Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Using IPsec with a Layer 3 VPN

Some key concepts to keep in mind when configuring IPsec within a VPN include the following:

  • Add the inside services interface for a next-hop style service set into the routing instance by including the interface sp-fpc/pic/port statement at the [edit routing-instances instance-name] hierarchy level.

  • For interface style service sets, add the interface on which you apply the service set and the services interface by including both interfaces at the [edit routing-instances instance-name] hierarchy level.

  • To define a routing instance for the local gateway within the service set, include the routing-instance instance-name option at the [edit services service-set service-set-name ipsec-vpn-options local-gateway address] hierarchy level.

The following configuration for an AS PIC on a provider edge (PE) router demonstrates the use of next-hop service sets with an IKE dynamic SA in a VPN routing and forwarding (VRF) routing instance.

For more information on VRF routing instances, see the Junos VPNs Configuration Guide. For more information on next-hop service sets, see the Junos Services Interfaces Configuration Guide.