Create VPN Profiles

Name

Enter a unique string of maximum 62 alphanumeric characters without spaces.

The string can contain dashes and underscores.

Description

Enter VPN description containing maximum 255 characters.

Authentication Method

Select the authentication method:

• Pre-shared based

• RSA-Signatures

• DSA-Signatures

• ECDSA-Signatures-256

• ECDSA-Signatures-384

For Remote VPN, only Pre-shared based and RSA-Signatures are supported.

IKE Version

Select the required IKE version, either V1 or V2, that is used to negotiate dynamic security associations (SAs) for IPsec. By default, IKE V2 is used.

This is not applicable for remote access VPN profiles.

Mode

Select an IKE policy mode.

• Main—Uses six messages in three peer-to-peer exchanges to establish the IKE SA. These three steps include the IKE SA negotiation, a Diffie-Hellman exchange, and authentication of the peer. Also provides identity protection.

• Aggressive—Takes half the number of messages of main mode, has less negotiation power, and does not provide identity protection.

Mode is applicable when the IKE Version is V1.

Mode is not applicable for remote access VPN profiles.

Dead Peer Detection

Enable to permit the two gateways to determine if the peer gateway is active and responding to the Dead Peer Detection (DPD) messages that are negotiated during IPsec establishment.

DPD Mode

Select a DPD Mode.

• Optimized: R-U-THERE messages are triggered if there is no incoming IKE or IPsec traffic within a configured interval after the device sends outgoing packets to the peer. This is the default mode.

• Probe Idle Tunnel: R-U-THERE messages are triggered if there is no incoming or outgoing IKE or IPsec traffic within a configured interval. R-U-THERE messages are sent periodically to the peer until there is traffic activity.

• Always-send: R-U-THERE messages are sent at configured intervals regardless of traffic activity between the peers.

DPD Interval

Select an interval in seconds to send dead peer detection messages.

The default interval is 10 seconds, with a permissible range of 2 to 60 seconds.

DPD Threshold

Select the failure DPD threshold value. This specifies the maximum number of times the DPD messages must be sent when there is no response from the peer.

The default number of transmissions is 5 times, with a permissible range of 1 to 5.

Name

Enter a name for the VPN. A unique string of maximum 32 alphanumeric characters without spaces.

The string can contain dashes and underscores.

Deffie Hellman group

Select a group. Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process.

The available options include group 1, group 2, group 5, group 14, group 15, group 16, group 19, group 20, group 21, and group 24.

Authentication-algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

The available options include SHA1, SHA 256-bit, SHA 384-bit, SHA 512-bit, HMAC 384-bit, HMAC 512-bit, and MD5.

If your device does not have any IKE version installed, run the CLI command to install IKE: request system software add optional://junos-ike.tgz.

Encryption-algorithm

Select the appropriate encryption mechanism.

The available options include AES-GCM 256-bit, AEM-CBC 128-bit, AES-GCM 128-bit, AEM-CBC 192-bit, AEM-CBC 256-bit, 3DES-CBC, and DES-CBC.

Lifetime-seconds

Select a lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

You can create a maximum of four custom profiles, and edit or delete the existing custom profiles.

General IKE ID

Enable this option to accept peer IKE ID. This option is disabled by default. If General IKE ID is enabled, the IKE ID option is disabled automatically.

This is not applicable for remote access VPN profiles.

IKEv2 Re Authentication

Select a re-authentication frequency. Re-authentication can be disabled by setting the re-authentication frequency to 0.

Range is 0 to 100.

This is not applicable for remote access VPN profiles.

IKEv2 Re Fragmentation Support

IKEv2 fragmentation splits a large IKEv2 message into a set of smaller ones so that there is no fragmentation at the IP level.

This is applicable when authentication method is RSA-Signatures.

IKE ID

Select an IKE ID:

• None

• Distinguished name

• Hostname

• IPv4 address

• E-mail Address. Only e-mail address is applicable for remote access VPN profiles.

IKE ID is applicable only when General IKE ID is disabled.

NAT-T

Enable Network Address Translation-Traversal (NAT-T) if the dynamic endpoint is behind a NAT device.

Keep Alive

Select a value. NAT Keepalives are required to maintain the NAT translation during the connection between the VPN peers. Range is from 1 to 300 seconds.

Perfect Forward Secrecy

Select Perfect Forward Secrecy (PFS) as the method that the device to generate new encryption key independently from the previous key. The higher numbered groups provide more security but require more processing time.

The available options include group 1, group 2, group 5, group 14, group 15, group 16, group 19, group 20, group 21, and group 24.

Establish Tunnel

Select an option to specify when IKE is activated.

• Immediately—IKE is activated immediately after VPN configuration changes are committed.

• On-traffic—IKE is activated only when data traffic flows and must be negotiated with the peer gateway. This is the default behavior.

This is not applicable for remote access VPN profiles.

Name

Enter a name for the VPN. A unique string of maximum 32 alphanumeric characters without spaces.

The string can contain dashes and underscores.

Authentication Algorithm

Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.

Protocol

Select the required protocol to establish the VPN.

• ESP—The Encapsulating Security Payload (ESP) protocol provides both encryption and authentication.

• AH—The Authentication Header (AH) protocol provides data integrity and data authentication.

This is not applicable for remote access VPN profiles.

Encryption Algorithm

Select the encryption method.

This is applicable if the Protocol is ESP.

The available options include AES-GCM 256-bit, AEM-CBC 128-bit, AES-GCM 128-bit, AEM-CBC 192-bit, AEM-GCM 192-bit, AEM-CBC 256-bit, 3DES-CBC, and DES-CBC.

Lifetime Seconds

Select the lifetime of an IKE security association (SA). The valid range is from 180 through 86,400 seconds.

Lifetime kilobytes

Select the lifetime in kilobytes of an IPsec security association (SA). The range is from 64 through 4294967294 kilobytes.

You can create a maximum of four custom profiles, and edit or delete the existing custom profiles.

VPN Monitor

Enable this option to send Internet Control Message Protocol (ICMP) to determine if the VPN is active.

Anti Replay

Enable Anti-Replay detection within IPsec to guard against VPN attacks. This approach relies on sequence numbers embedded in IPsec packets to reject duplicate packets with matching sequence numbers. The system checks these sequence numbers and successfully mitigates replay attacks. Disable Anti-Replay if IPsec process produces errors that reorder packets and hinder functionality. By default, Anti-Replay detection is enabled.

Install interval

Select the maximum number of seconds to allow for the installation of a re-keyed outbound security association (SA) on the device.

Idle Time

Select the appropriate idle time interval. The sessions and their corresponding translations typically time out after a certain period if no traffic is received.

DF Bit

Select an option to process the Don’t Fragment (DF) bit in IP messages.

• Clear—Disable the DF bit from the IP messages. This is the default.

• Copy—Copy the DF bit to the IP messages.

• Set—Enable the DF bit in the IP messages.

Copy Outer DSCP

Enable copying of Differentiated Services Code Point (DSCP) field from the outer IP header encrypted packet to the inner IP header plain text message on the decryption path. The benefit in enabling this feature is that after IPsec decryption, clear text packets can follow the inner class-of-service (CoS) rules.