Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Руководство администратора

Страница: 667 / 1026

NOTE: For examples on creating other VPN types using VPN Manager, see
“VPN Manager Examples” on page 586.
Example: Configuring a Route-Based Site-to-Site VPN, Manual Key
In this example, a Manual Key tunnel provides a secure communication channel between
offices in Tokyo and Paris. The Trust zones at each site are in NAT mode. The Trust and
Untrust security zones are in the trust-vr routing domain, and the Untrust zone interface
(ethernet3) serves as the outgoing interface for the VPN tunnel.
To set up the tunnel, you must configure the security devices at both ends of the tunnel.
First, you create the VPN components that you use to build the VPN, such as the security
devices and the shared address objects. Next, you create the tunnel interfaces for each
device and configure the VPN tunnel. You must also add the necessary static routes on
each device to create the VPN tunnel. Finally, you create firewall rules in a security policy
to control VPN traffic between the two sites.
1.
Add the Tokyo and Paris security devices.
2.
Configure the Tokyo device with the following interfaces:
•
Ethernet1 is the Trust IP (10.1.1.1/24) in the Trust zone.
•
Ethernet3 is the Untrust IP (1.1.1.1/24) in the Untrust zone.
3.
Configure the Paris device with the following interfaces:
•
Ethernet1 is the Trust IP (10.2.2.1/24) in the Trust zone.
• Ethernet3 is the Untrust IP (2.2.2.2/24) in the Untrust zone.
Next, you create the address objects that you use in the VPN rule in the firewall rulebase
(for details on creating VPN rules, see “Adding VPN Rules” on page 615).
4.
Add the Tokyo Trust LAN (10.1.1.0/24) as a network address object. In Address Objects,
click the Add icon and select
Network . Configure the following, then click OK :
•
For Name, enter Tokyo Trust LAN .
• For IP Address/Netmask, enter 10.1.1.0/24 .
•
For Color, select magenta .
•
For Comment, enter Tokyo Trust Zone .
5.
Add the Paris Trust LAN (10.2.2.0/24) as a network address object. In Address Objects,
click the Add icon and select
Network . Configure the following, then click OK :
•
For Name, enter Paris Trust LAN .
• For IP Address/Netmask, enter 10.2.2.0/24 .
•
For Color, select magenta .
617 Copyright © 2010, