This section explains the steps to configure an
IPSec license and IPSec parameters, create an IPSec tunnel, and define
an ISAKMP/IKE policy. The next section contains configuration examples.
Configuring an IPSec License
By default, and with no IPSec tunnel license, you
can configure up to 10 IPSec tunnels on an ERX router. However, you
can purchase licenses that support the following IPSec tunnel maximums:
1000
2000
4000
8000
16000
32000
The number of additional tunnels is independent
of the number of ISMs installed in the router. However, the router
chassis enforces the following tunnel limits:
SRP 10G – 10,000
SRP 40G – 20,000
license
ipsec-tunnels
Use to specify an IPSec tunnel license.
Note:
Acquire the license from Juniper Networks Customer Services
and Support or from your Juniper Networks sales representative.
Add a preshared key that
the routers use to authenticate each other.
host1(config)#ipsec key manual pre-share 5.2.0.1
host1(config-manual-key)#key customerASecret
After you enter a preshared key, the
router encrypts the key and displays it in masked form to increase
the security of the key. If you need to reenter the key, you can enter
it in its masked form using this command.
(Optional) Set the global (default) lifetime for all SAs
on the router.
host1(config)#ipsec lifetime kilobytes 42000000
ipsec
key manual pre-share
Use to specify that a peer use a preshared key for authentication
during the tunnel establishment phase, and to display the prompt that
lets you enter the preshared key. To enter a key, use the key command.
Specify the peer by using its IP address or fully qualified
domain name (FQDN).
FQDNs are supported only for signaled tunnels.
The router must be in aggressive mode to use FQDNs with
preshared keys.
The identity string can include an optional user@ specification preceding the FQDN.
You must enter this command in the virtual router context
where the IP address of the peer is defined.
Example 1—using an IP Address
host1(config)#ipsec key manual pre-share ip
address 10.10.1.1
Use to set the global (default) lifetime in seconds or
volume of traffic in kilobytes. The IPSec lifetime applies to tunnels
that do not have a tunnel lifetime defined. When either limit is reached,
the SA is renegotiated.
To set a lifetime for all SAs on a tunnel, use the tunnel lifetime command.
To set a lifetime for a specific SA, use lifetime .
Example 1
host1(config)#ipsec lifetime kilobytes 42000000
Example 2
host1(config)#ipsec lifetime seconds 8600
Use the no version to restore
the default values of 4294967295 kilobytes and 28800 seconds (8 hours).
Use to create a transform set. Each transform in a set
provides a different combination of data authentication and confidentiality.
Transform sets used for manually configured tunnels can
have one transform.
Transform sets used for signaled tunnels can have up to
six transforms. The actual transform used on the tunnel is negotiated
with the peer. Transforms are numbered in a priority sequence in the
order in which you enter them.
To display the names of the transforms that you can use
in a transform set, issue the ipsec transform-set transformSetName ? command.
For security purposes, the router displays the key only
in masked form. If you delete the key or reboot the router to factory
defaults, you can use this command to reenter the key in its masked
form so that the key is not visible while you enter it.
To see the masked key, use the show config command.
Use to set the renegotiation time of the SAs in use by
this tunnel.
To configure the lifetime in number of seconds, use the seconds keyword to specify the lifetime in the range
1800–864000.The default value is 28800
seconds.
To configure the lifetime in amount of traffic, use the kilobytes keyword to specify the lifetime in the range
102400–4294967295. The default is an unlimited volume.
If you include the seconds keyword
as the first keyword on the command line, you can also include the kilobytes keyword on the same line.
Before either the volume of traffic or number of seconds
limit is reached, the SA is renegotiated, which ensures that the tunnel
does not go down during renegotiation.
Use to manually configure the authentication or encryption
algorithm sets and session keys for inbound SAs on a tunnel. You can
enter this command only on tunnels that have tunnel signaling set
to manual.
Use the online Help to see a list of available algorithm
sets.
Each key is an arbitrary hexadecimal string. If the algorithm
set includes:
DES, create an 8-byte key using 16 hexadecimal characters
3DES, create a 24-byte key using 48 hexadecimal characters
MD5, create a 16-byte key using 32 hexadecimal characters
SHA, create a 20-byte key using 40 hexadecimal characters
Use to manually configure the authentication or encryption
algorithm sets, SPI, and session keys for outbound SAs on a tunnel.
