Configure an Encryption Interface

When you configure the encryption interface, you associate the configured SA with a logical interface. This configuration defines the tunnel, including the logical unit, tunnel addresses, maximum transmission unit (MTU), optional interface addresses, and the name of the IPSec SA to apply to traffic. To configure an encryption interface, include the following statements at the [edit interfaces es-fpc/pic/port unit logical-unit-number] hierarchy level:

[edit interfaces es-fpc/pic/port unit logical-unit-number] 

family inet {

    ipsec-sa ipsec-sa;                                                 # name of security association to apply to packet

    address address {                      # local interface address inside local VPN

        destination address;                 # destination address inside remote VPN

    }

}

tunnel {

    source-address source-address;

    destination destination-address;

}

The addresses configured as the tunnel source and destination are the addresses in the outer IP header of the tunnel.

NOTE: You must configure the tunnel source address locally on the router, and the tunnel destination address must be a valid address for the security gateway terminating the tunnel. The M5, M10, M20, and M40 routers support the ES PIC.

The SA must be a valid tunnel-mode SA. The interface address and destination address listed are optional. The destination address allows the user to configure a static route to encrypt traffic. If a static route uses that destination address as the next hop, traffic is forwarded through the portion of the tunnel in which encryption occurs.

Specify the Security Association Name

The security association is the set of properties that defines the protocols for encrypting internet traffic. To configure encryption interfaces, you specify the security association (SA) name associated with the interface by including the ipsec-sa sa-name statement at the [edit interfaces es-fpc/pic/port unit logical-unit-number family inet] hierarchy level:

[edit interfaces es-fpc/pic/port unit logical-unit-number family inet]

ipsec-sa sa-name;

For information about configuring the security association, see Configure Traffic.

Configure MTU for an Encryption Interface

The protocol MTU value for encryption interfaces must always be less than the default interface MTU value of 3900 bytes; the configuration fails to commit if you select a greater value. To set the MTU value, include the mtu bytes statement at the [edit interfaces interface-name unit logical-unit-number family inet] hierarchy level:

[edit interfaces es-fpc/pic/port unit logical-unit-number family inet]

mtu bytes;

For more information, see the JUNOS Network Interfaces and Class of Service Configuration Guide.