Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configuring VPN on a Device Running Junos OS

 

This section describes sample configurations of an IPsec VPN on a Junos OS device using the following IKE authentication methods:

Figure 1 illustrates the VPN topology used in all the examples described in this section. Here, H0 and H1 are the host PCs, R0 and R2 are the two endpoints of the IPsec VPN tunnel, and R1 is a router to route traffic between the two different networks.

The security association (SA) lifetimes are configured using the IKE proposal for IKE (Phase 1 or SA) and IPsec proposal for IPsec (Phase 2 or Child SAs). Both IKEv1 and IKEv2 support time-based lifetimes IKEv2 also supports traffic based lifetimes. For IPsec, both time-based and size-based lifetimes are supported. To configure lifetimes for the SAs, use the following commands:

Note

The router R1 can be a Linux-based router, a Juniper Networks device, or any other vendor router.

Figure 1: VPN Topology
VPN Topology

Table 1 provides a complete list of the supported IKE protocols, tunnel modes, Phase 1 negotiation mode, authentication method or algorithm, encryption algorithm, DH groups supported for the IKE authentication and encryption (Phase1, IKE Proposal), and for IPsec authentication and encryption (Phase2, IPsec Proposal). The listed protocols, modes, and algorithms are supported and required for 19.2R1 Common Criteria.

Table 1: VPN Combination Matrix

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

pre-shared-keys

sha-256

group14

aes-128-cbc

IKEv2

  

rsa-signatures-2048

sha-384

group19

aes-128-gcm

   

ecdsa-signatures-256

 

group20

aes-192-cbc

   

ecdsa-signatures-384

 

group24

aes-256-cbc

      

aes-256-gcm

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

hmac-sha1-256

group14

ESP

aes-128-cbc

IKEv2

  

hmac-sha-256-128

group19

 

aes-128-cbc

    

group20

 

aes-128-gcm

    

group24

 

aes-192-cbc

      

aes-192-gcm

      

aes-256-cbc

      

aes-256-gcm

Note

The following sections provide sample configurations of IKEv1 IPsec VPN examples for selected algorithms. Authentication and encryption algorithms can be replaced in the configurations to accomplish the user’s desired configurations. Use set security ike gateway <gw-name> version v2-only command for IKEv2 IPsec VPN.

Configuring an IPsec VPN with a Preshared Key for IKE Authentication

In this section, you configure devices running Junos OS for IPsec VPN using a preshared key as the IKE authentication method. The algorithms used in IKE or IPsec authentication or encryption is shown in Table 2

Table 2: IKE or IPsec Authentication and Encryption

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

pre-shared-keys

sha-256

group14

aes-256-cbc

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

No Algorithm

group14

ESP

aes-256-cbc

Note

A device running Junos OS uses preshared keys for IPsec (no other protocols). TOE accepts ASCII preshared or bit-based keys up to 255 characters (and their binary equivalents) that contain uppercase and lowercase letters, numbers, and special characters such as !, @, #, $, %, ^, &, *, (, and ). The device accepts the preshared text keys and converts the text string into an authentication value as per RFC 2409 for IKEv1 or RFC 4306 for IKEv2, using the PRF that is configured as the hash algorithm for the IKE exchanges.

Configuring IPsec VPN with Preshared Key as IKE Authentication on the Initiator

To configure the IPsec VPN with preshared key IKE authentication on the initiator:

  1. Configure the IKE proposal.
    Note

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  2. Configure the IKE policy.
  3. Configure the IPsec proposal.
    Note

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  4. Configure the IPsec policy.
    Note

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  5. Configure the IKE.
    Note

    Here, gw1 is an IKE gateway name, 192.0.2.8 is the peer VPN endpoint IP, 192.0.2.5 is the local VPN endpoint IP, and ge-0/0/2 is a local outbound interface as the VPN endpoint. The following additional configuration is also needed in the case of IKEv2

  6. Configure the VPN.
    Note

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  7. Configure the outbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  8. Configure the inbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  9. Commit your configuration.