You can enter this command only on tunnels that have tunnel signaling
set to manual.
Use the online Help to see a list of available algorithm
sets.
The SPI is a number in the range 256–4294967295
that identifies an SA.
Each key is an arbitrary hexadecimal string. If the algorithm
set includes:
DES, create an 8-byte key using 16 hexadecimal characters
3DES, create a 24-byte key using 48 hexadecimal characters
MD5, create a 16-byte key using 32 hexadecimal characters
SHA, create a 20-byte key using 40 hexadecimal characters
You can use the ipsec option dpd command to enable dead peer detection (DPD) on the router. DPD is
also known as IKE keepalive. If an IPSec tunnel destination backup
is configured, the router redirects traffic to the alternate destination
when DPD detects a disconnection between the E Series router and the
regular tunnel destination. See tunnel
destination backup .
To enable DPD and create an alternate IPSec tunnel
destination for failover:
Enable DPD on the router.
host1(config)#ipsec option dpd
Enter virtual router mode. Specify the VR that contains
the source and destination addresses assigned to the tunnel interface
(that is, the transport virtual router context).
host1(config)#virtual-router vrA
host1:vrA(config)#
Create an IPSec tunnel, and specify the transport VR.
Use to specify the address or identity of the remote IPSec
tunnel endpoint that is a backup tunnel destination. When DPD detects
a disconnection between the E Series router and the regular IPSec
tunnel destination, the router redirects traffic to the tunnel destination
backup, and vice versa.
You can use either the IP address or fully qualified domain
name (FQDN) to identify the backup IPSec tunnel, however you must
use the same type of identity that is used to specify the regular
tunnel destination.
For signaled IPSec tunnels in cable
or DSL environments, use the FQDN to identify the tunnel destination
backup, which does not have a fixed IP address.
The identity string can include an optional user@ specification preceding the FQDN (this is also known
as a user FQDN).
Note:
If you use a FQDN to specify the IPSec tunnel destination backup,
the tunnel is not initiated by the ERX router. However, the router
does respond to negotiations for this backup tunnel.
Note:
The command replaces the ipsec isakmp-policy-rule command, which may be removed completely
in a future release.
Use to define an IKE policy.
When you enter the command, you include a number that
identifies the policy and assigns a priority to the policy. You can
number policies in the range 1–10000, with 1 having the highest
priority.
You can add up to 10 IKE policies per router.
Example
host1(config)#ipsec ike-policy-rule 3
host1(config-ike-policy)#
Use the no version to remove
policies. If you do not include a priority number with the no version, all policies are removed.
The IKE protocol enables peers to exchange informational
messages. The payload of these messages can be a notify type or a
delete type. These messages are expected to be protected (encrypted)
by the keys negotiated by the peers when they establish a security
association as a result of the IKE phase 1 exchange.
If a responder peer does not recognize the initiator-responder
cookie pair, it can send an invalid cookie notification message to
the initiator. The responder might fail to recognize the cookie pair
because it has lost the cookie, or because it deleted the cookie and
then the peer lost the delete notification. Upon receipt of the invalid
cookie notification, the initiator peer can delete the phase 1 state.
The ability to send the invalid cookie message
is disabled by default. You can issue the ipsec option
tx-invalid-cookie command to enable the feature on a
per-transport-VR basis.
Even when you configure this feature, the E Series
router does not respond when it receives an invalid cookie notification.
These notifications are unprotected by a phase 1 key exchange and
therefore are subject to denial-of-service (DOS) attacks. Instead,
the E Series router can determine when a phase 1 relationship has
gone stale by timeouts or use of dead peer detection (DPD). For this
reason, this feature is useful only when the E Series router is a
responding peer for non–E Series devices that cannot detect
when the phase 1 relationship goes stale.
ipsec
option tx-invalid-cookie
Use to enable the router to send an invalid cookie notification
to an IKE peer when the router does not recognize the initiator-responder
cookie pair.
Example
host1(config)#ipsec option tx-invalid-cookie
Use the no version to restore
the default, disabling the ability to send an invalid cookie notification.
