[Contents] [Prev] [Next] [Index] [Report an Error]

Configure IPSec Services

To configure Internet Protocol Security (IPSec) services, you include the following statements at the [edit services ipsec-vpn] hierarchy level of the configuration: 

[edit services ipsec-vpn]

ike {

    proposal proposal-name {

        authentication-algorithm (md5 | sha1); 

        authentication-method (dsa-signatures | pre-shared-keys | rsa-signatures); 

        description description;

        dh-group (group1 | group2); 

        encryption-algorithm (3des-cbc | des-cbc); 

        lifetime-seconds seconds; 

    }

    policy policy-name {

        description description;

        local-id {

            fqdn [ values ];

            ipv4_addr [ values ];

            key_id [ values ];

        }

        mode (aggressive | main);

        pre-shared-key (ascii-text key | hexadecimal key);

        proposals [ proposal-names ];

        remote-id {

            fqdn [ values ];

            ipv4_addr [ values ];

            key_id [ values ];

        }

    }

}

ipsec {

    proposal proposal-name {

        authentication-algorithm (hmac-md5-96 | hmac-sha1-96); 

        description description;

        encryption-algorithm (3des-cbc | des-cbc); 

        lifetime-seconds seconds; 

        protocol (ah | esp | bundle); 

    } 

    policy policy-name {

        description description;

        perfect-forward-secrecy {

            keys (group1 | group2); 

        }

        proposals [ proposal-names ]; 

    } 

}

rule rule-name {

    match-direction (input | output);

    term term-name {

        from {

            destination-address address;

            source-address address;

        }

        then {

            dynamic {

                ike-policy policy-name;

                ipsec-policy policy-name;

            }

            manual (

                direction (inbound | outbound | bidirectional) {

                    authentication {

                        algorithm (hmac-md5-96 | hmac-sha1-96);

                        key (ascii-text key | hexadecimal key); 

                    }

                    auxiliary-spi spi-value;

                    encryption {

                        algorithm (des-cbc | 3des-cbc);

                        key (ascii-text key | hexadecimal key); 

                    }

                    protocol (ah | bundle | esp);

                    spi spi-value;

                }

            }

            clear-dont-fragment-bit;

            no-anti-replay:

            remote-gateway address;

            syslog;

        }

    }

}

rule-set rule-set-name {

    [ rule rule-names ];

}

This chapter includes the following sections:

[Contents] [Prev] [Next] [Index] [Report an Error]