Configuring Security Associations

To use IPSec services, you create an SA between hosts. An SA is a simplex connection that allows two hosts to communicate with each other securely by means of IPSec. You can configure two types of SAs:

• Manual—Requires no negotiation; all values, including the keys, are static and specified in the configuration. As a result, each peer must have the same configured options for communication to take place. For information about how to configure a manual SA, see Configuring Manual Security Associations.
• Dynamic—Specifies proposals to be negotiated with the tunnel peer. The keys are generated as part of the negotiation and therefore do not need to be specified in the configuration. The dynamic SA includes one or more proposal statements, which allow you to prioritize a list of protocols and algorithms to be negotiated with the peer. For information about how to configure a dynamic SA, see Configuring Dynamic Security Associations.

This section includes the following topics:

• Configuring Manual Security Associations
• Configuring Dynamic Security Associations
• Clearing Security Associations

Note: Both OSPFv2 and OSPFv3 support IPSec authentication. However, dynamic or tunnel mode IPSec SAs are not supported for OSPFv3. If you add SAs into OSPFv3 by including the ipsec-sa statement at the [edit protocols ospf3 area area-number interface interface-name] hierarchy level, your configuration fails to commit. For more information about OSPF authentication and other OSPF properties, see the JUNOS Routing Protocols Configuration Guide.

Copyright © 2009, Juniper Networks, Inc. All rights reserved. Trademark Notice.