Configuring Dynamic Endpoints

IPSec tunnels can also be established using dynamic peer security gateways, in which the remote end of the tunnels do not have a statically assigned IP address. Since the remote address is not known and might be pulled from an address pool each time the remote host reboots, establishment of the tunnel relies on using IKE main mode with either preshared global keys or digital certificates that accept any remote identification value. For more information on IKE policy modes, see Configuring the IKE Policy Mode. Both policy-based and link-type tunnels are supported:

• Policy-based tunnels used shared mode.
• Link-type or routed tunnels use dedicated mode. Each tunnel allocates a service interface from a pool of interfaces configured for the dynamic peers. Routing protocols can be configured to run on these service interfaces to learn routes over the IPSec tunnel that is used as a link in this scenario.

This section includes the following topics:

• Authentication Process
• Dynamic Implicit Rules
• Reverse Route Insertion
• Configuring an IKE Access Profile
• Configuring the Service Set
• Configuring the Interface Identifier
• Default IKE and IPSec Proposals

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.