A VPN provides a means by which remote computers communicate securely across a public WAN such as the Internet. VPN changes are published much like changes to firewall policies and IPS policies. You can publish and deploy a VPN configuration independently without waiting for a firewall, IPS, or NAT policy to get published first.
Read the IPsec VPN Overview topic.
Review the IPsec VPN main page for an understanding of your current data set. See IPsec VPN Main Page Fields for field descriptions.
Create addresses and address sets.
Create VPN profiles.
Define extranet devices.
To configure an IPsec VPN:
The IPsec VPNs page is displayed.
The corresponding create VPN page is displayed.
The Device Selection page is displayed.
Note You will be prompted to select devices before configuring the gateway. To view or edit devices click View/Select Devices.
Note If the profile type is Default, you can edit the IKE/IPSec Settings configurations. If the profile type is Shared Profile, you can only view the IKE/IPSec Settings configurations.
A new IPsec VPN is created.
Table 283: IPsec VPN Configuration Parameters
Settings | Guidelines |
---|---|
Name | Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores; spaces are not allowed; maximum length is 62 characters. This is a mandatory field. |
Description | Enter a description for the VPN; maximum length is 255 characters. |
Routing Topology | Select one of the following options:
Note: Routing Topology is applicable only for Route Based VPNs. |
VPN Profile | Select a VPN profile from the drop-down list based on the deployment scenario. Default profile is applicable to a particular IPsec VPN only. You can view and edit the details by clicking View IKE/IPsec settings on the Create IPsec VPN page. Shared profile can be used by one or more IPsec VPNs. You can only view the details of the shared profiles by clicking View IKE/IPsec settings on the Create IPsec VPN page. If you select the VPN Profile value as Default, then while saving the IPsec VPN, you’ll need to save the new profile as either VPN specific or shared. If you are saving it as shared, then the profile will be listed on the VPN Profiles page. |
Authentication Method | Select an authentication method. Note: If you select a shared VPN Profile, only the default authentication method is displayed. |
Shortcut Connection Limit | Select the maximum number of shortcut tunnels that can be created with different shortcut partners using a particular gateway. The maximum number, which is also the default, is platform-dependent. Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN). |
Idle Threshold | Select the rate, in packets per second, below which the shortcut is brought down. Range: 3 through 5,000 packets per second. Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN). |
Idle Time | Select the duration, in seconds, after which the shortcut is deleted if the traffic remains below the idle-threshold value. Range: 60 seconds through 86,400 seconds. Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN). |
Global Tunnel Settings | |
Preshared Key | Establish a VPN connection using preshared keys, which is essentially a password that is same for both parties. Preshared keys are commonly deployed for site-to-site IPsec VPNs, either within a single organization or between different organizations. Select the type of preshared key you want to use:
Note: This is applicable only if the authentication method is Preshared based. |
Max Transmission Unit | Select the maximum transmission unit (MTU) in bytes. This defines the maximum size of an IP packet, including the IPsec overhead. You can specify the MTU value for the tunnel endpoint. The valid range is 68 to 9192 bytes. The default value is 1500 bytes. |
Tunnel IP | Enter the IP address of the network. |
Table 284: VPN Topologies
VPN Topology | Description |
---|---|
Site to Site | ProcedureIf the VPN topology is Site o Site:
|
Hub and Spoke (Applicable for Hub and Spoke (Establishment All Peers), Hub and Spoke (Establishment by Spokes), and Hub and Spoke (ADVPN-Auto Discovery VPN) | ProcedureIf VPN Topology is Hub and Spoke:
Note: The topology displayed for hub and spoke is only a representation. You can configure any number of hubs and spokes. |
Full Mesh | ProcedureIf VPN Topology is Full Mesh:
Note: The topology displayed for full mesh is only a representation. Maximum of six nodes are displayed in the topology. You can configure any number of nodes. |
