Netskopeは、トラフィックルーティング方法としてインターネットプロトコルセキュリティ（IPSec）トンネルをサポートしています。IPSecトンネルを使用すると、ウェブトラフィック（ポート80および443）をNetskopeにルーティングできます。 Netskope IPSecゲートウェイで終端する論理トンネルインターフェイス。NetskopeのユーザーインターフェースでIPSecトンネルを作成すると、Netskopeはファイアウォール上でトンネルを設定するためのパラメータを提供します。以下のIPSec設定では、Junos OSのコマンドと概念を使用しています。
このガイドでは、Junos OSバージョン15.1X49-D75.5を実行するJuniper vSRX仮想ファイアウォールとNetskope間のIPSecトンネルの設定方法を示しています。IPSecには、トンネルモードとトランスポートモードの2つのモードがあります。このガイドはトンネルモード向けです。Junos OS の CLI 手順の詳細については、 Juniper のドキュメントを参照してください。
前提条件
IPSecを設定する前に、前提条件を確認してください。
NetskopeでIPSecトンネルを作成する
Netskope UIでJuniper SRXまたはvSRX用のIPSec VPNトンネルを作成するには、「 IPSecサイトの作成」を参照してください。
Netskopeのユーザーインターフェースから以下の情報を必ず保存してください。
-
<Primary_Gateway_IP_Address>または<Failover_Gateway_IP_Address> : プライマリおよびフェイルオーバーのNetskope POPのIPSecゲートウェイIPアドレス。
-
<Pre-Shared_Key>:Netskope UIで作成したIPSecサイトの事前共有キー(PSK)。
IPSecトンネルインターフェースの作成
以下のコマンドを入力してください。
set interfaces ge-0/0/0 unit 0 family inet address 172.16.176.137/26 set interfaces ge-0/0/1 unit 0 family inet address 172.16.176.204/26 set interfaces st0 unit 0 family inet address 10.11.11.10/24 set interfaces st0 unit 1 family inet address 20.11.11.10/24
静的ルーティングの設定
静的ルーティングを使用して、IPSecトンネル経由でNetskopeにトラフィックをルーティングできます。 IPSecトンネル上でNetskope明示的なプロキシとして使用する場合、st0.0とst0.1のネクストホップの静的ルートとして163.116.128.80/32と163.116.128.81/32を追加する必要があります。
IPSecトンネル経由でトラフィックをルーティングしたいIPアドレスを指定して、以下のコマンドを入力してください。
set routing-options static route 0.0.0.0/0 next-hop 172.16.176.129 set routing-options static route 185.199.0.0/16 next-hop st0.0 set routing-options static route 185.199.0.0/16 next-hop st0.1 set routing-options static route 9.8.7.6/32 next-hop st0.0 set routing-options static route 9.8.7.6/32 next-hop st0.1 set routing-options static route 164.100.133.0/24 next-hop st0.0 set routing-options static route 164.100.133.0/24 next-hop st0.1 set routing-options static route 8.8.8.8/32 next-hop st0.0 set routing-options static route 8.8.8.8/32 next-hop st0.1
IKE提案の定義
IKE提案とは、フェーズ1におけるIKEネゴシエーションを保護するためのセキュリティパラメータのリストである。
以下のコマンドを入力してください。
set security ike proposal <IKE_Proposal_Name> authentication-algorithm sha-256
set security ike proposal <IKE_Proposal_Name> authentication-method pre-shared-keys
set security ike proposal <IKE_Proposal_Name> dh-group group14
set security ike proposal <IKE_Proposal_Name> encryption-algorithm aes-256-cbc
set security ike proposal <IKE_Proposal_Name> lifetime-seconds 7200
IKE ポリシーの構成
IKE ポリシーは、IKE モード、ピアの PSK、および IKE ネゴシエーション中に使用される IKE プロポーザルを定義します。
以下のコマンドを入力してください。
set security ike policy <IKE_Policy_Name> mode main
set security ike policy <IKE_Policy_Name> proposals <IKE_Proposal_Name>
set security ike policy <IKE_Policy_Name> pre-shared-key ascii-text <Pre-Shared_Key>
IKEゲートウェイの作成
Netskope UIでコピーしたNetskope POPの IPSecゲートウェイのIPアドレス が必要です。
以下のコマンドを入力してください。
set security ike gateway <Primary_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Primary_IKE_Gateway_Name> address <Primary_Gateway_IP_Address>
set security ike gateway <Primary_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Primary_IKE_Gateway_Name> remote-identity inet 10.136.176.31
set security ike gateway <Primary_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Primary_IKE_Gateway_Name> version v2-only
set security ike gateway <Failover_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Failover_IKE_Gateway_Name> address <Failover_Gateway_IP_Address>
set security ike gateway <Failover_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Failover_IKE_Gateway_Name> remote-identity inet 10.136.176.30
