Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 657 / 1026

•
PKI—Use if your VPN includes extranet devices or you require the additional security
provided by certificates (PKI uses certificates for VPN member authentication).
For Phase 1 negotiations, select a proposal or proposal set. You can select from predefined
or user-defined proposals:
• To use a predefined proposal set, select one of the following:
•
Basic ( nopfs-esp-des-sha , nopfs-esp-des-md5 )
•
Compatible ( nopfs-esp-3des-sha , nopfs-esp-3des-md5, nopfs-esp-des-sha ,
nopfs-esp-des-md5)
•
Standard ( gs-esp-3des-sha , gs-esp-aes128-sha)
NOTE: You cannot use a predefined proposal set with certificates—you
must select a user-defined proposal or change the authentication method
to Preshared Key.
•
To use a user-defined proposal, select a single proposal from the list of predefined
and custom IKE Phase 1 Proposals. For details on custom IKE proposals.
If your VPN includes only security devices, you can specify one predefined or custom
proposal that NSM propagates to all nodes in the VPN. If your VPN includes extranet
devices, you should use multiple proposals to increase security and ensure compatibility.
Configuring Routes (Route-based only)
For a routing-based VPN member, you must configure:
•
Tunnel zone or tunnel interfaces on the member.
•
Static or dynamic routes from the member to other VPN members.
VPN traffic flows through the tunnel zones or tunnel interfaces on the security device,
and uses static or dynamic routes to reach other VPN members. You must create the
tunnel zones and interfaces before configuring routes.
For details on configuring tunnel zones, tunnel interfaces, static routes, or dynamic routes,
see the
Network and Security Manager Configuring ScreenOS and IDP Devices Guide .
After you have configured the tunnel zone or interface on the security device, you must
bind the VPN to that zone or interface to make the VPN functional, as described in the
following section.
Configuring the VPN
When you configure the VPN, you are defining the gateway the security device uses to
connect to the VPN, the IKE Phase 2 proposals used by that gateway, and how you want
NSM to monitor the VPN tunnel.
For route-based VPNs, you are also binding the VPN to the tunnel interface or zone that
sends and receives VPN traffic to and from the device.
607 Copyright © 2010, Juniper Networks, Inc.
Chapter 12: Configuring VPNs