Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 622 / 1026

want to configure L2TP. In the L2TP tab, specify the following values (you cannot edit
the name of the device).
•
Host Name—Enter the name of the L2TP host.
• Keep Alive—The number of seconds a VPN member waits between sending hello
packets to an L2TP RAS user.
•
Peer IP—Enter the IP address of the L2TP peer.
•
Secret—Enter the shared secret that authenticates communication in the L2TP tunnel.
• Remote Settings—Select the remote settings object that represents the DNS and WINS
servers assigned to L2TP RAS users after they have connected to the tunnel.
•
IP Pool Name—Select the IP pool object that represents the available IP addresses
that can be assigned to L2TP RAS users after they have connected to the tunnel.
• Auth Server—Because the L2TP must authenticate L2TP users, use custom settings
to associate those users with a specific Authentication Server. You can also configure
the device to query the remote settings object for DNS and WINS information for those
users.
To use the default authentication server for L2TP users, add the users to the device
first.
NOTE: When configuring a VPN that includes RAS users, if you added the
user as a L2TP local user and assigned an IP pool and remote settings
object on a specific device in the VPN, those settings override the settings
defined in the VPN.
Adding RAS Users
In the Remote User area, you can add RAS users to the VPN. (When configuring an
AutoKey IKE VPN, this area does not appear.) Click the
Users link to display the user
selection dialog box, then click the Edit icon to select the predefined RAS users or user
groups you want to include in the VPN. For details on creating RAS users and groups.
Defining a Default Gateway
You can include a single RAS user in multiple VPNs. To specify this VPN as the default
entry point for all RAS users listed in the VPN, enable Use as Default Gateway.
Adding Routing-Based Members
In the routing-based configuration area, you can add routing-based members to the VPN.
(When configuring an AutoKey IKE RAS VPN, an L2TP RAS VPN, or an L2TP over AutoKey
IKE RAS VPN, this area does not appear.) A routing-based VPN member is a security
device that will route traffic (statically or dynamically) through a tunnel interface to one
or more VPN members.
VPN Manager automatically creates the necessary tunnel interfaces for each route-based
VPNs member. However, after VPN Manager autogenerates the VPN tunnels, you must
configure static or dynamic routes on the security devices to route traffic through these
Copyright © 2010, Juniper Networks, Inc. 572
Network and Security Manager Administration Guide