Netskope prend en charge les tunnels IPSec (Internet Protocol Security) en tant que méthode de gestion du trafic. Les tunnels IPSec vous permettent d'acheminer le trafic web (ports 80 et 443) vers Netskope à l'aide d'interfaces de tunnel logiques qui aboutissent à une passerelle IPSec de Netskope. Lorsque vous créez des tunnels IPSec dans l'interface utilisateur de Netskope, Netskope fournit des paramètres pour configurer les tunnels sur votre pare-feu. La configuration IPSec ci-dessous utilise les commandes et concepts de Junos OS.
Ce guide illustre comment configurer les tunnels IPSec entre Netskope et le pare-feu virtuel VSRX de Juniper sous Junos OS version 15.1X49-D75.5. IPSec propose deux modes : le mode tunnel et le mode transport. Ce guide est destiné au mode tunnel. Pour en savoir plus sur les étapes de la ligne de ligne de ligne dans Junos OS, consultez la documentation Juniper.
Conditions préalables
Avant de configurer IPSec, examinez les prérequis.
Création de tunnels IPSec dans Netskope
Pour créer les tunnels VPN IPSec pour Juniper SRX ou vSRX dans l'interface utilisateur Netskope, consultez la section Création d'un site IPSec.
Veillez à enregistrer les informations suivantes dans l'interface utilisateur de Netskope :
-
<Primary_Gateway_IP_Address> ou <Failover_Gateway_IP_Address>: Les adresses IP de la passerelle IPSec des points de présence Netskope principaux et de secours.
-
<Pre-Shared_Key><Pré-Shared_Key> : La clé pré-partagée (PSK) du site IPSec que vous avez créé dans l’interface Netskope.
Création des interfaces du tunnel IPSec
Saisissez les commandes suivantes :
set interfaces ge-0/0/0 unit 0 family inet address 172.16.176.137/26 set interfaces ge-0/0/1 unit 0 family inet address 172.16.176.204/26 set interfaces st0 unit 0 family inet address 10.11.11.10/24 set interfaces st0 unit 1 family inet address 20.11.11.10/24
Configuration du routage statique
Vous pouvez utiliser le routage statique pour acheminer le trafic à travers les tunnels IPSec vers Netskope. Si vous utilisez Netskope comme proxy explicite sur des tunnels IPSec, vous devez ajouter 163.116.128.80/32 et 163.116.128.81/32 comme routes statiques pour le next-hop de st0.0 et st0.1.
Saisissez les commandes suivantes avec les adresses IP que vous souhaitez utiliser pour acheminer le trafic via les tunnels IPSec :
set routing-options static route 0.0.0.0/0 next-hop 172.16.176.129 set routing-options static route 185.199.0.0/16 next-hop st0.0 set routing-options static route 185.199.0.0/16 next-hop st0.1 set routing-options static route 9.8.7.6/32 next-hop st0.0 set routing-options static route 9.8.7.6/32 next-hop st0.1 set routing-options static route 164.100.133.0/24 next-hop st0.0 set routing-options static route 164.100.133.0/24 next-hop st0.1 set routing-options static route 8.8.8.8/32 next-hop st0.0 set routing-options static route 8.8.8.8/32 next-hop st0.1
Définition de la proposition IKE
La proposition IKE est une liste de paramètres de sécurité qui protège la négociation IKE pendant la phase 1.
Saisissez les commandes suivantes :
set security ike proposal <IKE_Proposal_Name> authentication-algorithm sha-256
set security ike proposal <IKE_Proposal_Name> authentication-method pre-shared-keys
set security ike proposal <IKE_Proposal_Name> dh-group group14
set security ike proposal <IKE_Proposal_Name> encryption-algorithm aes-256-cbc
set security ike proposal <IKE_Proposal_Name> lifetime-seconds 7200
Configuration de la politique IKE
La politique IKE définit le mode IKE, la PSK des pairs et la proposition IKE utilisée lors de la négociation IKE.
