Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 659 / 1026

If your VPN includes only security devices, you can specify one predefined or custom
proposal that NSM propagates to all nodes in the VPN. If your VPN includes extranet
devices, you should use multiple proposals to increase security and ensure compatibility.
Binding/ProxyID
You can bind the VPN tunnel to a tunnel interface or tunnel zone to increase the number
of available interfaces in the security device. To use a tunnel interface and/or tunnel zone
in your VPN, you must first create the tunnel interface or zone on the device; for details,
see “Configuring Tunnel Interfaces and Tunnel Zones” on page 566 and the
Network and
Security Manager Configuring ScreenOS and IDP Devices Guide .
• None—Select none when you do not want to bind the VPN tunnel to a tunnel interface
or zone.
•
Tunnel Interface—Select a preconfigured tunnel interface on the security device to
bind the VPN tunnel to the tunnel interface. The security device routes all VPN traffic
through the tunnel interface to the protected resources.
• Tunnel Zone—Select a preconfigured tunnel zone on the security device to bind the
VPN tunnel directly to the tunnel zone. The tunnel zone must include one or more
numbered tunnel interfaces; when the security device routes VPN traffic to the tunnel
zone, the traffic uses one or more of the tunnel interfaces to reach the protected
resources.
•
DSCP Marks — ScreenOS 6.1 and later supports the DSCP value configuration for tunnel
mode ESP packets only. You cannot configure the DSCP setting if the IPSec mode is
tunnel mode but the binding interface is not a tunnel interface.
You can set the following DSCP Marks under the Binding /Proxy tab on the AutoKey
IKE Parameters page:
• DSCP Marking — You can select either enable or disable. If the selected IPSec mode
is transport, this option is automatically disabled.
• DSCP Value
— Set the DSCP value in the range of 0–63. Mouse over the field to see
the range of allowed values.
You can also enable proxy and configure the proxy parameters.
Monitor
You can enable VPN Monitor and configure the monitoring parameters for the device.
Monitoring is off by default. To enable the VPN Monitor in Realtime Monitor to display
statistics for the VPN tunnel, configure the following:
609 Copyright © 2010, Juniper Networks, Inc.
Chapter 12: Configuring VPNs