[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring an IKE Access Profile

You can configure only one tunnel profile per service set for all dynamic peers. The configured preshared key in the profile is used for IKE authentication of all dynamic peers terminating in that service set. Alternatively, you can include the ike-policy statement to reference an IKE policy you define with either specific identification values or a wildcard (the any-remote-id option). You configure the IKE policy at the [edit services ipsec-vpn ike] hierarchy level; for more information, see Configuring an IKE Policy.

The IKE tunnel profile specifies all the information needed to complete the IKE negotiation. Each protocol has its own statement hierarchy within the client statement to configure protocol-specific attribute value pairs, but only one client configuration is allowed for each profile. The following is the configuration at the [edit access] hierarchy level; for more information on access profiles, see the JUNOS System Basics Configuration Guide.



profile profile-name {


client * {


ike {


allowed-proxy-pair {
remote remote-proxy-address local local-proxy-address;
}


pre-shared-key [ascii-text key-string] [hexadecimal key-string];
ike-policy policy-name;
interface-id <string-value>;
}


}


}

Note: For dynamic peers, the JUNOS software supports the IKE main mode with either the preshared key method of authentication or an IKE access profile that uses a local digital certificate.

In preshared key mode, the IP address is used to identify a tunnel peer to get the preshared key information. The client value * (wildcard) means that configuration within this profile is valid for all dynamic peers terminating within the service set accessing this profile.
In digital certificate mode, the IKE policy defines which remote identification values are allowed; for more information, see Configuring an IKE Policy.

The following statements make up the IKE profile:

allowed-proxy-pair—During phase 2 IKE negotiation, the remote peer supplies its network address (remote) and its peer’s network address (local). Since multiple dynamic tunnels are authenticated through the same mechanism, this statement must include the list of possible combinations. If the dynamic peer does not present a valid combination, the phase 2 IKE negotiation fails.
By default, remote 0.0.0.0/0 local 0.0.0.0/0 is used if no values are configured. Both IPv4 and IPv6 address formats are supported in this configuration, but there are no default IPv6 addresses. You must specify even 0::0/0.
pre-shared-key—Key used to authenticate the dynamic peer during IKE phase 1 negotiation. This key is known to both ends through an out-of-band secure mechanism. You can configure the value either in hexadecimal or ascii-text format. It is a mandatory value.
ike-policy—Policy that defines the remote identification values corresponding to the allowed dynamic peers; can contain a wildcard value any-remote-id for use in dynamic endpoint configurations only.
interface-id—Interface identifier, a mandatory attribute used to derive the logical service interface information for the session.

[Contents] [Prev] [Next] [Index] [Report an Error]