Saisissez les commandes suivantes :
set security ike policy <IKE_Policy_Name> mode main
set security ike policy <IKE_Policy_Name> proposals <IKE_Proposal_Name>
set security ike policy <IKE_Policy_Name> pre-shared-key ascii-text <Pre-Shared_Key>
Création des passerelles IKE
Vous avez besoin des adresses IP de la passerelle IPSec des POPs Netskope que vous avez copiés dans l’interface Netskope.
Saisissez les commandes suivantes :
set security ike gateway <Primary_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Primary_IKE_Gateway_Name> address <Primary_Gateway_IP_Address>
set security ike gateway <Primary_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Primary_IKE_Gateway_Name> remote-identity inet 10.136.176.31
set security ike gateway <Primary_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Primary_IKE_Gateway_Name> version v2-only
set security ike gateway <Failover_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Failover_IKE_Gateway_Name> address <Failover_Gateway_IP_Address>
set security ike gateway <Failover_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Failover_IKE_Gateway_Name> remote-identity inet 10.136.176.30
set security ike gateway <Failover_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Failover_IKE_Gateway_Name> version v2-only
Définition de la proposition IPSec
La proposition IPSec est une liste de protocoles et d'algorithmes qui négocie le pair IPSec.
Saisissez les commandes suivantes :
set security ipsec proposal <IPSec_Proposal_Name> protocol esp
set security ipsec proposal <IPSec_Proposal_Name> authentication-algorithm hmac-sha-256-128
set security ipsec proposal <IPSec_Proposal_Name> encryption-algorithm aes-256-cbc
set security ipsec proposal <IPSec_Proposal_Name> lifetime-seconds 7200
Configuration de la politique IPSec
La politique IPSec définit le secret parfait (PFS) et la proposition IPSec utilisée lors de la négociation IPSec.
Saisissez les commandes suivantes :
set security ipsec policy <IPSec_Policy_Name> perfect-forward-secrecy keys group14
set security ipsec policy <IPSec_Policy_Name> proposals <IPSec_Proposal_Name>
Création des VPN IPSec
Créez deux tunnels VPN IPSec liés à vos interfaces de tunnel et à vos passerelles IKE. Vous pouvez optionnellement configurer un proxy-identity pour chaque VPN, que Juniper SRX génère automatiquement comme 0.0.0.0/0. Toutefois, si vous souhaitez n'envoyer qu'un trafic spécifique à travers les tunnels, vous devez le définir en conséquence.
Saisissez les commandes suivantes :
set security ipsec vpn <Primary_IPSec_VPN_Name> bind-interface st0.0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike gateway <Primary_IKE_Gateway_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Primary_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> establish-tunnels immediately
set security ipsec vpn <Failover_IPSec_VPN_Name> bind-interface st0.1
set security ipsec vpn <Failover_IPSec_VPN_Name> ike gateway <Failover_IKE_Gateway_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Failover_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> establish-tunnels immediately
Modification de la politique de sécurité du système par défaut
Entrez la commande suivante :
set security policies default-policy permit-all
Création des zones de sécurité
Configurez une stratégie de sécurité pour autoriser le trafic de la zone source vers la zone de destination.
