Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


IPsec VPN Overview


A VPN provides a means for securely communicating among remote computers across a public WAN such as the Internet.

Security Director simplifies the management and deployment of IPsec VPNs. In general, VPN configurations are tedious and repetitive when deploying over a large number of SRX Series devices and for full-meshed VPN deployments. With Security Director, you can use VPN profiles to group common settings and apply them to multiple VPN tunnel configurations across multiple SRX Series devices. You can mass deploy site-to-site, hub-and-spoke, and fully meshed VPNs. Security Director determines the necessary deployment scenarios and publishes the required configuration necessary for all SRX Series devices.

Security Director supports policy-based and route-based IPsec VPNs on SRX Series devices. Policy-based VPNs are supported only in the site-to-site deployments, where you configure two endpoints. If you have two or more SRX Series devices, then route-based VPNs offer more flexibility and scalability. You can select between site-to-site, full-mesh, and hub-and-spoke for route-based VPNs. To allow data to be securely transferred between a branch office and the corporate office, configure a policy-based or route-based IPsec VPN. For an enterprise-class deployment, configure a hub-and-spoke IPsec VPN.

  • Security Director views each logical system as any other security device and takes ownership of the security configuration of the logical system. In Security Director, each logical system is managed as a unique security device.

  • Security Director ensures that the tunnel interfaces are exclusively assigned to the individual logical systems of a device. No tunnel interface is assigned to more than one logical system of the same device.

IPsec VPN Topologies

The following IPsec VPNs are supported:

  • Site-to-Site VPNs—Connects two sites in an organization together and allows secure communications between the sites.

  • Hub-and-Spoke (establishment all peers)—Connects branch offices to the corporate office in an enterprise network. You can also use this topology to connect spokes together by sending traffic through the hub.

  • Hub-and-Spoke (establishment by spokes)—Auto-VPN supports an IPsec VPN aggregator (hub) that serves as a single termination point for multiple tunnels to remote sites (spokes). Auto-VPN allows network administrators to configure a hub for current and future spokes. No configuration changes are required on the hub when spoke devices are added or deleted, thus allowing administrators flexibility in managing large-scale network deployments.

  • Hub-and-Spoke (Auto Discovery VPN)—Auto Discovery VPN (ADVPN) is a technology that allows the central hub to dynamically inform spokes about a better path for traffic between two spokes. When both spokes acknowledge the information from the hub, they establish a shortcut tunnel and change the routing topology for the host to reach the other side without sending traffic through the hub.

  • Full Mesh— Connects two or more participating gateways and sets up a separate tunnel with every other device in the group.