Create a Remote Access VPN NCP Exclusive Client

Name

Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores; spaces are not allowed; maximum length is 62 characters. This is a mandatory field.

Routing Topology

Select one of the following options:

• Traffic Selector (Auto Route Insertion)—A traffic selector is an agreement between Internet Key Exchange (IKE) peers to permit traffic through a tunnel if the traffic matches a specified pair of local and remote addresses.

• Static routing—Generates static routing based on the protected networks or zones per device.

• OSPF-Dynamic Routing—Generates OSPF configuration.

• RIP-Dynamic Routing—Generates RIP configuration.

• eBGP-Dynamic Routing—Generates eBGP configuration.

  Note: eBGP-Dynamic Routing is not applicable for Full Mesh VPN topology.

Note: Routing Topology is applicable only for Route Based VPNs.

Authentication Method

Select an authentication method.

Note: If you select a shared VPN Profile, only the default authentication method is displayed.

Idle Threshold

Select the rate, in packets per second, below which the shortcut is brought down.

Range: 3 through 5,000 packets per second.

Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN).

Max Transmission Unit

Select the maximum transmission unit (MTU) in bytes. This defines the maximum size of an IP packet, including the IPsec overhead. You can specify the MTU value for the tunnel endpoint. The valid range is 68 to 9192 bytes. The default value is 1500 bytes.

Endpoint

Select a device to add it as an endpoint.

Gateway is behind NAT

Enable this option when the local gateway is behind a NAT device.

External Interface

Select the outgoing interface for IKE security associations (SAs). This interface is associated with a zone that acts as its carrier, providing firewall security for it.

User Authentication

This field is mandatory. Select the authentication profile from the list that will be used to authenticate user accessing the remote access VPN.

Click Add to create a new Profile. For more information on creating a new access profile, see Add an Access Profile.

Note: LDAP authentication is not supported in remote VPN.

NAT Traffic

Enable this option so that all traffic from the Juniper Secure Connect client is NATed to the selected interface by default.

If disabled, you must ensure that you have a route from your network pointing to the SRX Series devices for handling the return traffic correctly.

Trusted CA/Group

Select a Trusted CA/Group.

This is applicable in one of the following scenarios:

• The VPN profile with authentication method RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

• The authentication method is RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

Mode

Select an IKE policy mode.

• Main—Uses six messages in three peer-to-peer exchanges to establish the IKE SA. These three steps include the IKE SA negotiation, a Diffie-Hellman exchange, and authentication of the peer. Also provides identity protection.

• Aggressive—Takes half the number of messages of main mode, has less negotiation power, and does not provide identity protection.

Note: Mode is applicable when the IKE Version is V1.

Authentication-algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

Lifetime-seconds

Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

DPD Mode

Select a DPD Mode. Optimized: R-U-THERE messages are triggered if there is no incoming IKE or IPsec traffic within a configured interval after the device sends outgoing packets to the peer. This is the default mode. Probe Idle Tunnel: R-U-THERE messages are triggered if there is no incoming or outgoing IKE or IPsec traffic within a configured interval. R-U-THERE messages are sent periodically to the peer until there is traffic activity. Always-send: R-U-THERE messages are sent at configured intervals regardless of traffic activity between the peers.

DPD Threshold

Select the failure DPD threshold value. This specifies the maximum number of times the DPD messages must be sent when there is no response from the peer. The default number of transmissions is 5 times, with a permissible range of 1 to 5.

General IKE ID

Enable this option to accept peer IKE ID. This option is disabled by default. If General IKE ID is enabled, the IKE ID option is disabled automatically.

IKEv2 Re Fragmentation Support

IKEv2 fragmentation splits a large IKEv2 message into a set of smaller ones so that there is no fragmentation at the IP level.

IKE ID

Select an option:

• None

• Distinguished name

• Hostname

• IPv4 address

• E-mail Address

IKE ID is applicable only when General IKE ID is disabled.

Keep Alive

Select a value. NAT Keepalives are required to maintain the NAT translation during the connection between the VPN peers. Range is from 1 to 300 seconds.

Protocol

Select the required protocol to establish the VPN.

• ESP—The Encapsulating Security Payload (ESP) protocol provides both encryption and authentication.

• AH—The Authentication Header (AH) protocol provides data integrity and data authentication.

Authentication Algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

Lifetime Seconds

Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

Establish Tunnel

Select an option to specify when IKE is activated.

• Immediately—IKE is activated immediately after VPN configuration changes are committed.

• On-traffic—IKE is activated only when data traffic flows and must be negotiated with the peer gateway. This is the default behavior.

VPN Monitor

Enable this option to send Internet Control Message Protocol (ICMP) to determine if the VPN is up.

Anti Replay

By default, Anti-Replay detection is enabled. IPsec protects against the VPN attack by using a sequence of numbers that are built into the IPsec packet—the system does not accept a packet for which it has already seen the same sequence number. It essentially checks the sequence numbers and enforces the check, rather than just ignoring the sequence numbers. Disable it if there is an error with the IPsec mechanism that results in out-of-order packets, preventing proper functionality.

Idle Time

Select the appropriate idle time interval. The sessions and their corresponding translations typically time out after a certain period if no traffic is received.

Copy Outer DSCP

Enable copying of Differentiated Services Code Point (DSCP) field from the outer IP header encrypted packet to the inner IP header plain text message on the decryption path. The benefit in enabling this feature is that after IPsec decryption, clear text packets can follow the inner CoS rules.