Saisissez les commandes suivantes :
set security zones security-zone all host-inbound-traffic system-services all set security zones security-zone all host-inbound-traffic protocols all set security zones security-zone all interfaces all
Exemple de configuration CLI
Vous trouverez ci-dessous un exemple de configuration de tunnel IPSec pour les pare-feu Juniper SRX :
root> show configuration | display set
set version 15.1X49-D75.5
set system root-authentication encrypted-password "1234567890"
set system name-server 172.16.254.11 source-address 172.16.176.137
set system services ssh
set security ike proposal <IKE_Proposal_Name> authentication-method pre-shared-keys
set security ike proposal <IKE_Proposal_Name> dh-group group14
set security ike proposal <IKE_Proposal_Name> encryption-algorithm aes-256-cbc
set security ike proposal <IKE_Proposal_Name> lifetime-seconds 7200
set security ike policy <IKE_Policy_Name> mode main
set security ike policy <IKE_Policy_Name> proposals <IKE_Proposal_Name>
set security ike policy <IKE_Policy_Name> pre-shared-key ascii-text <Pre-Shared_Key>
set security ike gateway <Primary_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Primary_IKE_Gateway_Name> address <Primary_IKE_Gateway_Name>
set security ike gateway <Primary_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Primary_IKE_Gateway_Name> remote-identity inet 10.136.176.31
set security ike gateway <Primary_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Primary_IKE_Gateway_Name> version v2-only
set security ike gateway <Failover_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Failover_IKE_Gateway_Name> address <Failover_Gateway_IP_Address>
set security ike gateway <Failover_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Failover_IKE_Gateway_Name> remote-identity inet 10.136.176.30
set security ike gateway <Failover_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Failover_IKE_Gateway_Name> version v2-only
set security ipsec proposal <IPSec_Proposal_Name> protocol esp
set security ipsec proposal <IPSec_Proposal_Name> authentication-algorithm hmac-sha1-96
set security ipsec proposal <IPSec_Proposal_Name> lifetime-seconds 7200
set security ipsec policy <IPSec_Policy_Name> perfect-forward-secrecy keys group14
set security ipsec policy <IPSec_Policy_Name> proposals <IPSec_Proposal_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> bind-interface st0.0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike gateway <Primary_IKE_Gateway_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Primary_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> establish-tunnels immediately
set security ipsec vpn <Failover_IPSec_VPN_Name> bind-interface st0.1
set security ipsec vpn <Failover_IPSec_VPN_Name> ike gateway <Failover_IKE_Gateway_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Failover_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> establish-tunnels immediately
set security policies default-policy permit-all
set security zones security-zone all host-inbound-traffic system-services all
set security zones security-zone all host-inbound-traffic protocols all
set security zones security-zone all interfaces all
set interfaces ge-0/0/0 unit 0 family inet address 172.16.176.137/26
set interfaces ge-0/0/1 unit 0 family inet address 172.16.176.204/26
set interfaces st0 unit 0 family inet address 10.11.11.10/24
set interfaces st0 unit 1 family inet address 20.11.11.10/24
set routing-options static route 0.0.0.0/0 next-hop 172.16.176.129
set routing-options static route 185.199.0.0/16 next-hop st0.0
set routing-options static route 185.199.0.0/16 next-hop st0.1
set routing-options static route 9.8.7.6/32 next-hop st0.0
set routing-options static route 9.8.7.6/32 next-hop st0.1
set routing-options static route 164.100.133.0/24 next-hop st0.0
set routing-options static route 164.100.133.0/24 next-hop st0.1
set routing-options static route 8.8.8.8/32 next-hop st0.0
set routing-options static route 8.8.8.8/32 next-hop st0.1
Dépannage
Vous pouvez utiliser l'une des commandes suivantes pour dépanner les tunnels IPSec sur le pare-feu Juniper :
