Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 619 / 1016

Configuring Heartbeats
Use heartbeats to enable redundant gateways.
•
Hello—Enter the number of seconds the security devices wait between sending hello
pulses.
• Reconnect—Enter the maximum number of seconds the security devices wait for a
reply to the hello pulse.
•
Threshold—Enter the number of seconds that the security devices wait before
attempting to reconnect.
Configuring NAT Traversal
Because NAT obscures the IP address in some IPSec packet headers, VPN nodes cannot
receive VPN traffic that passes through an external NAT device. To enable VPN traffic
to traverse a NAT device, you can use NAT Traversal (NAT-T) to encapsulate the VPN
packets in UDP. If a VPN node with NAT-T enabled detects an external NAT device, it
checks every VPN packet to determine if NAT-T is necessary.
Because checking every packet impacts VPN performance, you should only use NAT
Traversal for remote users that must connect to the VPN over an external NAT device.
You do not need to enable NAT-T for your internal security device nodes that use NAT;
each VPN node knows the correct address translations for VPN traffic and does not need
to encapsulate the traffic.
To use NAT-T, enable NAT-Traversal and specify:
•
UDP Checksum—A 2-byte value (calculated from the UDP header, footer, and other
UDP message fields) that verifies packet integrity. You
must enable this option for
NAT devices that require UDP checksum verification; however, most NAT devices
(including security devices) do not require it.
•
Keep alive Frequency—The number of seconds a VPN node waits between sending
empty UDP packets through the NAT device. A NAT device keeps translated IP
addresses active only during traffic flow, and invalidates unused IP addresses. To
ensure that the VPN tunnel remains open, you can configure the VPN node to send
empty "keep alive” packets through the NAT device.
Configuring XAuth
Use the XAuth protocol to authenticate RAS users with an authentication token (such
as SecureID) and to make TCP/IP settings (IP address, DNS server, and WINS server)
for the peer gateway.
•
Default Server—To use the default XAuthentication server for the device. To change
or assign a default XAuthentication server, edit the VPN settings in the security device
configuration.
• XAuth Server—Use when the remote gateway is a security device that you want to
assign TCP/IP settings.
•
Auth Server Name. Select a preconfigured authentication server object.
569 Copyright © 2010, Juniper Networks, Inc.
Chapter 12: Configuring VPNs