Creating IPsec VPNs

Name

Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores; spaces are not allowed; maximum length is 62 characters. This is a mandatory field.

Tunnel Mode

Select either route based or policy based for tunnel mode.

Note: SRX Series devices support only tunnel mode.

Use route-based tunnel mode if:

• Participating gateways are Juniper Networks products. We recommend the route-based option.

• Either source or destination NAT must occur when traffic traverses the VPN.

• Dynamic routing protocols must be used for VPN routing.

• Primary and backup VPNs are required in the setup.

Use policy-based tunnel mode if:

• The remote VPN gateway is a non-Juniper Networks device.

• Access to the VPN must be restricted for specific application traffic.

Note: You cannot change the tunnel mode of an existing IPsec VPN. If the Tunnel Mode is Policy Based, then VPN Topology is Site to Site and Routing Topology is not applicable.

Routing Topology

Select one of the following options:

• Traffic Selector (Auto Route Insertion)—A traffic selector is an agreement between Internet Key Exchange (IKE) peers to permit traffic through a tunnel if the traffic matches a specified pair of local and remote addresses.

• Static routing—Generates static routing based on the protected networks or zones per device.

• OSPF-Dynamic Routing—Generates OSPF configuration.

• RIP-Dynamic Routing—Generates RIP configuration.

• eBGP-Dynamic Routing—Generates eBGP configuration.

  Note: eBGP-Dynamic Routing is not applicable for Full Mesh VPN topology.

VPN Profile

Select a VPN profile from the drop-down list based on the deployment scenario.

Note: The VPN profile is applicable only if the Profile Type is Shared Profile.

Preshared Key

Establish a VPN connection using preshared keys, which is essentially a password that is same for both parties. Preshared keys are commonly deployed for site-to-site IPsec VPNs, either within a single organization or between different organizations.

Select the type of preshared key you want to use:

• Autogenerate—Select if you want to automatically generate a unique key per tunnel. When selected, the Generate Unique key per tunnel check box is automatically selected. If you clear the Generate Unique key per tunnel check box, Security Director generates a single key for all tunnels.

• Manual—Select to enter the key manually. By default, the manual key is masked. To unmask the manual key, select the Unmask check box.

Note: This is applicable only if the authentication method is Preshared based.

Tunnel IP

Enter the IP address of the network.

Idle Threshold

Select the rate, in packets per second, below which the shortcut is brought down.

Range: 3 through 5,000 packets per second.

Note: It is applicable only if the VPN topology is Hub and Spoke (ADVPN-Auto Discovery VPN).

Site to Site

1. Click the device icon to configure the gateways.

   The Device Selection page is displayed.

2. Complete the device selection according to the guidelines in Table 3.

   The Device configuration page is displayed.

3. Complete the device configuration according to the guidelines in Table 4.

   After the configuration is complete, the device names are displayed at the gateway icons.

Full Mesh

1. Click an icon to configure a nodes.

   The Device Selection page is displayed.

2. Complete the device selection according to the guidelines in Table 3.

   The Device Settings page is displayed.

3. Select a device and click the pencil icon to configure the gateway settings.

   The Gateway Settings page is displayed.

4. Complete the node configuration according to the guidelines in Table 4.

Note: The topology displayed for full mesh is only a representation. Maximum of six nodes are displayed in the topology. You can configure any number of nodes.

Available

View all devices from the current and child domains, with view parent enabled. Devices from the child domain with view parent disabled are not shown.

You can select a device and add it as an endpoint.

The following filter criteria are applied for the device selection:

• SRX Series devices mapped to Junos OS Release 12.1X46 and later Junos-es schemas are not shown.

• Logical systems are not shown.

• Routing option is not applicable.

Hub

Select either Devices or Extranet devices as Hub.

IPv4 Address

Enter the IP address of the network.

Note: This is applicable only when the Routing Topology is OSPF-Dynamic Routing, RIP-Dynamic Routing, or eBGP-Dynamic Routing in case of Site to Site and Hub and Spoke topology.

In Full Mesh VPN topology, it is applicable to OSPF-Dynamic Routing Topology and RIP-Dynamic Routing Topology.

External Interface

Select the outgoing interface for IKE security associations (SAs). This interface is associated with a zone that acts as its carrier, providing firewall security for it.

Metric

Specify the cost for an access route for the next hop.

Note: This is applicable only if the VPN topology is Hub and Spoke and Full Mesh.

Initiator/Recipient

Select an option:

• Initiator

• Recipient

Note: This is applicable when the IKE mode is Aggressive.

Certificate

Select a certificate to authenticate the virtual private network (VPN) initiator and recipient.

This is applicable in one of the following scenarios:

• The VPN profile with authentication method RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

• The authentication method is RSA-Signatures, DSA-Signatures, ECDSA-Signatures-256, or ECDSA-Signatures-384.