set security ike gateway <Failover_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Failover_IKE_Gateway_Name> version v2-only
IPSec提案の定義
IPSec提案とは、IPSecピアとのネゴシエーションを行うためのプロトコルとアルゴリズムのリストである。
以下のコマンドを入力してください。
set security ipsec proposal <IPSec_Proposal_Name> protocol esp
set security ipsec proposal <IPSec_Proposal_Name> authentication-algorithm hmac-sha-256-128
set security ipsec proposal <IPSec_Proposal_Name> encryption-algorithm aes-256-cbc
set security ipsec proposal <IPSec_Proposal_Name> lifetime-seconds 7200
IPSec ポリシーの構成
IPSec ポリシーは、PFS (Perfect Forward Secrecy) と、IPSec ネゴシエーション中に使用される IPSec 提案を定義します。
以下のコマンドを入力してください。
set security ipsec policy <IPSec_Policy_Name> perfect-forward-secrecy keys group14
set security ipsec policy <IPSec_Policy_Name> proposals <IPSec_Proposal_Name>
IPSec VPNの作成
トンネルインターフェースとIKEゲートウェイにバインドされた2つのIPSec VPNトンネルを作成します。各VPNに対してproxy-identity任意で設定できます。Juniper SRXはこれを0.0.0.0/0として自動生成します。ただし、トンネルを通して特定のトラフィックのみを送信したい場合は、それに応じて定義する必要があります。
以下のコマンドを入力してください。
set security ipsec vpn <Primary_IPSec_VPN_Name> bind-interface st0.0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike gateway <Primary_IKE_Gateway_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Primary_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> establish-tunnels immediately
set security ipsec vpn <Failover_IPSec_VPN_Name> bind-interface st0.1
set security ipsec vpn <Failover_IPSec_VPN_Name> ike gateway <Failover_IKE_Gateway_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Failover_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> establish-tunnels immediately
デフォルトシステムセキュリティポリシーの編集
次のコマンドを入力してください。
set security policies default-policy permit-all
セキュリティゾーンの作成
送信元ゾーンから宛先ゾーンへのトラフィックを許可するようにセキュリティポリシーを設定します。
以下のコマンドを入力してください。
set security zones security-zone all host-inbound-traffic system-services all set security zones security-zone all host-inbound-traffic protocols all set security zones security-zone all interfaces all
サンプルCLI設定
以下は、Juniper SRXファイアウォールにおけるCLI IPSecトンネル設定の例です。
root> show configuration | display set
set version 15.1X49-D75.5
set system root-authentication encrypted-password "1234567890"
set system name-server 172.16.254.11 source-address 172.16.176.137
set system services ssh
set security ike proposal <IKE_Proposal_Name> authentication-method pre-shared-keys
set security ike proposal <IKE_Proposal_Name> dh-group group14
set security ike proposal <IKE_Proposal_Name> encryption-algorithm aes-256-cbc
set security ike proposal <IKE_Proposal_Name> lifetime-seconds 7200
set security ike policy <IKE_Policy_Name> mode main
set security ike policy <IKE_Policy_Name> proposals <IKE_Proposal_Name>
set security ike policy <IKE_Policy_Name> pre-shared-key ascii-text <Pre-Shared_Key>
set security ike gateway <Primary_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Primary_IKE_Gateway_Name> address <Primary_IKE_Gateway_Name>
set security ike gateway <Primary_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Primary_IKE_Gateway_Name> remote-identity inet 10.136.176.31
set security ike gateway <Primary_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Primary_IKE_Gateway_Name> version v2-only
set security ike gateway <Failover_IKE_Gateway_Name> ike-policy <IKE_Policy_Name>
set security ike gateway <Failover_IKE_Gateway_Name> address <Failover_Gateway_IP_Address>
set security ike gateway <Failover_IKE_Gateway_Name> local-identity hostname srx123
set security ike gateway <Failover_IKE_Gateway_Name> remote-identity inet 10.136.176.30
set security ike gateway <Failover_IKE_Gateway_Name> external-interface ge-0/0/0.0
