Create a Remote Access VPN NCP Exclusive Client

The NCP Exclusive Remote Access Client is part of the NCP Exclusive Remote Access solution for Juniper SRX Series Gateways. The VPN client is only available with NCP Exclusive Remote Access Management. Use the NCP Exclusive Client to establish secure, IPsec-based data links from any location when connected with SRX Series Gateways.

Before You Begin

Procedure

To configure an IPsec VPN:

  1. Select Configure > IPsec VPN > IPsec VPNs.

    The IPsec VPNs page is displayed.

  2. Click Create VPN > <Route Based> Remote Access NCP Exclusive Client.

    The Create Remote Access (NCP Exclusive Client) page is displayed.

  3. Complete the IPsec VPN configuration parameters according to the guidelines provided in Table 273.
  4. Click the Local Gateway icon in the topology to configure the local gateway.

    The Device Selection page is displayed.

  5. Select the endpoint according to the guidelines in Table 275.
  6. Click OK.

    The Device page is displayed.

  7. Complete the configuration according to the guidelines in Table 276
  8. Click OK.
  9. Click View IKE/IPSec Settings and complete the configurations according to the guidelines provided in Table 277.

    Note If the profile type is Default, you can edit the IKE/IPSec Settings configurations. If the profile type is Shared Profile, you can only view the IKE/IPSec Settings configurations.

  10. Click Save to create a remote access VPN.

Table 308: IPsec VPN Configuration Parameters

 

Settings

Guidelines

Name

Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores; spaces are not allowed; maximum length is 62 characters. This is a mandatory field.

Description

Enter a description for the VPN; maximum length is 255 characters.

Routing Topology

Select one of the following options:

  • Traffic Selector (Auto Route Insertion)—A traffic selector is an agreement between Internet Key Exchange (IKE) peers to permit traffic through a tunnel if the traffic matches a specified pair of local and remote addresses.

  • Static routing—Generates static routing based on the protected networks or zones per device.

  • OSPF-Dynamic Routing—Generates OSPF configuration.

  • RIP-Dynamic Routing—Generates RIP configuration.

  • eBGP-Dynamic Routing—Generates eBGP configuration.

    Note: eBGP-Dynamic Routing is not applicable for Full Mesh VPN topology.

Note: Routing Topology is applicable only for Route Based VPNs.

VPN Profile

Select a VPN profile from the drop-down list based on the deployment scenario.

Default profile is applicable to a particular IPsec VPN only. You can view and edit the details by clicking View IKE/IPsec settings on the Create IPsec VPN page.

Shared profile can be used by one or more IPsec VPNs. You can only view the details of the shared profiles by clicking View IKE/IPsec settings on the Create IPsec VPN page.

If you select the VPN Profile value as Default, then while saving the IPsec VPN, you’ll need to save the new profile as either VPN specific or shared. If you are saving it as shared, then the profile will be listed on the VPN Profiles page.

Authentication Method

Select an authentication method.

Note: If you select a shared VPN Profile, only the default authentication method is displayed.

Shortcut Connection Limit

Select the maximum number of shortcut tunnels that can be created with different shortcut partners using a particular gateway. The maximum number, which is also the default, is platform-dependent.

Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN).

Idle Threshold

Select the rate, in packets per second, below which the shortcut is brought down.

Range: 3 through 5,000 packets per second.

Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN).

Idle Time

Select the duration, in seconds, after which the shortcut is deleted if the traffic remains below the idle-threshold value.

Range: 60 seconds through 86,400 seconds.

Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN).

Global Tunnel Settings

Preshared Key

Establish a VPN connection using preshared keys, which is essentially a password that is same for both parties. Preshared keys are commonly deployed for site-to-site IPsec VPNs, either within a single organization or between different organizations.

Select the type of preshared key you want to use:

  • Autogenerate—Select if you want to automatically generate a unique key per tunnel. When selected, the Generate Unique key per tunnel is automatically enabled. If you disable Generate Unique key per tunnel, Security Director generates a single key for all tunnels.

  • Manual—Select to enter the key manually. By default, the manual key is masked.

Note: This is applicable only if the authentication method is Preshared based.

