Encryption Interfaces Configuration Guidelines > Configuring an Encryption Interface

When you configure the encryption interface, you associate the configured SA with a logical interface. This configuration defines the tunnel, including the logical unit, tunnel addresses, maximum transmission unit (MTU), optional interface addresses, and the name of the IPSec SA to apply to traffic. To configure an encryption interface, include the following statements at the [edit interfaces es-fpc/pic/port unit logical-unit-number] hierarchy level:

family inet {

    ipsec-sa ipsec-sa;                                                 # name of security association to apply to packet

    address address {                   # local interface address inside local VPN

        destination address;                 # destination address inside remote VPN

    }

}

tunnel {

    source source-address;

    destination destination-address;

}

The addresses configured as the tunnel source and destination are the addresses in the outer IP header of the tunnel.

NOTE: You must configure the tunnel source address locally on the router, and the tunnel destination address must be a valid address for the security gateway terminating the tunnel. The ES Physical Interface Card (PIC) is supported on M-series and T-series routing platforms.

The SA must be a valid tunnel-mode SA. The interface address and destination address listed are optional. The destination address allows the user to configure a static route to encrypt traffic. If a static route uses that destination address as the next hop, traffic is forwarded through the portion of the tunnel in which encryption occurs.

Specifying the Security Association Name

The security association is the set of properties that defines the protocols for encrypting internet traffic. To configure encryption interfaces, you specify the SA name associated with the interface by including the ipsec-sa statement at the [edit interfaces es-fpc/pic/port unit logical-unit-number family inet] hierarchy level:

ipsec-sa sa-name;

For information about configuring the security association, see Configuring Traffic.

Configuring the MTU for an Encryption Interface

The protocol MTU value for encryption interfaces must always be less than the default interface MTU value of 3900 bytes; the configuration fails to commit if you select a greater value. To set the MTU value, include the mtu statement at the [edit interfaces interface-name unit logical-unit-number family inet] hierarchy level:

mtu bytes;

For more information, see the JUNOS Network Interfaces Configuration Guide.