set security ike gateway <Failover_IKE_Gateway_Name> version v2-only
set security ipsec proposal <IPSec_Proposal_Name> protocol esp
set security ipsec proposal <IPSec_Proposal_Name> authentication-algorithm hmac-sha1-96
set security ipsec proposal <IPSec_Proposal_Name> lifetime-seconds 7200
set security ipsec policy <IPSec_Policy_Name> perfect-forward-secrecy keys group14
set security ipsec policy <IPSec_Policy_Name> proposals <IPSec_Proposal_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> bind-interface st0.0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike gateway <Primary_IKE_Gateway_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Primary_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Primary_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Primary_IPSec_VPN_Name> establish-tunnels immediately
set security ipsec vpn <Failover_IPSec_VPN_Name> bind-interface st0.1
set security ipsec vpn <Failover_IPSec_VPN_Name> ike gateway <Failover_IKE_Gateway_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity local 172.16.176.192/26
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity remote 0.0.0.0/0
set security ipsec vpn <Failover_IPSec_VPN_Name> ike proxy-identity service any
set security ipsec vpn <Failover_IPSec_VPN_Name> ike ipsec-policy <IPSec_Policy_Name>
set security ipsec vpn <Failover_IPSec_VPN_Name> establish-tunnels immediately
set security policies default-policy permit-all
set security zones security-zone all host-inbound-traffic system-services all
set security zones security-zone all host-inbound-traffic protocols all
set security zones security-zone all interfaces all
set interfaces ge-0/0/0 unit 0 family inet address 172.16.176.137/26
set interfaces ge-0/0/1 unit 0 family inet address 172.16.176.204/26
set interfaces st0 unit 0 family inet address 10.11.11.10/24
set interfaces st0 unit 1 family inet address 20.11.11.10/24
set routing-options static route 0.0.0.0/0 next-hop 172.16.176.129
set routing-options static route 185.199.0.0/16 next-hop st0.0
set routing-options static route 185.199.0.0/16 next-hop st0.1
set routing-options static route 9.8.7.6/32 next-hop st0.0
set routing-options static route 9.8.7.6/32 next-hop st0.1
set routing-options static route 164.100.133.0/24 next-hop st0.0
set routing-options static route 164.100.133.0/24 next-hop st0.1
set routing-options static route 8.8.8.8/32 next-hop st0.0
set routing-options static route 8.8.8.8/32 next-hop st0.1
トラブルシューティング
次のいずれかのコマンドを使用して、Juniperファイアウォール上のIPSecトンネルのトラブルシューティングを行うことができます。
IKE SAステータスの確認
IKEセキュリティアソシエーション（SA）に関する情報を表示するには、以下のコマンドを入力してください。
root> show security ike security-associations
Index State Initiator cookie Responder cookie Mode Remote Address
3267788 UP 7ff0b8be90fca7da 188629ab03675f57 IKEv2 10.136.176.30
3267789 UP 4b49d6cc1476a53b 009f5e70a44f767f IKEv2 10.136.176.31
root> show security ike security-associations detail
IKE peer 10.136.176.30, Index 3267788, Gateway Name: IKE_GW2
Role: Initiator, State: UP
Initiator cookie: 7ff0b8be90fca7da, Responder cookie: 188629ab03675f57
Exchange type: IKEv2, Authentication method: Pre-shared-keys
Local: 172.16.176.137:4500, Remote: 10.136.176.30:4500
Lifetime: Expires in 5803 seconds
Reauth Lifetime: Disabled
IKE Fragmentation: Enabled, Size: 576
Peer ike-id: 10.136.176.30
Xauth assigned IP: 0.0.0.0
Algorithms:
Authentication : hmac-sha1-96
Encryption : aes256-cbc
Pseudo random function: hmac-sha1
Diffie-Hellman group : DH-group-14
Traffic statistics:
Input bytes : 0
Output bytes : 0
Input packets: 0
Output packets: 0
