Netskope supports Generic Route Encapsulation (GRE) tunnels as a traffic steering method. GRE tunnels allow you to route web traffic (port 80 and 443) to Netskope using logical tunnel interfaces that terminate to a Netskope GRE gateway. When you create GRE tunnels in the Netskope UI, Netskope provides parameters for configuring the tunnels on your firewall. The GRE configuration below utilizes Junos OS commands and concepts.
This guide illustrates how to configure GRE tunnels between Netskope and the Juniper vSRX virtual firewall running Junos OS version 15.1X49-D75.5. To learn more about the CLI steps in Junos OS, see the Juniper documentation.
Prerequisites
Before configuring GRE, review the guidelines and prerequisites.
Creating GRE Tunnels in Netskope
To create the GRE tunnels for Juniper SRX or vSRX in the Netskope UI, see Creating a GRE Site.
Ensure you save the <Primary_Gateway_IP_Address> or <Failover_Gateway_IP_Address>, which are the GRE Gateway IP address of the primary and failover Netskope POPs.
Creating the GRE Tunnel Interfaces
On the Juniper SRX or vSRX firewall, enter the following commands. Replace <Primary_Gateway_IP_Address> and <Failover_Gateway_IP_Address> with the GRE Gateway IP address of the primary and backup Netskope POPs you copied in Creating a GRE Site.
set interfaces gr-0/0/0 unit 0 tunnel source 172.16.176.137
set interfaces gr-0/0/0 unit 0 tunnel destination <Primary_Gateway_IP_Address>
set interfaces gr-0/0/0 unit 0 family inet mtu 1476
set interfaces gr-0/0/0 unit 0 family inet address 10.100.100.1/24
set interfaces gr-0/0/0 unit 1 tunnel source 172.16.176.137
set interfaces gr-0/0/0 unit 1 tunnel destination <Failover_Gateway_IP_Address>
set interfaces gr-0/0/0 unit 1 family inet mtu 1476
set interfaces gr-0/0/0 unit 1 family inet address 10.100.200.1/24
Configuring the Real-Time Performance Monitoring Probes
Enter the following commands:
set services rpm probe icmp-gre test icmp probe-type icmp-ping set services rpm probe icmp-gre test icmp target address 5.6.7.8 set services rpm probe icmp-gre test icmp probe-count 5 set services rpm probe icmp-gre test icmp probe-interval 5 set services rpm probe icmp-gre test icmp test-interval 10 set services rpm probe icmp-gre test icmp source-address 172.16.176.137 set services rpm probe icmp-gre test icmp thresholds successive-loss 5 set services rpm probe icmp-gre test icmp thresholds total-loss 5
Editing the Default-System Security Policy
Enter the following command:
set security policies default-policy permit-all
Creating the Security Zones
Enter the following commands:
set security zones security-zone all host-inbound-traffic system-services all set security zones security-zone all host-inbound-traffic protocols all set security zones security-zone all interfaces all
Configuring Static Routing
Enter the following commands:
set routing-options static route 0.0.0.0/0 next-hop 172.16.176.129 set routing-options static route 8.8.8.8/32 next-hop gr-0/0/0.0 set routing-options static route 8.8.8.8/32 next-hop gr-0/0/0.1 set routing-options static route 185.199.0.0/16 next-hop gr-0/0/0.0 set routing-options static route 185.199.0.0/16 next-hop gr-0/0/0.1 set routing-options static route 164.100.133.0/24 next-hop gr-0/0/0.0 set routing-options static route 164.100.133.0/24 next-hop gr-0/0/0.1 set routing-options static route 5.6.7.8/32 next-hop gr-0/0/0.1 set routing-options static route 5.6.7.8/32 next-hop gr-0/0/0.0 set routing-options static route 10.136.176.33/32 next-hop gr-0/0/0.0 set routing-options static route 10.136.176.33/32 next-hop gr-0/0/0.1
Configuring the GRE Keepalive Times
Enter the following commands:
set protocols oam gre-tunnel interface gr-0/0/0.0 keepalive-time 5
set protocols oam gre-tunnel interface gr-0/0/0.0 hold-time 20
set protocols oam gre-tunnel interface gr-0/0/0.1 keepalive-time 5
set protocols oam gre-tunnel interface gr-0/0/0.1 hold-time 20
Sample CLI Configuration
Below is a sample CLI GRE tunnel configuration for Juniper SRX firewalls:
set version 15.1X49-D75.5
set system root-authentication encrypted-password "1234567890"
set system name-server 172.16.254.11 source-address 172.16.176.137
set system services ssh
set services rpm probe icmp-gre test icmp probe-type icmp-ping
set services rpm probe icmp-gre test icmp target address 5.6.7.8
set services rpm probe icmp-gre test icmp probe-count 5
set services rpm probe icmp-gre test icmp probe-interval 5
set services rpm probe icmp-gre test icmp test-interval 10
set services rpm probe icmp-gre test icmp source-address 172.16.176.137
set services rpm probe icmp-gre test icmp thresholds successive-loss 5
set services rpm probe icmp-gre test icmp thresholds total-loss 5
set security policies default-policy permit-all
set security zones security-zone all host-inbound-traffic system-services all
set security zones security-zone all host-inbound-traffic protocols all
set security zones security-zone all interfaces all
set interfaces ge-0/0/0 unit 0 family inet address 172.16.176.137/26
set interfaces gr-0/0/0 unit 0 tunnel source 172.16.176.137
set interfaces gr-0/0/0 unit 0 tunnel destination <Primary_Gateway_IP_Address>
set interfaces gr-0/0/0 unit 0 family inet mtu 1476
set interfaces gr-0/0/0 unit 0 family inet address 10.100.100.1/24
set interfaces gr-0/0/0 unit 1 tunnel source 172.16.176.137
set interfaces gr-0/0/0 unit 1 tunnel destination <Failover_Gateway_IP_Address>
set interfaces gr-0/0/0 unit 1 family inet mtu 1476
set interfaces gr-0/0/0 unit 1 family inet address 10.100.200.1/24
set interfaces ge-0/0/1 unit 0 family inet address 172.16.176.204/26
set routing-options static route 0.0.0.0/0 next-hop 172.16.176.129
set routing-options static route 8.8.8.8/32 next-hop gr-0/0/0.0
set routing-options static route 8.8.8.8/32 next-hop gr-0/0/0.1
set routing-options static route 185.199.0.0/16 next-hop gr-0/0/0.0
set routing-options static route 185.199.0.0/16 next-hop gr-0/0/0.1
set routing-options static route 164.100.133.0/24 next-hop gr-0/0/0.0
set routing-options static route 164.100.133.0/24 next-hop gr-0/0/0.1
set routing-options static route 5.6.7.8/32 next-hop gr-0/0/0.1
set routing-options static route 5.6.7.8/32 next-hop gr-0/0/0.0
set routing-options static route 10.136.176.33/32 next-hop gr-0/0/0.0
set routing-options static route 10.136.176.33/32 next-hop gr-0/0/0.1
set protocols oam gre-tunnel interface gr-0/0/0.0 keepalive-time 5
set protocols oam gre-tunnel interface gr-0/0/0.0 hold-time 20
set protocols oam gre-tunnel interface gr-0/0/0.1 keepalive-time 5
set protocols oam gre-tunnel interface gr-0/0/0.1 hold-time 20