> - Downloads
> - Before You Add a JUNOS VPN to the SRC Configuration
> - Related Topics
> - Overview of NAT Address Management Portal
> - Assigning IP Addresses

> # Before You Add a JUNOS VPN to the SRC Configuration

> Before you can add a VPN to an SRC configuration, you must configure the VPN. Before you configure the VPN, make sure that in the routing scheme in the VPN:

> - All members in the VPN can reach other.
> - No changes are needed as members are added to and removed from the VPN.

> If a VPN is used as an intranet, you can ensure that the routing scheme meets these requirements by configuring either:

> - Static routes in the VPN
> - Appropriate routing protocols

> If the VPN is exported as an extranet, some members of the VPN may use private or conflicting address schemes. In addition, if the VPN has a large number of potential members, configuring static routing or routing protocols for all potential members may not be a manageable proposition. In these last two cases, we recommend that you use public addresses in the VPN and have VPN members implement Network Address translation (NAT) for traffic destined for the VPN.

> VPNs use private IP addresses. If, however, enterprises that you administer export VPNs to extranet clients, you must ensure that the extranet clients can reach the IP addresses that the VPNs use. To implement an address scheme that allows all subscribers who have access to a VPN, we recommend that you implement NAT on the JUNOS routing platform. IT managers in the retailers and enterprises who own the VPNs can then map private IP addresses in the VPNs to public IP addresses, which extranet clients can reach.

> Before you can reference a JUNOS VPN from the SRC configuration:

> 1. Create one routing instance in each router where VPN members access the VPN.
> 2. Make sure that each routing instance in the VPN has the same name as the VPN. The VPN represents the collection of the routing instances, the VPN members, and the connections between those routing instances within the VPN. All routing instances share a VPN ID, which you use to add VPNs to an SRC configuration.
> 3. Connect the VPN through a tunnel such as an MPLS label-switched path or IP Security tunnel.

> #### Published: 2009-09-13

> Copyright © 2009, Juniper Networks, Inc. All rights reserved. Trademark Notice.