Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X, Configuration Manual

Page: 210 / 366

■
See ike peer-identity domain-name.
■
See ike peer-identity ip address.
■
See ike peer-identity username.
Appending a Domain Suffix to a Username
The VPN to which a user is to be terminated is sometimes known from the IKE
identities attached to the user. However, to assist in connecting users to the correct
AAA domain for authentication, you can use the
domain-suffix command to append
a domain suffix to the username. Using the default, no domain suffix, passes
usernames transparently to AAA.
domain-suffix
■
Use to specify a domain suffix that you want to append to any usernames
received on this profile.
■
Example
host1(config-ipsec-tunnel-profile)# domain-suffix domain2
■
Use the no version to restore the default value, no domain suffix, and usernames
are passed transparently to AAA.
■
See domain-suffix.
Overriding IPSec Local and Peer Identities for SA Negotiations
You can use the local ip identity and peer ip identity commands to override the
local and peer identities used for SA negotiations (respectively).
local ip identity
■
Use to override the local identity (phase 2 identity) used for IPSec security
association negotiations. For IPSec negotiations to succeed, the local and peer
identities at one end of the tunnel must match the peer and local identities at
the other end (respectively).
■
Example
host1(config-ipsec-tunnel-profile)# local ip identity range 10.30.11.1 10.30.11.50
■
Use the no version to restore the default value, the internal IP address allocated
for the subscriber.
■
See local ip identity.
peer ip identity
184 ■
Configuring IPSec Tunnel Profiles
JUNOSe 11.1.x IP Services Configuration Guide