Max Transmission Unit

Select the maximum transmission unit (MTU) in bytes. This defines the maximum size of an IP packet, including the IPsec overhead. You can specify the MTU value for the tunnel endpoint. The valid range is 68 to 9192 bytes. The default value is 1500 bytes.

Tunnel IP

Enter the IP address of the network.

Table 309: View or Select Devices

 

Settings

Guidelines

Endpoint

Select a device to add it as an endpoint.

Available

View all devices from the current and child domains, with view parent enabled. Devices from the child domain with view parent disabled are not shown.

You can select a device and add it as an endpoint.

The following filter criteria are applied for the device selection:

  • SRX Series devices mapped to Junos OS Release 12.1X46 and later Junos-es schemas are not shown.

  • Logical systems are not shown.

  • Routing option is not applicable.

Table 310: Local Gateway Configuration Parameters

 

Settings

Guidelines

Gateway is behind NAT

Enable this option when the local gateway is behind a NAT device.

IKE Identity

Enter the IKE ID in the format user@example.com.

External Interface

Select the outgoing interface for IKE security associations (SAs). This interface is associated with a zone that acts as its carrier, providing firewall security for it.

Tunnel Zone

Select the tunnel zone. They are logical areas of address space that can support dynamic IP (DIP) address pools for NAT applications to pre- and post-encapsulated IPsec traffic.

Tunnel zones also provide great flexibility in combining tunnel interfaces with VPN tunnels.

User Authentication

This field is mandatory. Select the authentication profile from the list that will be used to authenticate user accessing the remote access VPN.

Click Add to create a new Profile. For more information on creating a new access profile, see Add an Access Profile.

Note: LDAP authentication is not supported in remote VPN.

SSL VPN Profile

Select the SSL VPN Profile from the list that will be used to terminate the remote access connections.

Procedure

To create a new SSL VPN profile:

  1. Click Add.

    The Add SSL VPN Profile page is displayed.

  2. Enter the name for a SSL VPN profile.
  3. Enable Logging option to log for SSL VPN.
  4. Enter a SSL termination profile name.
  5. Select a server certificate from the list.
  6. Click OK.

NAT Traffic

Enable this option so that all traffic from the Juniper Secure Connect client is NATed to the selected interface by default.

If disabled, you must ensure that you have a route from your network pointing to the SRX Series devices for handling the return traffic correctly.

Certificate

Select a certificate to authenticate the virtual private network (VPN) initiator and recipient.

This is applicable in one of the following scenarios:

  • The VPN profile with authentication method RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

  • The authentication method is RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

Trusted CA/Group

Select a Trusted CA/Group.

This is applicable in one of the following scenarios:

  • The VPN profile with authentication method RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

  • The authentication method is RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

Protected Networks

Configure the addresses or interface type for the selected device to protect one area of the network from the other.

When a dynamic routing protocol is selected, the interface option is displayed.

Note: You can also create inline addresses by clicking Add New Address.

Table 311: View or Edit IKE or IPsec Settings

 

Settings

Guidelines

IKE Settings

IKE Version

Select the required IKE version, either V1 or V2, that is used to negotiate dynamic security associations (SAs) for IPsec. By default, IKE V2 is used.

Mode

Select an IKE policy mode.

  • Main—Uses six messages in three peer-to-peer exchanges to establish the IKE SA. These three steps include the IKE SA negotiation, a Diffie-Hellman exchange, and authentication of the peer. Also provides identity protection.

  • Aggressive—Takes half the number of messages of main mode, has less negotiation power, and does not provide identity protection.

Note: Mode is applicable when the IKE Version is V1.

Encryption-algorithm

Select the appropriate encryption mechanism.

Authentication-algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

Deffie Hellman group

Select a group. Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process.

Lifetime-seconds

Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

Dead Peer Detection

Enable to permit the two gateways to determine if the peer gateway is up and responding to the Dead Peer Detection (DPD) messages that are negotiated during IPsec establishment.

DPD Mode

Select a DPD Mode. Optimized: R-U-THERE messages are triggered if there is no incoming IKE or IPsec traffic within a configured interval after the device sends outgoing packets to the peer. This is the default mode. Probe Idle Tunnel: R-U-THERE messages are triggered if there is no incoming or outgoing IKE or IPsec traffic within a configured interval. R-U-THERE messages are sent periodically to the peer until there is traffic activity. Always-send: R-U-THERE messages are sent at configured intervals regardless of traffic activity between the peers.

