member (Group VPN)

Syntax

member {ike {gateway gateway-name {address [(ip-address | hostname)];ike-policy policy-name;local-address address;local-identity (distinguished-name string | hostname hostname | inet ipv4-ip-address | user-at-hostname e-mail-address);}policy name {certificate {local-certificate identifier;peer-certificate-type [pkcs7 | x509-signature);trusted-ca (ca-index | use-all);}description text;mode (aggressive | main); pre-shared-key (ascii-text text | hexadecimal hex);proposal-set (basic | compatible | standard);proposals name;}proposal name {authentication-algorithm (md5 | sha-256 | sha1);authentication-method (pre-shared-keys | rsa-signatures);description text;dh-group (group1 | group2 | group5);encryption-algorithm (3des-cbc | aes-128-cbc | aes-192-cbc | aes-256-cbc | des-cbc);lifetime-seconds seconds;}}ipsec vpn name {group id;group-vpn-external-interface interface;heartbeat-threshold number;ike-gateway name;}}

Hierarchy Level

[edit security group-vpn]

Release Information

Statement introduced in Release 10.2 of Junos OS.

Description

Configure group VPN member.

Options

Configure group VPN member. You configure the following on the group member:

Phase 1 IKE SA with the group server. The IKE gateway is the group server.

Note: We recommend that you do not change the default value for lifetime-seconds for the IKE proposal on the member. Increasing the value might cause the member device to continue to use the existing Phase 1 IKE SA key even in the event of a crash; this can delay the recovery process.

IPsec group VPN.

Note: A scope policy must also be configured on the group member. To configure a scope policy, use the policies configuration statement at the [edit security] hierarchy and specify the IPsec group VPN for the ipsec-group-vpn option.

The remaining statements are explained separately.

Usage Guidelines

For configuration instructions and examples, see the Junos OS Security Configuration Guide

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.