Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 646 / 1016

You do not need to enable NAT-T for your internal security device nodes that use NAT;
each VPN node knows the correct address translations for VPN traffic and does not
need to encapsulate the traffic.
To use NAT-T, enable NAT-Traversal and specify:
•
UDP Checksum. A 2-byte value (calculated from the UDP header, footer, and other
UDP message fields) that verifies packet integrity. You must enable this option for
NAT devices that require UDP checksum verification; however, most NAT devices
(including security devices) do not require it.
•
Keep alive Frequency. The number of seconds a VPN node waits between sending
empty UDP packets through the NAT device. A NAT device keeps translated IP
addresses active only during traffic flow, and invalidates unused IP addresses. To
ensure that the VPN tunnel remains open, you can configure the VPN node to send
empty "keep alive” packets through the NAT device.
IKE IDs/XAuth
Every VPN member has a unique identification number, known as an IKE ID. During Phase
1 negotiations, the IKE protocol uses the ID to authenticate the VPN member. You must
select and configure an ID type for the VPN members at each end of the tunnel. However,
the ID type can be different for each member:
• ASN1-DN—Abstract Syntax Notation, version 1 is a data representation format that is
non-platform specific; Distinguished Name is the name of the computer. Use ASN1-DN
to create a Group ID that enables multiple RAS users to connect to the VPN tunnel
concurrently.
• At the peer ID, specify values for the Container Match and Wildcard Match.
•
At the local ID, specify the value.
Using a Group ID can make configuring and maintaining your VPN quicker and easier.
For details on how Group IKE IDs work, see “Configuring Group IKE IDS” on page 557.
For details on determining the ASN1-DN container and wildcard values for Group IKE
IDs, see the documentation for your version of ScreenOS.
• FQDN—Use a Fully Qualified Domain Name when the VPN member uses a dynamic
IP address. FQDN is a name that identifies (qualifies) a computer to the DNS protocol
using the computer name and the domain name; ex. server1.colorado.mycompany.com.
• IP Address—Use an IP address when the VPN member uses a static IP address.
• U-FQDN—Use a User Fully Qualified Domain Name when the VPN member uses a
dynamic IP address (such as a RAS user). A U-FQDN is an e-mail address, such as
user1@mycompany.com.
Use the XAuth protocol to authenticate RAS users with an authentication token (such
as SecureID) and to make TCP/IP settings (IP address, DNS server, and WINS server)
for the peer gateway.
Copyright © 2010, Juniper Networks, Inc. 596
Network and Security Manager Administration Guide