Vérification de l'état de l'AS IKE
Entrez les commandes suivantes pour afficher des informations sur les associations de sécurité IKE (SA) :
root> show security ike security-associations
Index State Initiator cookie Responder cookie Mode Remote Address
3267788 UP 7ff0b8be90fca7da 188629ab03675f57 IKEv2 10.136.176.30
3267789 UP 4b49d6cc1476a53b 009f5e70a44f767f IKEv2 10.136.176.31
root> show security ike security-associations detail
IKE peer 10.136.176.30, Index 3267788, Gateway Name: IKE_GW2
Role: Initiator, State: UP
Initiator cookie: 7ff0b8be90fca7da, Responder cookie: 188629ab03675f57
Exchange type: IKEv2, Authentication method: Pre-shared-keys
Local: 172.16.176.137:4500, Remote: 10.136.176.30:4500
Lifetime: Expires in 5803 seconds
Reauth Lifetime: Disabled
IKE Fragmentation: Enabled, Size: 576
Peer ike-id: 10.136.176.30
Xauth assigned IP: 0.0.0.0
Algorithms:
Authentication : hmac-sha1-96
Encryption : aes256-cbc
Pseudo random function: hmac-sha1
Diffie-Hellman group : DH-group-14
Traffic statistics:
Input bytes : 0
Output bytes : 0
Input packets: 0
Output packets: 0
Input fragmentated packets: 0
Output fragmentated packets: 0
IPSec security associations: 0 created, 0 deleted
Phase 2 negotiations in progress: 1
Negotiation type: Quick mode, Role: Initiator, Message ID: 0
Local: 172.16.176.137:4500, Remote: 10.136.176.30:4500
Local identity: srx123
Remote identity: 10.136.176.30
Flags: IKE SA is created
IKE peer 10.136.176.31, Index 3267789, Gateway Name: IKE_GW
Role: Initiator, State: UP
Initiator cookie: 4b49d6cc1476a53b, Responder cookie: 009f5e70a44f767f
Exchange type: IKEv2, Authentication method: Pre-shared-keys
Local: 172.16.176.137:4500, Remote: 10.136.176.31:4500
Lifetime: Expires in 6348 seconds
Reauth Lifetime: Disabled
IKE Fragmentation: Enabled, Size: 576
Peer ike-id: 10.136.176.31
Xauth assigned IP: 0.0.0.0
Algorithms:
Authentication : hmac-sha1-96
Encryption : aes256-cbc
Pseudo random function: hmac-sha1
Diffie-Hellman group : DH-group-14
Traffic statistics:
Input bytes : 0
Output bytes : 0
Input packets: 0
Output packets: 0
Input fragmentated packets: 0
Output fragmentated packets: 0
IPSec security associations: 0 created, 0 deleted
Phase 2 negotiations in progress: 1
Negotiation type: Quick mode, Role: Initiator, Message ID: 0
Local: 172.16.176.137:4500, Remote: 10.136.176.31:4500
Local identity: srx123
Remote identity: 10.136.176.31
Flags: IKE SA is created
Vérification de l'état de l'AS IPSec
Entrez les commandes suivantes pour afficher des informations sur les associations de sécurité IPSec (SA) :
root> show security ipsec security-associations
Total active tunnels: 2
ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway
<131073 ESP: sha1 a340c94f 6268/ unlim - root 4500 10.136.176.31
>131073 ESP: sha1 ca7ab31e 6268/ unlim - root 4500 10.136.176.31
<131074 ESP: sha1 62db2a02 5399/ unlim - root 4500 10.136.176.30
>131074 ESP: sha1 ca197fcb 5399/ unlim - root 4500 10.136.176.30
root> show security ipsec security-associations detail
ID: 131073 Virtual-system: root, VPN Name: IPSEC_VPN
Local Gateway: 172.16.176.137, Remote Gateway: 10.136.176.31
Local Identity: ipv4_subnet(any:0,[0..7]=172.16.176.192/26)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Version: IKEv2
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.0
Port: 4500, Nego#: 66, Fail#: 0, Def-Del#: 0 Flag: 0x600a29
Tunnel events:
Wed Jul 14 2021 06:03:30: IKE SA rekey successfully completed (1 times)
Wed Jul 14 2021 06:01:45: IPSec SA rekey successfully completed (1 times)
Wed Jul 14 2021 04:13:18: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 04:13:18: IKE SA negotiation successfully completed (1 times)
Wed Jul 14 2021 04:13:17: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 03:48:36: IKE SA rekey successfully completed (4 times)
Wed Jul 14 2021 03:25:11: IPSec SA rekey successfully completed (4 times)
Tue Jul 13 2021 20:29:25: IPSec SA negotiation successfully completed (1 times)
Tue Jul 13 2021 20:29:25: IKE SA negotiation successfully completed (13 times)
