Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 646 / 1026

g. Select the Topology link. The Topology dialog box appears.
h. Click the Add icon to display the Topology configuration dialog box.
i. In the Mains window, select the Paris and Tokyo security devices.
j. Click OK to return to the Topology dialog box, then click OK to return to the main
display area.
k. Configure the termination points of the VPN:
l. Click the Termination Points link. The Termination Points dialog box appears.
m. Confirm that both Paris and Tokyo devices use a Termination Interface of ethernet3,
then click OK to return to the main display area.
n. Configure the VPN gateway:
o. Click the Gateway Parameters link. The Properties tab appears. Leave all defaults
and click the Security tab.
p. In the Security tab, enter the preshared key value (h1p8A24nG5), then click
Generate Key .
q. For Phase 1 Proposals, select User-Defined , then click the Add/Edit icon to add
the pre-g2-3des-sha proposal.
11.
Click Save to save your configuration changes to the VPN. Because this VPN is
route-based, no rules are autogenerated. However, you can view the device tunnel
summary to see all autogenerated tunnels between each security device in the VPN.
Figure 94: View Tunnel Summary for AutoKey IKE, RB Site-to Site VPN
A tunnel interface acts as a doorway to a VPN tunnel; traffic enters and exits a VPN tunnel
via a tunnel interface. These tunnels are an "always-on” connection—the devices will
route any traffic with an appropriate source and destination IP address through the VPN
tunnel.
To control traffic through the tunnel, you must add firewall rules to the security policy
that is installed on each VPN node.
Next, you must create the routes (in the route table of each device) that will connect the
autogenerated tunnel interfaces and form the VPN tunnel (for details on creating routes,
see the
Network and Security Manager Configuring ScreenOS and IDP Devices Guide . You
can use static or dynamic routes, however, this example details only the static route
creation. For each device, you will create two routes using the trust virtual router (trust-vr):
Copyright © 2010, Juniper Networks, Inc. 596
Network and Security Manager Administration Guide