Input fragmentated packets: 0
Output fragmentated packets: 0
IPSec security associations: 0 created, 0 deleted
Phase 2 negotiations in progress: 1
Negotiation type: Quick mode, Role: Initiator, Message ID: 0
Local: 172.16.176.137:4500, Remote: 10.136.176.30:4500
Local identity: srx123
Remote identity: 10.136.176.30
Flags: IKE SA is created
IKE peer 10.136.176.31, Index 3267789, Gateway Name: IKE_GW
Role: Initiator, State: UP
Initiator cookie: 4b49d6cc1476a53b, Responder cookie: 009f5e70a44f767f
Exchange type: IKEv2, Authentication method: Pre-shared-keys
Local: 172.16.176.137:4500, Remote: 10.136.176.31:4500
Lifetime: Expires in 6348 seconds
Reauth Lifetime: Disabled
IKE Fragmentation: Enabled, Size: 576
Peer ike-id: 10.136.176.31
Xauth assigned IP: 0.0.0.0
Algorithms:
Authentication : hmac-sha1-96
Encryption : aes256-cbc
Pseudo random function: hmac-sha1
Diffie-Hellman group : DH-group-14
Traffic statistics:
Input bytes : 0
Output bytes : 0
Input packets: 0
Output packets: 0
Input fragmentated packets: 0
Output fragmentated packets: 0
IPSec security associations: 0 created, 0 deleted
Phase 2 negotiations in progress: 1
Negotiation type: Quick mode, Role: Initiator, Message ID: 0
Local: 172.16.176.137:4500, Remote: 10.136.176.31:4500
Local identity: srx123
Remote identity: 10.136.176.31
Flags: IKE SA is created
IPSec SAステータスの確認
IPSecセキュリティアソシエーション（SA）に関する情報を表示するには、以下のコマンドを入力してください。
root> show security ipsec security-associations
Total active tunnels: 2
ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway
<131073 ESP: sha1 a340c94f 6268/ unlim - root 4500 10.136.176.31
>131073 ESP: sha1 ca7ab31e 6268/ unlim - root 4500 10.136.176.31
<131074 ESP: sha1 62db2a02 5399/ unlim - root 4500 10.136.176.30
>131074 ESP: sha1 ca197fcb 5399/ unlim - root 4500 10.136.176.30
root> show security ipsec security-associations detail
ID: 131073 Virtual-system: root, VPN Name: IPSEC_VPN
Local Gateway: 172.16.176.137, Remote Gateway: 10.136.176.31
Local Identity: ipv4_subnet(any:0,[0..7]=172.16.176.192/26)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Version: IKEv2
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.0
Port: 4500, Nego#: 66, Fail#: 0, Def-Del#: 0 Flag: 0x600a29
Tunnel events:
Wed Jul 14 2021 06:03:30: IKE SA rekey successfully completed (1 times)
Wed Jul 14 2021 06:01:45: IPSec SA rekey successfully completed (1 times)
Wed Jul 14 2021 04:13:18: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 04:13:18: IKE SA negotiation successfully completed (1 times)
Wed Jul 14 2021 04:13:17: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 03:48:36: IKE SA rekey successfully completed (4 times)
Wed Jul 14 2021 03:25:11: IPSec SA rekey successfully completed (4 times)
Tue Jul 13 2021 20:29:25: IPSec SA negotiation successfully completed (1 times)
Tue Jul 13 2021 20:29:25: IKE SA negotiation successfully completed (13 times)
Tue Jul 13 2021 20:28:27: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Tue Jul 13 2021 20:28:25: IPSec SA negotiation successfully completed (1 times)
Tue Jul 13 2021 20:27:27: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Tue Jul 13 2021 19:53:53: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 18:04:23: IKE SA negotiation successfully completed (10 times)
Tue Jul 13 2021 17:13:41: IKE SA rekey successfully completed (2 times)
Tue Jul 13 2021 13:34:21: IKE SA negotiation successfully completed (6 times)
