0/1" zone "DMZ"

set interface "ethernet0/5" zone "Trust"

set interface "ethernet0/6" zone "Trust"

set interface "bgroup0" zone "Trust"

set interface "tunnel.1" zone "VPN"

set interface bgroup0 port ethernet0/2

set interface bgroup0 port ethernet0/3

set interface bgroup0 port ethernet0/4

unset interface vlan1 ip

set interface ethernet0/0 ip 192.168.188.11/24

set interface ethernet0/0 route

set interface ethernet0/5 ip 192.168.4.1/24

set interface ethernet0/5 nat

set interface ethernet0/6 ip 192.168.6.1/24

set interface ethernet0/6 nat

set interface bgroup0 ip 192.168.2.1/24

set interface bgroup0 nat

set interface tunnel.1 ip 1.1.100.2/24

unset interface vlan1 bypass-others-ipsec

unset interface vlan1 bypass-non-ip

set interface ethernet0/0 ip manageable

set interface ethernet0/5 ip manageable

set interface ethernet0/6 ip manageable

set interface bgroup0 ip manageable

set interface ethernet0/0 manage ping

set interface ethernet0/0 manage telnet

set interface ethernet0/0 manage web

unset interface ethernet0/5 manage ssh

unset interface ethernet0/5 manage snmp

unset interface ethernet0/5 manage ssl

unset interface ethernet0/6 manage ssh

unset interface ethernet0/6 manage snmp

unset interface ethernet0/6 manage ssl

set interface bgroup0 manage mtrace

set interface ethernet0/5 dhcp server service

set interface ethernet0/6 dhcp server service

set interface bgroup0 dhcp server service

set interface ethernet0/5 dhcp server enable

set interface ethernet0/6 dhcp server enable

set interface bgroup0 dhcp server auto

set interface ethernet0/5 dhcp server option lease 1440000

set interface ethernet0/5 dhcp server option gateway 192.168.4.1

set interface ethernet0/5 dhcp server option dns1 168.95.1.1

set interface ethernet0/5 dhcp server option dns2 168.95.192.1

set interface ethernet0/6 dhcp server option lease 1440000

set interface ethernet0/6 dhcp server option gateway 192.168.6.1

set interface ethernet0/6 dhcp server option dns1 168.95.1.1

set interface ethernet0/6 dhcp server option dns2 168.95.192.1

set interface bgroup0 dhcp server option gateway 192.168.2.1

set interface bgroup0 dhcp server option dns1 168.95.1.1

set interface bgroup0 dhcp server option dns2 168.95.192.1

set interface ethernet0/5 dhcp server ip 192.168.4.11 to 192.168.4.111

set interface ethernet0/6 dhcp server ip 192.168.6.11 to 192.168.6.111

set interface bgroup0 dhcp server ip 192.168.2.11 to 192.168.2.111

unset interface ethernet0/5 dhcp server config next-server-ip

unset interface ethernet0/6 dhcp server config next-server-ip

unset interface bgroup0 dhcp server config next-server-ip

set interface "serial0/0" modem settings "USR" init "AT&F"

set interface "serial0/0" modem settings "USR" active

set interface "serial0/0" modem speed 115200

set interface "serial0/0" modem retry 3

set interface "serial0/0" modem interval 10

set interface "serial0/0" modem idle-time 10

set flow tcp-mss

unset flow tcp-syn-check

unset flow tcp-syn-bit-check

set flow reverse-route clear-text prefer

set flow reverse-route tunnel always

set pki authority default scep mode "auto"

set pki x509 default cert-path partial

set dns host dns1 168.95.1.1

set dns host dns2 168.95.192.1

set dns host dns3 0.0.0.0

set dns host schedule 06:28 interval 4

set address "Trust" "Local-192.168.2.1/24" 192.168.2.1 255.255.255.0

set address "Trust" "Local-192.168.4.1/24" 192.168.4.1 255.255.255.0

set address "Trust" "Local-192.168.6.1/24" 192.168.6.1 255.255.255.0

set address "VPN" "Remote-192.168.10.1/24" 192.168.10.1 255.255.255.0

set address "VPN" "Remote-192.168.11.1/24" 192.168.11.1 255.255.255.0

set address "VPN" "Remote-192.168.12.1/24" 192.168.12.1 255.255.255.0

set address "VPN" "Remote-192.168.1.1/24" 192.168.1.1 255.255.255.0

set address "VPN" "Remote-192.168.3.1/24" 192.168.3.1 255.255.255.0

set address "VPN" "Remote-192.168.5.1/24" 192.168.5.1 255.255.255.0

set address "VPN" "Remote-192.168.7.1/24" 192.168.7.1 255.255.255.0

set address "VPN" "Remote-192.168.8.1/24" 192.168.8.1 255.255.255.0

set address "VPN" "Remote-192.168.9.1/24" 192.168.9.1 255.255.255.0

set group address "Trust" "Local_Lans"

set group address "Trust" "Local_Lans" add "Local-192.168.2.1/24"

set group address "Trust" "Local_Lans" add "Local-192.168.4.1/24"

set group address "Trust" "Local_Lans" add "Local-192.168.6.1/24"

set group address "VPN" "Remote-Lans"

set group address "VPN" "Remote-Lans" add "Remote-192.168.10.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.11.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.12.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.1.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.3.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.5.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.7.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.8.1/24"

set group address "VPN" "Remote-Lans" add "Remote-192.168.9.1/24"

set crypto-policy

exit

set ike gateway "Site1-GW" address 192.168.188.10 Main local-id "192.168.188.11" outgoing-interface "ethernet0/0" preshare "I1uIdkFgN4eG9hs1uzC3BskwzRnVcksr7Q==" proposal "pre-g2-3des-md5"