DPD Interval

Select an interval in seconds to send dead peer detection messages. The default interval is 10 seconds, with a permissible range of 2 to 60 seconds.

DPD Threshold

Select the failure DPD threshold value. This specifies the maximum number of times the DPD messages must be sent when there is no response from the peer. The default number of transmissions is 5 times, with a permissible range of 1 to 5.

Advance Configuration

General IKE ID

Enable this option to accept peer IKE ID. This option is disabled by default. If General IKE ID is enabled, the IKE ID option is disabled automatically.

IKEv2 Re Authentication

Select a reauthentication frequency. Reauthentication can be disabled by setting the reauthentication frequency to 0.

Range is 0 to 100.

IKEv2 Re Fragmentation Support

IKEv2 fragmentation splits a large IKEv2 message into a set of smaller ones so that there is no fragmentation at the IP level.

IKEv2 Re-fragment Size

Select the size of the packet at which messages are fragmented. By default, the size is 576 bytes for IPv4.

Range is 570 to 1320.

IKE ID

Select an option:

  • None

  • Distinguished name

  • Hostname

  • IPv4 address

  • E-mail Address

IKE ID is applicable only when General IKE ID is disabled.

NAT-T

Enable Network Address Translation-Traversal (NAT-T) if the dynamic endpoint is behind a NAT device.

Keep Alive

Select a value. NAT Keepalives are required to maintain the NAT translation during the connection between the VPN peers. Range is from 1 to 300 seconds.

IPSec Settings

Protocol

Select the required protocol to establish the VPN.

  • ESP—The Encapsulating Security Payload (ESP) protocol provides both encryption and authentication.

  • AH—The Authentication Header (AH) protocol provides data integrity and data authentication.

Encryption Algorithm

Select the necessary encryption method.

This is applicable if the Protocol is ESP.

Authentication Algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

Perfect Forward Secrecy

Select Perfect Forward Secrecy (PFS) as the method that the device uses to generate the encryption key. The PFS generates each new encryption key independently from the previous key. The higher numbered groups provide more security but require more processing time.

Lifetime Seconds

Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

Lifetime kilobytes

Select the lifetime (in kilobytes) of an IPsec security association (SA). The range is from 64 through 4294967294 kilobytes.

Establish Tunnel

Select an option to specify when IKE is activated.

  • Immediately—IKE is activated immediately after VPN configuration changes are committed.

  • On-traffic—IKE is activated only when data traffic flows and must be negotiated with the peer gateway. This is the default behavior.

Advance Configuration

VPN Monitor

Enable this option to send Internet Control Message Protocol (ICMP) to determine if the VPN is up.

Optimized

Enable the Optimized option. When VPN monitoring optimization is enabled, the SRX Series device only sends ICMP echo requests (pings) when there is outgoing traffic and no incoming traffic from the configured peer through the VPN tunnel. If there is incoming traffic through the VPN tunnel, the SRX Series device considers the tunnel to be active and does not send pings to the peer.

Anti Replay

By default, Anti-Replay detection is enabled. IPsec protects against the VPN attack by using a sequence of numbers that are built into the IPsec packet—the system does not accept a packet for which it has already seen the same sequence number. It essentially checks the sequence numbers and enforces the check, rather than just ignoring the sequence numbers. Disable it if there is an error with the IPsec mechanism that results in out-of-order packets, preventing proper functionality.

Install interval

Select the maximum number of seconds to allow for the installation of a re-keyed outbound security association (SA) on the device.

Idle Time

Select the appropriate idle time interval. The sessions and their corresponding translations typically time out after a certain period if no traffic is received.

DF Bit

Select an option to process the Don’t Fragment (DF) bit in IP messages.

  • Clear—Disable the DF bit from the IP messages. This is the default.

  • Copy—Copy the DF bit to the IP messages.

  • Set—Enable the DF bit in the IP messages.

Copy Outer DSCP

Enable copying of Differentiated Services Code Point (DSCP) field from the outer IP header encrypted packet to the inner IP header plain text message on the decryption path. The benefit in enabling this feature is that after IPsec decryption, clear text packets can follow the inner CoS rules.