Configuring IPsec VPN with Preshared Key as IKE Authentication on the Responder

To configure the IPsec VPN with preshared key IKE authentication on the responder:

  1. Configure the IKE proposal.
    Note

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  2. Configure the IKE policy.
  3. Configure the IPsec proposal.
    Note

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  4. Configure the IPsec policy.
    Note

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  5. Configure the IKE.
    Note

    Here, gw1 is an IKE gateway name, 192.0.2.5 is the peer VPN endpoint IP, 192.0.2.8 is the local VPN endpoint IP, and ge-0/0/2 is a local outbound interface as the VPN endpoint. The following additional configuration is also needed in the case of IKEv2.

  6. Configure the VPN.
    Note

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  7. Configure the outbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  8. Configure the inbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  9. Commit your configuration.

Configuring an IPsec VPN with an RSA Signature for IKE Authentication

The following section provides an example to configure Junos OS devices for IPsec VPN using RSA Signature as IKE Authentication method, whereas, the algorithms used in IKE/IPsec authentication/encryption is as shown in the following table. In this section, you configure devices running Junos OS for IPsec VPN using an RSA signature as the IKE authentication method. The algorithms used in IKE or IPsec authentication or encryption is shown in Table 3.

Table 3: IKE/IPsec Authentication and Encryption

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

rsa-signatures-2048

sha-256

group14

aes-128-cbc

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

hmac-sha-256-128

group19

ESP

aes-128-cbc

Configuring IPsec VPN with RSA Signature as IKE Authentication on the Initiator

To configure the IPsec VPN with RSA signature IKE authentication on the initiator:

  1. Configure the PKI. See Example: Configuring PKI.
  2. Generate the RSA key pair. See Example: Generating a Public-Private Key Pair.
  3. Generate and load the CA certificate. See Example: Loading CA and Local Certificates Manually.
  4. Load the CRL. See Example: Manually Loading a CRL onto the Device .Note

    You can use the disable option to disable the revocation check or select the crl option to configure the CRL attributes. Using the set security pki ca-profile <profile-name> revocation-check crl disable on-download-failure command disable the on-download-failure option to allow the sessions matching the CA profile, when CRL download failed for a CA profile. The sessions will be allowed only if no old CRL is present in the same CA profile.

  5. Generate and load a local certificate. See Example: Loading CA and Local Certificates Manually.
  6. Configure the IKE proposal.
    Note

    Here, ike-proposal1 is the name given by the authorized administrator.

  7. Configure the IKE policy.
    Note

    Here, ike-policy1 IKE policy name given by the authorized administrator.

  8. Configure the IPsec proposal.
    Note

    Here, ipsec-proposal1 is the name given by the authorized administrator.

  9. Configure the IPsec policy.
    Note

    Here, ipsec-policy1 is the name given by the authorized administrator.

  10. Configure the IKE.
    Note

    Here, 192.0.2.8 is the peer VPN endpoint IP, 192.0.2.5 is the local VPN endpoint IP, and fe-0/0/1 is the local outbound interface as VPN endpoint. The following configuration is also needed for IKEv2.

  11. Configure VPN.
    Note

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  12. Configure the outbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zone and trustLan and untrustLan are preconfigured network addresses.

  13. Configure the inbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  14. Commit the configuration.

Configuring IPsec VPN with RSA Signature as IKE Authentication on the Responder

To configure the IPsec VPN with the RSA signature IKE authentication on the responder:

  1. Configure the PKI. See Example: Configuring PKI.
  2. Generate the RSA key pair. See Example: Generating a Public-Private Key Pair.
  3. Generate and load CA certificate. See Example: Loading CA and Local Certificates Manually.
  4. Load the CRL. See Example: Manually Loading a CRL onto the Device .
  5. Generate and load a local certificate. See Example: Loading CA and Local Certificates Manually.
  6. Configure the IKE proposal.
    Note

    Here, ike-proposal1 is the name given by the authorized administrator.

  7. Configure the IKE policy.
    Note

    Here, ike-policy1 IKE policy name given by the authorized administrator.

  8. Configure the IPsec proposal.
    Note

    Here, ipsec-proposal1 is the name given by the authorized administrator.

  9. Configure the IPsec policy.
    Note

    Here, ipsec-policy1 is the name given by the authorized administrator.