Tue Jul 13 2021 20:28:27: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Tue Jul 13 2021 20:28:25: IPSec SA negotiation successfully completed (1 times)
Tue Jul 13 2021 20:27:27: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Tue Jul 13 2021 19:53:53: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 18:04:23: IKE SA negotiation successfully completed (10 times)
Tue Jul 13 2021 17:13:41: IKE SA rekey successfully completed (2 times)
Tue Jul 13 2021 13:34:21: IKE SA negotiation successfully completed (6 times)
Direction: inbound, SPI: a340c94f, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 6236 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 5672 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: ca7ab31e, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 6236 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 5672 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
ID: 131074 Virtual-system: root, VPN Name: IPSEC_VPN2
Local Gateway: 172.16.176.137, Remote Gateway: 10.136.176.30
Local Identity: ipv4_subnet(any:0,[0..7]=172.16.176.192/26)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Version: IKEv2
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.1
Port: 4500, Nego#: 53, Fail#: 0, Def-Del#: 0 Flag: 0x600a29
Tunnel events:
Wed Jul 14 2021 05:54:25: IKE SA rekey successfully completed (2 times)
Wed Jul 14 2021 05:47:16: IPSec SA rekey successfully completed (2 times)
Wed Jul 14 2021 02:15:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 02:15:29: IKE SA negotiation successfully completed (24 times)
Wed Jul 14 2021 02:14:32: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 02:14:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 02:13:32: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 02:13:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 02:12:32: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 02:12:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 01:21:18: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 23:31:27: IKE SA negotiation successfully completed (1 times)
Tue Jul 13 2021 23:00:25: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 21:10:25: IKE SA negotiation successfully completed (18 times)
Tue Jul 13 2021 20:00:23: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 18:10:23: IKE SA negotiation successfully completed (5 times)
Direction: inbound, SPI: 62db2a02, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 5367 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 4780 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: ca197fcb, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 5367 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 4780 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
Client Logs
nsadmin@VSRX-Ubuntu:~$ curl -v -k https://file-examples-com.github.io/uploads/2017/10/file-example_PDF_1MB.pdf 2>&1 | grep issuer:
issuer: C=IN,ST=Karnataka,L=Bangalore,O=CFW,OU=e02224c3afe0020a0ec95f4e8251c05e,CN=ca.dineshks.inskope.com,EMAIL=certadmin@netskope.com
nsadmin@VSRX-Ubuntu:~$
nsadmin@VSRX-Ubuntu:~$
nsadmin@VSRX-Ubuntu:~$ curl -v -k --silent https://ssp.karnataka.gov.in:8080 2>&1 | grep issuer:
issuer: C=IN,ST=Karnataka,L=Bangalore,O=CFW,OU=e02224c3afe0020a0ec95f4e8251c05e,CN=ca.dineshks.inskope.com,EMAIL=certadmin@netskope.com
nsadmin@VSRX-Ubuntu:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=78.2 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=115 time=77.4 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=115 time=77.2 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=115 time=77.3 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 77.230/77.575/78.253/0.524 ms
nsadmin@VSRX-Ubuntu:~$ ^C
nsadmin@VSRX-Ubuntu:~$ ping 9.8.7.6
PING 9.8.7.6 (9.8.7.6) 56(84) bytes of data.
64 bytes from 9.8.7.6: icmp_seq=1 ttl=60 time=76.3 ms
64 bytes from 9.8.7.6: icmp_seq=2 ttl=60 time=76.2 ms
64 bytes from 9.8.7.6: icmp_seq=3 ttl=60 time=76.9 ms
^C
--- 9.8.7.6 ping statistics ---
4 packets transmitted, 3 received, 25% packet loss, time 3004ms
rtt min/avg/max/mdev = 76.292/76.545/76.987/0.447 ms
nsadmin@VSRX-Ubuntu:~$ ^C