set ike gateway "Site3-GW" address 192.168.188.12 Main local-id "192.168.188.11" outgoing-interface "ethernet0/0" preshare "I1uIdkFgN4eG9hs1uzC3BskwzRnVcksr7Q==" proposal "pre-g2-3des-md5"

set ike gateway "Site4-GW" address 192.168.188.13 Main local-id "192.168.188.11" outgoing-interface "ethernet0/0" preshare "I1uIdkFgN4eG9hs1uzC3BskwzRnVcksr7Q==" proposal "pre-g2-3des-md5"

set ike respond-bad-spi 1

set ike ikev2 ike-sa-soft-lifetime 60

unset ike ikeid-enumeration

unset ike dos-protection

unset ipsec access-session enable

set ipsec access-session maximum 5000

set ipsec access-session upper-threshold 0

set ipsec access-session lower-threshold 0

set ipsec access-session dead-p2-sa-timeout 0

unset ipsec access-session log-error

unset ipsec access-session info-exch-connected

unset ipsec access-session use-error-log

set vpn "Site2-Site1" gateway "Site1-GW" no-replay tunnel idletime 0 proposal "nopfs-esp-3des-md5"

set vpn "Site2-Site1" monitor optimized rekey

set vpn "Site2-Site1" id 0x1 bind interface tunnel.1

set interface tunnel.1 nhtb 1.1.100.1 vpn "Site2-Site1"

set vpn "Site2-Site3" gateway "Site3-GW" no-replay tunnel idletime 0 proposal "nopfs-esp-3des-md5"

set vpn "Site2-Site3" monitor optimized rekey

set vpn "Site2-Site3" id 0x2 bind interface tunnel.1

set interface tunnel.1 nhtb 1.1.100.3 vpn "Site2-Site3"

set vpn "Site2-Site4" gateway "Site4-GW" no-replay tunnel idletime 0 proposal "nopfs-esp-3des-md5"

set vpn "Site2-Site4" monitor optimized rekey

set vpn "Site2-Site4" id 0x3 bind interface tunnel.1

set interface tunnel.1 nhtb 1.1.100.4 vpn "Site2-Site4"

set url protocol websense

exit

set policy id 5 from "VPN" to "VPN"  "Remote-Lans" "Remote-Lans" "ANY" permit

set policy id 5

exit

set policy id 3 name "Remote_Sites-to-Local_Site" from "VPN" to "Trust"  "Remote-Lans" "Local_Lans" "ANY" permit

set policy id 3

exit

set policy id 2 name "Local_Site-to-Remote_Sites" from "Trust" to "VPN"  "Local_Lans" "Remote-Lans" "ANY" permit

set policy id 2

exit

set policy id 1 from "Trust" to "Untrust"  "Any" "Any" "ANY" permit

set policy id 1

exit

set nsmgmt bulkcli reboot-timeout 60

set ssh version v2

set config lock timeout 5

unset license-key auto-update

set telnet client enable

set ntp server "118.163.81.61"

set ntp server backup1 "129.6.15.28"

set ntp server backup2 "120.119.31.1"

set ntp interval 100

set snmp port listen 161

set snmp port trap 162

set snmpv3 local-engine id "0162112010001171"

set vrouter "untrust-vr"

exit

set vrouter "trust-vr"

unset add-default-route

set route 0.0.0.0/0 interface ethernet0/0 gateway 192.168.188.178

set route 192.168.1.0/24 interface tunnel.1 gateway 1.1.100.1

set route 192.168.3.0/24 interface tunnel.1 gateway 1.1.100.1

set route 192.168.4.0/24 interface tunnel.1 gateway 1.1.100.1

set route 192.168.7.0/24 interface tunnel.1 gateway 1.1.100.3

set route 192.168.8.0/24 interface tunnel.1 gateway 1.1.100.3

set route 192.168.9.0/24 interface tunnel.1 gateway 1.1.100.3

set route 192.168.10.0/24 interface tunnel.1 gateway 1.1.100.4

set route 192.168.11.0/24 interface tunnel.1 gateway 1.1.100.4

set route 192.168.12.0/24 interface tunnel.1 gateway 1.1.100.4

exit

set interface bgroup0 protocol ospf area 0.0.0.0

set interface bgroup0 protocol ospf passive

set interface bgroup0 protocol ospf enable

set interface bgroup0 protocol ospf priority 10

set interface bgroup0 protocol ospf cost 1

set interface ethernet0/5 protocol ospf area 0.0.0.0

set interface ethernet0/5 protocol ospf passive

set interface ethernet0/5 protocol ospf enable

set interface ethernet0/5 protocol ospf priority 10

set interface ethernet0/5 protocol ospf cost 1

set interface ethernet0/6 protocol ospf area 0.0.0.0

set interface ethernet0/6 protocol ospf passive

set interface ethernet0/6 protocol ospf enable

set interface ethernet0/6 protocol ospf priority 10

set interface ethernet0/6 protocol ospf cost 1

set interface tunnel.1 protocol ospf area 0.0.0.0

set interface tunnel.1 protocol ospf link-type p2mp

set interface tunnel.1 protocol ospf enable

set interface tunnel.1 protocol ospf dead-interval 40

set interface tunnel.1 protocol ospf hello-interval 10

set interface tunnel.1 protocol ospf priority 10

set interface tunnel.1 protocol ospf cost 1

set vrouter "untrust-vr"

exit

set vrouter "trust-vr"

exit

+++++++++++++++++++++++++++++++++++++++++++++++++++++++