Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X, Configuration Manual

Page: 204 / 366

The router uses existing authentication, authorization, and accounting (AAA)
functionality to authenticate the user data.
After granting access, the router instantiates an IP interface for the new subscriber
as well as an access route for the IP address assigned to the subscriber on the
terminating virtual router. The subscriber also obtains IP interface data (IP address,
subnetwork mask, primary and secondary DNS address, primary and secondary
WINS address, and so on) during a configuration exchange.
Once instantiated, an access router created, and the client successfully set with
interface data parameters, the router can terminate the Xauth exchange and enable
the IPSec layer and phase 2 SAs (IPSec SAs or P2s) can begin. Following these
exchanges, the full data path is ready and subscribers can exchange packets with
the VR on which they terminate.
Dynamic Connection Teardown
The following events can trigger the teardown of a dynamic IPSec subscriber
connection:
■
All phase 1 and phase 2 SA deleted by a remote peer and no rekeying activity
occurs for one minute
■
Administrative logout
■
IPSec card terminating the user becoming unavailable (for example, the card is
reloading, disabled, or disconnected)
■
Dead peer detection (DPD) reporting the phase 1 SA is unreachable
■
Authentication, authorization, and accounting session or idle timeout values
expire
Dynamic IPSec Subscriber Recognition
The E Series router expects to receive the Xauth vendor ID from the remote peer for
dynamic interface instantiation. The expected Xauth vendor ID is
0x09002689DFD6B712.
NOTE: The E Series router does not initiate connections to new subscribers.
Acceptable vendor IDs are global to the router and not user-configurable.
Phase 2 SAs intended for static tunnels and those intended for dynamic subscribers
do not share the same phase 1 SA. This means that dynamic phase 1 SAs are only
used to negotiate dynamic phase 2 SAs. Conversely, phase 1 SAs that are not
recognized as dynamic are used only to negotiate phase 2 SA static tunnels.
Licensing Requirements
Each dynamic IPSec subscribers requires the use of two licenses:
■
One B-RAS license
178 ■
Overview
JUNOSe 11.1.x IP Services Configuration Guide