JUNOS Software with Enhanced Services Features

Release 9.1R4 of JUNOS software with enhanced services includes the following features. For more information, see the following manuals:

• JUNOS Software Migration Guide
• JUNOS Software with Enhanced Services Getting Started Guide
• J-series Services Routers Quick Start
• JUNOS Software Design and Implementation Guide
• JUNOS Software Interfaces and Routing Configuration Guide
• JUNOS Software Administration Guide
• JUNOS Software CLI Reference
• WXC Integrated Services Module Installation and Configuration Guide

Interfaces and Chassis

• HA Status LED for Chassis Clusters—The Services Router provides a high availability (HA) LED that is used to indicate the status of the router when it is deployed in single-chassis mode and when it is used in a chassis cluster. The HA LED indicates one of four states:
  • The router is not configured for clustering, or it is disabled.
  • All routers belonging to the cluster and all high availability links are available.
  • All routers belonging to the cluster are present, but some links are down.
  • A cluster member is missing or unreachable.
• High Availability Support for Route-Based IPSec VPNs—The Services Router enhances high availability with graceful failover by providing route-based IP Security (IPSec) VPN support in a chassis cluster, including the following features:
  • Site-to-site manual and Internet Key Exchange (IKE)-negotiated route-based IPSec VPNs
  • Next-hop tunnel binding (NHTB)
  • Dead peer detection (DPD)
  • VPN monitoring
  • Invalid Security Parameter Index (SPI)
  • Network Address Translation (NAT) traversal
  • Remote access IPSec VPNs for dynamic endpoints
  • Public key infrastructure (PKI)

Note: When configuring chassis clusters you are automatically in configure private mode. As a result, you must commit changes from the top of the hierarchy. For information about the configure private mode, see the JUNOS CLI User Guide.

Security Features

• Generation of Self-Signed Certificates—The Services Router supports generation of self-signed certificates.

  Self-signed certificates:

  • Attest to the identity of the person who creates and signs them.
  • Allow for use of Secure Sockets Layer (SSL)-based services without requiring that you obtain an identity certificate signed by a certificate authority (CA).

  The Services Router provides two methods for generating a self-signed certificate:

  • Automatic generation—The self-signed certificate is configured on the router as a factory default. This certificate enables the router to provide immediate access to SSL services, such as Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS), after it is initialized.
  • Manual generation—You can use the command-line interface (CLI) to generate a self-signed certificate, which can also be used to gain access to SSL services.

  Self-signed certificates are valid for 5 years from the time they are generated.

• SecurID for User Authentication—The Services Router supports several methods for performing user authentication. Release 9.1 adds support for use of SecurID as an external authentication method. SecurID user authentication is an RSA proprietary authentication method that supports use of static or dynamic passwords. Dynamic passwords consist of a user’s pin number and a randomly generated token. JUNOS software with enhanced services does not support use of authentication challenges.