Remote VPN (Juniper Secure Connect) | ProcedureIf the VPN Topology is Remote VPN (Juniper Secure Connect):
|
Remote VPN NCP Client | ProcedureIf the VPN Topology is Remote VPN NCP Client:
|
Table 285: View or Select Devices
Settings | Guidelines |
---|---|
Device selection for Site to Site and Full Mesh Topology | |
Endpoint | Select either Devices or Extranet devices as endpoints. Note: To add extranet devices inline, click Add Extranet Devices. |
Available | View all devices from the current and child domains, with view parent enabled. Devices from the child domain with view parent disabled are not shown. You can select a device and add it as an endpoint. The following filter criteria are applied for the device selection:
|
Device selection for Hub and Spoke | |
Hub | Select either Devices or Extranet devices as Hub. |
Spoke | Select either Devices or Extranet devices as Spoke. |
Table 286: Device Configuration Parameters
Settings | Guidelines |
---|---|
IPv4 Address | Enter the IP address of the network. Note: This is applicable only when the Routing Topology is OSPF-Dynamic Routing, RIP-Dynamic Routing, or eBGP-Dynamic Routing in case of Site to Site and Hub and Spoke topology. In Full Mesh VPN topology, it is applicable to OSPF-Dynamic Routing Topology and RIP-Dynamic Routing Topology. |
Subnet Mask | Enter the subnet mask. Note: This is applicable only when the Routing Topology is OSPF-Dynamic Routing, RIP-Dynamic Routing, or eBGP-Dynamic Routing in case of Site to Site and Hub and Spoke topology. In Full Mesh VPN topology, it is applicable to OSPF-Dynamic Routing Topology and RIP-Dynamic Routing Topology. |
External Interface | Select the outgoing interface for IKE security associations (SAs). This interface is associated with a zone that acts as its carrier, providing firewall security for it. |
Tunnel Zone | Select the tunnel zone. They are logical areas of address space that can support dynamic IP (DIP) address pools for NAT applications to pre- and post-encapsulated IPsec traffic. Tunnel zones also provide great flexibility in combining tunnel interfaces with VPN tunnels. |
Metric | Specify the cost for an access route for the next hop. Note: This is applicable only if the VPN topology is Hub and Spoke and Full Mesh. |
Routing instance | Select the required routing instance. |
Initiator/Recipient | Select an option:
Note: This is applicable when the IKE mode is Aggressive. |
External IP address | Enter the external IP address. |
Certificate | Select a certificate to authenticate the virtual private network (VPN) initiator and recipient. This is applicable in one of the following scenarios:
|
Trusted CA/Group | Select a Trusted CA/Group. This is applicable in one of the following scenarios:
|
Export |
|
OSPF Area | Select an OSPF area ID within the range of 0 to 4,294,967,295, where the tunnel interfaces of this VPN need to be configured. This is applicable when the Routing Topology is OSPF-Dynamic Routing in Site to Site VPN topology. |
Max Retransmission Time | Select the retransmission timer to limit the number of times the RIP demand circuit re-sends update messages to an unresponsive peer. If the configured retransmission threshold is reached, routes from the next-hop router are marked as unreachable and the hold-down timer starts. You must configure a pair of RIP demand circuits for this timer to take effect. The retransmission range is from 5 through 180 seconds and the default value is 50 seconds. Note: This is applicable only when Routing Topology is RIP-Dynamic Routing. |
AS Number | Select a unique number to assign to the autonomous system (AS). The AS number identifies an autonomous system and enables the system to exchange exterior routing information with other neighboring autonomous systems. The valid range is from 0 through 4294967295. Note: This is applicable only when Routing Topology is e-BGP Dynamic Routing. |
Protected Networks | Configure the addresses or interface type for the selected device to protect one area of the network from the other. When a dynamic routing protocol is selected, the interface option is displayed. Note: You can also create inline addresses by clicking Add New Address. |
Table 287: View or Edit IKE or IPsec Settings
Settings | Guidelines |
---|---|
IKE Settings | |
IKE Version | Select the required IKE version, either V1 or V2, that is used to negotiate dynamic security associations (SAs) for IPsec. By default, IKE V2 is used. |
Mode | Select an IKE policy mode.
