IPsec VPN Overview

IPsec VPN Modes

Juniper Security Director Cloud supports two VPN traffic exchange modes:

• Tunnel Mode—This mode encapsulates the original IP packet within another packet in the VPN tunnel. This is most commonly used when hosts within separate private networks want to communicate over a public network. Both VPN gateways establish the VPN tunnel to each other, and all traffic between the two gateways appears to be from the two gateways, with the original packet embedded within the exterior IPsec packet.

• Transport Mode—This mode does not encapsulate the original packet in a new packet like the tunnel mode. The transport mode sends the packet directly between the two hosts that have established the IPsec tunnel.

The Tunnel mode is the most common VPN mode on the Internet because it easily allows entire networks, particularly those with private address space, to communicate over public IP networks. The Transport mode is primarily used when encrypting traffic between two hosts to secure communication where IP address overlap is not an issue, such as between a host and a server on a private network.

IPsec VPN Routing

SRX Series Firewalls must know how to reach destination networks. This can be configured through the use of static routing or dynamic routing.

In Juniper Security Director Cloud route-based VPNs support OSPF, RIP, and eBGP routing along with static routing. Static routing requires that administrators specify the list of host or network addresses at each site as part of the VPN.

For example, in a retail scenario, where thousands of spokes can be part of a VPN, the static routing approach generates a huge configuration at each device. Static routing requires administrators to manually configure each route, and problems might occur when the infrastructure changes or when the administrators do not have access to the addresses for the protected network. Keeping routes up-to-date manually also creates a tremendous overhead.

IKE Authentication

Internet Key Exchange negotiations only provide the ability to establish a secure channel over which two parties can communicate. You still need to define how they authenticate each other. This is where IKE authentication is used to ensure that the other party is authorized to establish the VPN. The following IKE authentications are available:

• Preshared key authentication—The most common way to establish a VPN connection is to use preshared keys, which is essentially a password that is the same for both parties. This password must be exchanged in advance in an out-of-band mechanism, such as over the phone, through a verbal exchange, or through less secure mechanisms, even e-mail. The parties then authenticate each other by encrypting the preshared key with the peer’s public key, which is obtained in the Diffie-Hellman exchange.

  Preshared keys are commonly deployed for site-to-site IPsec VPNs, either within a single organization or between different organizations. A preshared key must consist of at least 8 characters with 12 or more characters recommended comprising a combination of letters, numbers, and non-alphanumeric characters, along with different cases for the letters. Preshared keys should not use a dictionary word.

• Certificate authentication—Certificate-based authentication is considered more secure than preshared key authentication because the certificate key cannot be compromised easily. Certificates are also more ideal in larger scale environments with numerous peer sites that should not all share a preshared key. Certificates are composed of a public and private key and can be signed by a primary certificate known as a certificate authority (CA). In this way, certificates can be checked to see if they are signed with a trusted CA.