Technical Documentation

Downloads
IPSec Feature Guide, JUNOS Release 9.6

Technical Documentation

IPSec

IPSec is a framework for ensuring secure private communication over IP networks and is based on standards developed by the International Engineering Task Force 4 (IETF).

OverviewConfigurationExamplesAdministration

Product Overview

IPSec-Enabled PICs

Authentication Algorithms

Encryption Algorithms

IPSec Protocols

Security Associations

Digital Certificates

System Requirements
System Requirements

Glossary
Terms and Acronyms

IPSec Configuration

Considering General IPSec Issues

Configuring Security Associations

Using a Filter to Select Traffic to Be Secured

Applying the Filter or Service Set to the Interface Receiving Traffic to Be Secured

Digital Certificates

Configuring a CA Profile

Configuring a Certificate Revocation List

Requesting a CA Digital Certificate

Generating a Private/Public Key Pair

Generating and Enrolling a Local Digital Certificate

Applying the Local Digital Certificate to an IPSec Configuration

Configuring Automatic Reenrollment of Digital Certificates

Monitoring Digital Certificates

Clearing Digital Certificates

Other Options

Option: Using Filter-Based Forwarding to Select Traffic to Be Secured

Option: Using IPSec with a Layer 3 VPN

Option: Securing BGP Sessions with Transport Mode

Option: Securing OSPFv3 Networks with Transport Mode

Option: Securing OSPFv2 Networks with Transport Mode

Option: Monitoring IPSec by Using SNMP

Option: Configuring Multiple Routed Tunnels in a Single Next-Hop Service Set

IPSec Dynamic Endpoints

Option: Configuring IPSec Dynamic Endpoints

Dynamic Endpoint Tunnel Architecture

Authentication Process

Dynamic Implicit Rules

Reverse Route Insertion

Configuring an IKE Access Profile

Configuring the Service Set

Configuring the Interface Identifier

IPSec Configuration Examples

Example: ES PIC Manual SA Configuration

Example: AS PIC Manual SA Configuration

Example: ES PIC IKE Dynamic SA Configuration

Example: AS PIC IKE Dynamic SA Configuration

Example: IKE Dynamic SA Between an AS PIC and an ES PIC Configuration

Example: AS PIC IKE Dynamic SA with Digital Certificates Configuration

Example: Dynamic Endpoint Tunneling Configuration

IPSec Commands

clear security pki ca-certificate

clear security pki certificate-request

clear security pki crl

clear security pki local-certificate

request security certificate (signed)

request security certificate (unsigned)

request security key-pair

request security pki ca-certificate enroll

request security pki ca-certificate load

request security pki generate-certificate-request

request security pki generate-key-pair

request security pki local-certificate enroll

request security pki local-certificate load

request system certificate add

show ike security-associations

show ipsec certificates

show security pki ca-certificate

show ipsec security-associations

show security pki certificate-request

show security pki crl

show security pki local-certificate

show services ipsec-vpn certificates

show services ipsec-vpn ike security-associations

show services ipsec-vpn ipsec security-associations

show system certificate