  10. Configure IKE.
    Note

    Here, 192.0.2.5 is the peer VPN endpoint IP, 192.0.2.8 is the local VPN endpoint IP, and ge-0/0/2 is the local outbound interface as VPN endpoint. The following configuration is also needed for IKEv2.

  11. Configure VPN.
    Note

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  12. Configure the outbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are network addresses.

  13. Configure the inbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  14. Commit the configuration.l

Configuring an IPsec VPN with an ECDSA Signature for IKE Authentication

In this section, you configure devices running Junos OS for IPsec VPN using an ECDSA signature as the IKE authentication method. The algorithms used in IKE or IPsec authentication or encryption are shown in Table 4.

Table 4: IKE or IPsec Authentication and Encryption

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

ecdsa-signatures-256

sha-384

group14

aes-256-cbc

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

No Algorithm

group14

ESP

aes-256-gcm

Configuring IPsec VPN with ECDSA signature IKE authentication on the Initiator

To configure the IPsec VPN with ECDSA signature IKE authentication on the initiator:

  1. Configure the PKI. See, Example: Configuring PKI.
  2. Generate the ECDSA key pair. See Example: Generating a Public-Private Key Pair.
  3. Generate and load CA certificate. See Example: Loading CA and Local Certificates Manually.
  4. Load CRL. See Example: Manually Loading a CRL onto the Device .
  5. Generate and load a local certificate. See Example: Loading CA and Local Certificates Manually.
  6. Configure the IKE proposal.
    Note

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  7. Configure the IKE policy.
  8. Configure the IPsec proposal.
    Note

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  9. Configure the IPsec policy.
    Note

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  10. Configure IKE.
    Note

    Here, gw1 is an IKE gateway name, 192.0.2.8 is the peer VPN endpoint IP, 192.0.2.5 is the local VPN endpoint IP, and ge-0/0/2 is a local outbound interface as the VPN endpoint. The following configuration is also needed for IKEv2.

  11. Configure the VPN.
    Note

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  12. Configure the outbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  13. Configure the inbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  14. Commit your configuration.

Configuring IPsec VPN with ECDSA signature IKE authentication on the Responder

To configure IPsec VPN with ECDSA signature IKE authentication on the responder:

  1. Configure the PKI. See Example: Configuring PKI.
  2. Generate the ECDSA key pair. See Example: Generating a Public-Private Key Pair.
  3. Generate and load the CA certificate. See Example: Loading CA and Local Certificates Manually.
  4. Load the CRL. See Example: Manually Loading a CRL onto the Device.
  5. Configure the IKE proposal.
    Note

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  6. Configure the IKE policy.
  7. Configure the IPsec proposal.
    Note

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  8. Configure the IPsec policy.
    Note

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  9. Configure the IKE.
    Note

    Here, gw1 is an IKE gateway name, 192.0.2.5 is the peer VPN endpoint IP, 192.0.2.8 is the local VPN endpoint IP, and ge-0/0/1 is a local outbound interface as the VPN endpoint. The following configuration is also needed for IKEv2.

  10. Configure the VPN.
    Note

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  11. Configure the outbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  12. Configure the inbound flow policies.
    Note

    Here, trustZone and untrustZone are preconfigured security zones and trustLan and untrustLan are preconfigured network addresses.

  13. Commit your configuration.

Configuring Remote IKE IDs

By default, the IKE ID received from the peer is validated with the IP address configured for the IKE gateway. In certain network setups, the IKE ID received from the peer (the IKE ID can be an IPv4 or IPv6 address, fully qualified domain name (FQDN), or a distinguished name) does not match the IKE gateway configured on the device. This can lead to a Phase 1 validation failure.

To configure the IKE ID perform the following steps:

  1. Configure the remote-identity statement at the set security ike gateway gateway-name hierarchy level to match the IKE ID that is received from the peer. The IKE ID values can be an IPv4 address or an IPv6 address, FQDN, or a distinguished name.
  2. On the peer device, ensure that the IKE ID is the same as the remote-identity configured on the device. If the peer device is a Junos OS device, configure the local-identity statement at the set security ike gateway gateway-name hierarchy level. The IKE ID values can be an IPv4 address or an IPv6 address, FQDN, or a distinguished name.