Configuring Tunnel Interfaces and Tunnel Zones
A VPN requires a physical or virtual interface on the security device, and each security
device supports a specific number of physical and virtual interfaces. To support multiple
VPNs on a device, you might want to create tunnel interfaces and tunnel zones to increase
the number of available interfaces on the device.
NOTE:
VPN Manager automatically creates the necessary tunnel interfaces for
route-based VPNs. For device-level VPNs, you can create the tunnel interfaces before
or after creating the VPN.
If you do not need to do address translation (NAT), use unnumbered.
•
Tunnel Interfaces—
A tunnel interface handles VPN traffic between the VPN tunnel and
the protected resources. You can create numbered tunnel interfaces that use unique
IP addresses and netmasks, or unnumbered tunnel interfaces that do not have their
own IP address and netmask (unnumbered tunnel interface borrows the IP address
of the default interface of the security zone).
•
Tunnel Zones—
A tunnel zone is a logical construction that includes one or more
numbered tunnel interfaces. You must bind the VPN tunnel to the tunnel zone (not
the numbered tunnel interfaces); the VPN tunnel uses the default interface for the
tunnel zone. In a policy-based VPN, you can link:
•
A single VPN tunnel to multiple tunnel interfaces
•
Multiple VPN tunnels to a single tunnel interface
For details on tunnel interfaces and tunnel zones, see the
Network and Security Manager
Configuring ScreenOS and IDP Devices Guide
.
Configuring Static and Dynamic Routes
A security device must know the path, or route, between each protected resource or
security device in the VPN before it can forward packets from the source network to the
destination network on the other side of the tunnel. To specify the route, you can use
static routes, which define a specific, unchanging path between two VPN nodes, or
dynamic routes, which define an algorithm that dynamically determines the best path
between two VPN nodes.
NOTE:
If you are using VPN Manager to create the route-based VPNs, you create the
routes after autogenerating the VPN. If you are creating a device-level VPN, you can
create the routes after configuring the tunnel interfaces.
To create a static route, you must manually create a route for each tunnel on each device.
For VPNs with more than just a few devices, Juniper Networks highly recommends using
a dynamic routing protocol to automatically determine the best route for VPN traffic:
To route between different networks over the Internet, use Border Gateway Protocol
(BGP); to route within the same network, use Open Shortest Patch First (OSPF). For
Copyright © 2010, Juniper Networks, Inc.
558
Network and Security Manager Administration Guide
Summary of Contents for NETWORK AND SECURITY MANAGER 2010.3
Page 6: ...Copyright 2010 Juniper Networks Inc vi...
Page 36: ...Copyright 2010 Juniper Networks Inc xxxvi Network and Security Manager Administration Guide...
Page 52: ...Copyright 2010 Juniper Networks Inc 2 Network and Security Manager Administration Guide...
Page 90: ...Copyright 2010 Juniper Networks Inc 40 Network and Security Manager Administration Guide...
Page 144: ...Copyright 2010 Juniper Networks Inc 94 Network and Security Manager Administration Guide...
Page 146: ...Copyright 2010 Juniper Networks Inc 96 Network and Security Manager Administration Guide...
Page 234: ...Copyright 2010 Juniper Networks Inc 184 Network and Security Manager Administration Guide...
Page 310: ...Copyright 2010 Juniper Networks Inc 260 Network and Security Manager Administration Guide...
Page 364: ...Copyright 2010 Juniper Networks Inc 314 Network and Security Manager Administration Guide...
Page 366: ...Copyright 2010 Juniper Networks Inc 316 Network and Security Manager Administration Guide...
Page 478: ...Copyright 2010 Juniper Networks Inc 428 Network and Security Manager Administration Guide...
Page 576: ...Copyright 2010 Juniper Networks Inc 526 Network and Security Manager Administration Guide...
Page 580: ...Copyright 2010 Juniper Networks Inc 530 Network and Security Manager Administration Guide...
Page 592: ...Copyright 2010 Juniper Networks Inc 542 Network and Security Manager Administration Guide...
Page 684: ...Copyright 2010 Juniper Networks Inc 634 Network and Security Manager Administration Guide...
Page 690: ...Copyright 2010 Juniper Networks Inc 640 Network and Security Manager Administration Guide...
Page 696: ...Copyright 2010 Juniper Networks Inc 646 Network and Security Manager Administration Guide...
Page 698: ...Copyright 2010 Juniper Networks Inc 648 Network and Security Manager Administration Guide...
Page 748: ...Copyright 2010 Juniper Networks Inc 698 Network and Security Manager Administration Guide...
Page 778: ...Copyright 2010 Juniper Networks Inc 728 Network and Security Manager Administration Guide...
Page 870: ...Copyright 2010 Juniper Networks Inc 820 Network and Security Manager Administration Guide...
Page 872: ...Copyright 2010 Juniper Networks Inc 822 Network and Security Manager Administration Guide...
Page 898: ...Copyright 2010 Juniper Networks Inc 848 Network and Security Manager Administration Guide...
Page 908: ...Copyright 2010 Juniper Networks Inc 858 Network and Security Manager Administration Guide...
Page 910: ...Copyright 2010 Juniper Networks Inc 860 Network and Security Manager Administration Guide...
Page 995: ...PART 6 Index Index on page 947 945 Copyright 2010 Juniper Networks Inc...
Page 996: ...Copyright 2010 Juniper Networks Inc 946 Network and Security Manager Administration Guide...