Juniper JUNOSE 11.2.X IP SERVICES, Configuration Manual

Page: 202 / 356

to the username. Using the default, no domain suffix, passes usernames transparently
to AAA.
domain-suffix
•
Use to specify a domain suffix that you want to append to any usernames received on
this profile.
•
Example
host1(config-ipsec-tunnel-profile)# domain-suffix domain2
•
Use the no version to restore the default value, no domain suffix, and usernames are
passed transparently to AAA.
•
See domain-suffix.
Overriding IPSec Local and Peer Identities for SA Negotiations
You can use the local ip identity and peer ip identity commands to override the local
and peer identities used for SA negotiations (respectively).
local ip identity
•
Use to override the local identity (phase 2 identity) used for IPSec security association
negotiations. For IPSec negotiations to succeed, the local and peer identities at one
end of the tunnel must match the peer and local identities at the other end
(respectively).
•
Example
host1(config-ipsec-tunnel-profile)# local ip identity range 10.30.11.1 10.30.11.50
•
Use the no version to restore the default value, the internal IP address allocated for
the subscriber.
•
See local ip identity.
peer ip identity
•
Use to override the peer identity (phase 2 identity) used for IPSec security association
negotiations. For IPSec negotiations to succeed, the local and peer identities at one
end of the tunnel must match the peer and local identities at the other end
(respectively).
•
Example
host1(config-ipsec-tunnel-profile)# peer ip identity address 10.227.1.2
•
Use the no version to restore the default value, the internal IP address allocated for
the subscriber.
•
See peer ip identity.
Specifying an IP Profile for IP Interface Instantiations
The ip profile command specifies the IP profile that is passed from the IPSec layer to
the IP layer upon request for upper layer instantiation.
Copyright © 2010, Juniper Networks, Inc. 176
JunosE 11.2.x IP Services Configuration Guide