Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 661 / 1026

3.
Configure VPN on Device
4.
Add VPN rules to security policy
Adding XAuth Users
For VPNs that use IPSec manual key to provide remote access services, you must add
an XAuth User to the security device. An XAuth User has an account on the security device
that guards the protected resources in the VPN; when the user attempts to connect to
a protected resource, the security device authenticates the user.
To add a XAuth User for a security device, in the security device configuration
L2TP/XAuth/Local User, click the Add icon. Enter a name for the user, then specify:
•
User—Select a preconfigured Local User object that is configured for XAuth.
• Remote Setting—Select a preconfigured Remote Settings object.
• IP Pool—Select a preconfigured IP Pool object.
•
Static IP—Enter the static IP address of the Local User.
Configuring Routes (Route-based only)
For a routing-based VPN member, you must configure:
•
Tunnel zone or tunnel interfaces on the member.
•
Static or dynamic routes from the member to other VPN members.
VPN traffic flows through the tunnel zones or tunnel interfaces on the security device,
and uses static or dynamic routes to reach other VPN members. You must create the
tunnel zones and interfaces before configuring routes. For details on configuring tunnel
zones, tunnel interfaces, and static or dynamic routes, see the
Network and Security
Manager Configuring ScreenOS and IDP Devices Guide .
After you have configured the tunnel zone or interface on the security device, you must
bind the VPN to that zone or interface to make the VPN functional, as described in the
following section.
Configuring the VPN
The following sections detail how to configure the VPN.
Properties
Enter the following values:
•
VPN name—Enter a name for the VPN.
• Gateway—Enter a gateway for the VPN.
• Local SPI—The local Security Parameter Index.
•
Remote SPI—The remote Security Parameter Index.
•
Outgoing Interface—The outgoing interface is the interface on the security device that
sends and receives VPN traffic. Typically, the outgoing interface is in the untrust zone.
611 Copyright © 2010, Juniper Networks, Inc.
Chapter 12: Configuring VPNs