Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 641 / 1026

Example: Configuring an Autokey IKE RAS, Policy-Based VPN
An AutoKey IKE RAS VPN connects RAS users and protected resources. In this example,
Local Auth user Wendy (login name: reporter, password: Nd4syst4) wants to access
resources on the UNIX server at the corporate site.
To accommodate Wendy, create an AutoKey IKE tunnel using a preshared key to provide
the secure communication channel between IKE user Wendy and the UNIX server, which
is protected by the Chicago Corporate security device.
The tunnel uses ESP with 3DES encryption and SHA-1 authentication. For the Phase 1
and 2 security levels, specify the Phase 1 proposal as pre-g2-3des-sha and select the
predefined "Compatible” set of proposals for Phase 2.
1.
Add the Chicago Corporate device and configure the following interfaces:
•
Ethernet1 is the Trust IP (10.1.1.1/24) in the Trust zone.
• Ethernet3 is the Untrust IP (1.1.1.1/24) in the Untrust zone.
2.
Create the address objects that you will use to create Protected Resources (for details
on creating or editing address objects.
a. Add the Chicago Corporate Trusted LAN (10.1.1.0/24) as a network address object.
In Address Objects, click the Add icon and select Network . Configure the following,
then click OK :
• For Name, enter Chicago Corporate Trust LAN .
•
For IP Address/Netmask, enter 10.2.1.0/24 .
•
For Color, select magenta .
• For Comments, enter Chicago Trusted Network .
b. Add the UNIX Server (10.1.1.5) as a host address object. In Address Objects, click
the Add icon and select Host . Configure the following, then click OK :
•
For Name, enter UNIX Server .
•
For Color, select magenta .
• For Comment, enter UNIX file server, Chicago .
• Select IP and enter the IP Address 10.1.1.5 .
3.
Create Chicago Corporate Trusted LAN Protected Resources to represent the
destination point of the VPN . In Protected Resources (under VPN Manager), click the
Add icon. Configure as shown in Figure 91 on page 592, then click
OK :
591 Copyright © 2010, Juniper Networks, Inc.
Chapter 12: Configuring VPNs