[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Configuring an IPsec Policy (Standard and Dynamic VPNs)

When configuring Phase 2 of an IPsec tunnel, you first configure proposals, then policies, and finally you configure IPsec AutoKey (IKE). The following example-based instructions show how to create the policy.

Before You Begin
For background information about standard IPsec VPNs, read: Virtual Private Networks (VPNs) Overview Understanding IKE and IPsec Packet Processing Configuring an IPsec Tunnel—Overview For background information about dynamic IPsec VPNs, read: Dynamic VPN Overview. Configuring a Dynamic VPN—Overview.

Before You Begin

For background information about standard IPsec VPNs, read:

For background information about dynamic IPsec VPNs, read:

In Phase 2 IPsec policy configuration, you must create a policy and reference a Phase 2 proposal. In this example, you create a policy called ipsec_pol_1 and reference the proposal ipsec_prop_1. You also configure Perfect Forward Secrecy to use Diffie-Hellman Group 2 as the method the device uses to generate the encryption key.

To configure IPsec policies, use either the J-Web or the CLI configuration editor. (For information about configuring IPsec policies using J-Web Quick Configuration pages, see Configuring an IPsec Policy—Quick Configuration (Standard VPNs)or Configuring an IPsec Policy—Quick Configuration (Dynamic VPNs).)

This topic covers:

J-Web Configuration

To configure an IPsec policy in J-Web:

Select Configure>CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Ipsec, click Configure or Edit.
Next to Policy, click Add new entry.
In the Name box, type Ipsec_pol_1.
In the Description box, type new Ipsec policy.
Next to Perfect forward secrecy, click Configure.
From the Keys list, select group2 and click OK.
Next to Proposals, click Add new entry.
In the Value keyword box, type Ipsec_prop_1 and click OK.
To save and commit the configuration, click Commit.

CLI Configuration

To configure an IPsec policy using the CLI editor:


            
               user@host# set security ipsec policy ipsec_pol_1
                     description "new ipsec policy"
               user@host# set security ipsec policy ipsec_pol_1
                     perfect-forward-secrecy keys group2
               user@host# set security ipsec policy ipsec_pol_1
                     proposals ipsec_prop_1

Use the following command to display information about this IKE proposal:


            
               user@host# show security ipsec policy ipsec_pol_1

[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]