Note: Mode is applicable when the IKE Version is V1. |
Encryption-algorithm | Select the appropriate encryption mechanism. |
Authentication-algorithm | Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet. |
Deffie Hellman group | Select a group. Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. |
Lifetime-seconds | Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds. |
Dead Peer Detection | Enable to permit the two gateways to determine if the peer gateway is up and responding to the Dead Peer Detection (DPD) messages that are negotiated during IPsec establishment. |
DPD Mode | Select a DPD Mode. Optimized: R-U-THERE messages are triggered if there is no incoming IKE or IPsec traffic within a configured interval after the device sends outgoing packets to the peer. This is the default mode. Probe Idle Tunnel: R-U-THERE messages are triggered if there is no incoming or outgoing IKE or IPsec traffic within a configured interval. R-U-THERE messages are sent periodically to the peer until there is traffic activity. Always-send: R-U-THERE messages are sent at configured intervals regardless of traffic activity between the peers. |
DPD Interval | Select an interval in seconds to send dead peer detection messages. The default interval is 10 seconds, with a permissible range of 2 to 60 seconds. |
DPD Threshold | Select the failure DPD threshold value. This specifies the maximum number of times the DPD messages must be sent when there is no response from the peer. The default number of transmissions is 5 times, with a permissible range of 1 to 5. |
Advance Configuration | |
General IKE ID | Enable this option to accept peer IKE ID. This option is disabled by default. If General IKE ID is enabled, the IKE ID option is disabled automatically. |
IKEv2 Re Authentication | Select a reauthentication frequency. Reauthentication can be disabled by setting the reauthentication frequency to 0. Range is 0 to 100. |
IKEv2 Re Fragmentation Support | IKEv2 fragmentation splits a large IKEv2 message into a set of smaller ones so that there is no fragmentation at the IP level. |
IKEv2 Re-fragment Size | Select the size of the packet at which messages are fragmented. By default, the size is 576 bytes for IPv4. Range is 570 to 1320. |
IKE ID | Select an option:
IKE ID is applicable only when General IKE ID is disabled. |
NAT-T | Enable Network Address Translation-Traversal (NAT-T) if the dynamic endpoint is behind a NAT device. |
Keep Alive | Select a value. NAT Keepalives are required to maintain the NAT translation during the connection between the VPN peers. Range is from 1 to 300 seconds. |
IPSec Settings | |
Protocol | Select the required protocol to establish the VPN.
|
Encryption Algorithm | Select the necessary encryption method. This is applicable if the Protocol is ESP. |
Authentication Algorithm | Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet. |
Perfect Forward Secrecy | Select Perfect Forward Secrecy (PFS) as the method that the device uses to generate the encryption key. The PFS generates each new encryption key independently from the previous key. The higher numbered groups provide more security but require more processing time. |
Lifetime Seconds | Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds. |
Lifetime kilobytes | Select the lifetime (in kilobytes) of an IPsec security association (SA). The range is from 64 through 4294967294 kilobytes. |
Establish Tunnel | Select an option to specify when IKE is activated.
|
Advance Configuration | |
VPN Monitor | Enable this option to send Internet Control Message Protocol (ICMP) to determine if the VPN is up. |
Optimized | Enable the Optimized option. When VPN monitoring optimization is enabled, the SRX Series device only sends ICMP echo requests (pings) when there is outgoing traffic and no incoming traffic from the configured peer through the VPN tunnel. If there is incoming traffic through the VPN tunnel, the SRX Series device considers the tunnel to be active and does not send pings to the peer. |
Anti Replay | By default, Anti-Replay detection is enabled. IPsec protects against the VPN attack by using a sequence of numbers that are built into the IPsec packet—the system does not accept a packet for which it has already seen the same sequence number. It essentially checks the sequence numbers and enforces the check, rather than just ignoring the sequence numbers. Disable it if there is an error with the IPsec mechanism that results in out-of-order packets, preventing proper functionality. |
Install interval | Select the maximum number of seconds to allow for the installation of a re-keyed outbound security association (SA) on the device. |
Idle Time | Select the appropriate idle time interval. The sessions and their corresponding translations typically time out after a certain period if no traffic is received. |
DF Bit | Select an option to process the Don’t Fragment (DF) bit in IP messages.
|
Copy Outer DSCP | Enable copying of Differentiated Services Code Point (DSCP) field from the outer IP header encrypted packet to the inner IP header plain text message on the decryption path. The benefit in enabling this feature is that after IPsec decryption, clear text packets can follow the inner CoS rules. |