Juniper JUNOSE 11.2.X IP SERVICES, Configuration Manual

Page: 173 / 356

•
Use to specify an existing interface address that serves as the tunnel's source address.
•
For signaled IPSec tunnels in cable or DSL environments, you can optionally use an
FQDN to identify the tunnel endpoint.
•
Example
host1(config-if)# tunnel source 10.10.2.8
•
Use the no version to remove the tunnel source.
•
See tunnel source.
tunnel transform-set
•
Use to specify the transform set that ISAKMP uses during SA negotiations on this
tunnel. You create transform sets using “ipsec transform-set” on page 141 .
•
Example
host1(config-if)# tunnel transform-set espSet
•
Use the no version to remove the transform set from a tunnel.
•
See tunnel transform-set.
Configuring DPD and IPSec Tunnel Failover
You can use the ipsec option dpd command to enable dead peer detection (DPD) on
the router. DPD is also known as IKE keepalive. If an IPSec tunnel destination backup is
configured, the router redirects traffic to the alternate destination when DPD detects a
disconnection between the E Series router and the regular tunnel destination. See “tunnel
destination backup” on page 148 .
To enable DPD and create an alternate IPSec tunnel destination for failover:
1.
Enable DPD on the router.
host1(config)# ipsec option dpd
2.
Enter virtual router mode. Specify the VR that contains the source and destination
addresses assigned to the tunnel interface (that is, the transport virtual router
context).
host1(config)# virtual-router vrA
host1:vrA(config)#
3.
Create an IPSec tunnel, and specify the transport VR.
host1:vrA(config)# interface tunnel ipsec:Aottawa2boston transport-virtual-router
default
host1:vrA(config-if)#
4.
Specify the address or identity of the tunnel destination backup endpoint.
host1:vrA(config-if)# tunnel destination backup identity
branch500.customer77.isp.net
ipsec option dpd
147 Copyright © 2010, Juniper Networks, Inc.
Chapter 5: Configuring IPSec