Direction: inbound, SPI: a340c94f, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 6236 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 5672 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: ca7ab31e, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 6236 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 5672 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
ID: 131074 Virtual-system: root, VPN Name: IPSEC_VPN2
Local Gateway: 172.16.176.137, Remote Gateway: 10.136.176.30
Local Identity: ipv4_subnet(any:0,[0..7]=172.16.176.192/26)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Version: IKEv2
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.1
Port: 4500, Nego#: 53, Fail#: 0, Def-Del#: 0 Flag: 0x600a29
Tunnel events:
Wed Jul 14 2021 05:54:25: IKE SA rekey successfully completed (2 times)
Wed Jul 14 2021 05:47:16: IPSec SA rekey successfully completed (2 times)
Wed Jul 14 2021 02:15:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 02:15:29: IKE SA negotiation successfully completed (24 times)
Wed Jul 14 2021 02:14:32: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 02:14:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 02:13:32: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 02:13:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 02:12:32: IPSec SAs cleared as corresponding IKE SA deleted (1 times)
Wed Jul 14 2021 02:12:29: IPSec SA negotiation successfully completed (1 times)
Wed Jul 14 2021 01:21:18: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 23:31:27: IKE SA negotiation successfully completed (1 times)
Tue Jul 13 2021 23:00:25: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 21:10:25: IKE SA negotiation successfully completed (18 times)
Tue Jul 13 2021 20:00:23: IKE SA rekey successfully completed (1 times)
Tue Jul 13 2021 18:10:23: IKE SA negotiation successfully completed (5 times)
Direction: inbound, SPI: 62db2a02, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 5367 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 4780 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: ca197fcb, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 5367 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 4780 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: NULL
Anti-replay service: counter-based enabled, Replay window size: 64
Client Logs
nsadmin@VSRX-Ubuntu:~$ curl -v -k https://file-examples-com.github.io/uploads/2017/10/file-example_PDF_1MB.pdf 2>&1 | grep issuer:
issuer: C=IN,ST=Karnataka,L=Bangalore,O=CFW,OU=e02224c3afe0020a0ec95f4e8251c05e,CN=ca.dineshks.inskope.com,EMAIL=certadmin@netskope.com
nsadmin@VSRX-Ubuntu:~$
nsadmin@VSRX-Ubuntu:~$
nsadmin@VSRX-Ubuntu:~$ curl -v -k --silent https://ssp.karnataka.gov.in:8080 2>&1 | grep issuer:
issuer: C=IN,ST=Karnataka,L=Bangalore,O=CFW,OU=e02224c3afe0020a0ec95f4e8251c05e,CN=ca.dineshks.inskope.com,EMAIL=certadmin@netskope.com
nsadmin@VSRX-Ubuntu:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=78.2 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=115 time=77.4 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=115 time=77.2 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=115 time=77.3 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 77.230/77.575/78.253/0.524 ms
nsadmin@VSRX-Ubuntu:~$ ^C
nsadmin@VSRX-Ubuntu:~$ ping 9.8.7.6
PING 9.8.7.6 (9.8.7.6) 56(84) bytes of data.
64 bytes from 9.8.7.6: icmp_seq=1 ttl=60 time=76.3 ms
64 bytes from 9.8.7.6: icmp_seq=2 ttl=60 time=76.2 ms
64 bytes from 9.8.7.6: icmp_seq=3 ttl=60 time=76.9 ms
^C
--- 9.8.7.6 ping statistics ---
4 packets transmitted, 3 received, 25% packet loss, time 3004ms
rtt min/avg/max/mdev = 76.292/76.545/76.987/0.447 ms
nsadmin@VSRX-Ubuntu:~$ ^C