Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 666 / 1026

•
For IKE VPNs, select the VPN that you configured on the device.
• For L2TP VPNs, you must also select the L2TP tunnel that you configured on the
device.
3.
Select the Protected Resources for the VPN:
• If both VPN termination points are security devices, choose the protected resources
that represent the network components you want to protect. You can also select
a predefined Global MIP or VIP for the device.
• If the source VPN termination point is a RAS user, select Source is Dialup and choose
the Protected Resources behind the destination VPN termination point that represent
the network components you want to protect on the remote network.
• If the destination VPN termination point is a RAS user, select Destination is Dialup
and choose the Protected Resources behind the source VPN termination point that
represent the network components you want to protect on the local network.
Configuring the Security Policy
To configure the remaining columns for the VPN rule:
• From Zone—Select the zone on the source VPN member that contains the termination
interface for the VPN tunnel.
•
To Zone—Select the zone on the destination VPN member that contains the termination
interface for the VPN tunnel.
• Service column—Select the services you want to permit in the VPN tunnel.
You do not need to configure the action—NSM automatically defines the action as tunnel.
You can also configure traffic shaping, options, authentication, antivirus, or attack
protection for the VPN Rule.
To deny a host, use a deny rule before the VPN rule.
Assign and Install the Security Policy
You must assign the security policy to the each VPN member and install the security
policy on those devices before the VPN is active.
Device-Level VPN Examples
This section provides examples of the two device-level VPN types:
•
“Example: Configuring a Route-Based Site-to-Site VPN, Manual Key” on page 617
•
“Example: Configuring a Policy-Based Site-to-Site VPN, Manual Key” on page 622
• “Example: Configuring a Policy-Based RAS VPN, L2TP” on page 624
The following sections provide step-by-step instructions on creating each type of
device-level VPN.
Copyright © 2010, Juniper Networks, Inc. 616
Network and Security Manager Administration Guide