Export

• Select the Static Routes check box to export static routes.

  Security Director simplifies VPN address management by enabling the administrator to export static routes to a remote site over a tunnel, allowing the static route networks to participate in the VPN. However, only devices on the hub side can export static default routes to the device side. Devices at the spoke side cannot export static default routes over a tunnel.

  Note: For eBGP Dynamic Routing, by default, the Static Routes check box is selected.

• Select the RIP Routes check box to export RIP routes.

  Note: You can export RIP routes only when Routing Topology is OSPF Dynamic Routing.

• Select the OSPF Routes check box to export OSPF routes.

  Note: You can export OSPF routes only when Routing Topology is RIP-Dynamic Routing.

  If you select OSPF or RIP export, the OSPF or RIP network outside the VPN network are imported into a VPN network through OSPF or RIP Dynamic routing protocols.

Max Retransmission Time

Select the retransmission timer to limit the number of times the RIP demand circuit re-sends update messages to an unresponsive peer. If the configured retransmission threshold is reached, routes from the next-hop router are marked as unreachable and the hold-down timer starts. You must configure a pair of RIP demand circuits for this timer to take effect.

The retransmission range is from 5 through 180 seconds and the default value is 50 seconds.

Note: This is applicable only when Routing Topology is RIP-Dynamic Routing.

Protected Networks

Configure the addresses or interface type for the selected device to protect one area of the network from the other.

When a dynamic routing protocol is selected, the interface option is displayed.

Note: You can also create inline addresses by clicking Add New Address.

Mode

Select an IKE policy mode.

• Main—Uses six messages in three peer-to-peer exchanges to establish the IKE SA. These three steps include the IKE SA negotiation, a Diffie-Hellman exchange, and authentication of the peer. Also provides identity protection.

• Aggressive—Takes half the number of messages of main mode, has less negotiation power, and does not provide identity protection.

Note: Mode is applicable when the IKE Version is V1.

Authentication-algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

Lifetime-seconds

Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

DPD Mode

Select a DPD Mode. Optimized: R-U-THERE messages are triggered if there is no incoming IKE or IPsec traffic within a configured interval after the device sends outgoing packets to the peer. This is the default mode. Probe Idle Tunnel: R-U-THERE messages are triggered if there is no incoming or outgoing IKE or IPsec traffic within a configured interval. R-U-THERE messages are sent periodically to the peer until there is traffic activity. Always-send: R-U-THERE messages are sent at configured intervals regardless of traffic activity between the peers.

DPD Threshold

Select the failure DPD threshold value. This specifies the maximum number of times the DPD messages must be sent when there is no response from the peer. The default number of transmissions is 5 times, with a permissible range of 1 to 5.

General IKE ID

Enable this option to accept peer IKE ID. This option is disabled by default. If General IKE ID is enabled, the IKE ID option is disabled automatically.

IKEv2 Re Fragmentation Support

IKEv2 fragmentation splits a large IKEv2 message into a set of smaller ones so that there is no fragmentation at the IP level.

IKE ID

Select an option:

• None

• Distinguished name

• Hostname

• IPv4 address

• E-mail Address

IKE ID is applicable only when General IKE ID is disabled.

Keep Alive

Select a value. NAT Keepalives are required to maintain the NAT translation during the connection between the VPN peers. Range is from 1 to 300 seconds.

Protocol

Select the required protocol to establish the VPN.

• ESP—The Encapsulating Security Payload (ESP) protocol provides both encryption and authentication.

• AH—The Authentication Header (AH) protocol provides data integrity and data authentication.

Authentication Algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

Lifetime Seconds

Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

Establish Tunnel

Select an option to specify when IKE is activated.

• Immediately—IKE is activated immediately after VPN configuration changes are committed.

• On-traffic—IKE is activated only when data traffic flows and must be negotiated with the peer gateway. This is the default behavior.

VPN Monitor

Enable this option to send Internet Control Message Protocol (ICMP) to determine if the VPN is up.

Anti Replay

By default, Anti-Replay detection is enabled. IPsec protects against the VPN attack by using a sequence of numbers that are built into the IPsec packet—the system does not accept a packet for which it has already seen the same sequence number. It essentially checks the sequence numbers and enforces the check, rather than just ignoring the sequence numbers. Disable it if there is an error with the IPsec mechanism that results in out-of-order packets, preventing proper functionality.

Idle Time

Select the appropriate idle time interval. The sessions and their corresponding translations typically time out after a certain period if no traffic is received.

Copy Outer DSCP

Enable copying of Differentiated Services Code Point (DSCP) field from the outer IP header encrypted packet to the inner IP header plain text message on the decryption path. The benefit in enabling this feature is that after IPsec decryption, clear text packets can follow the inner CoS rules.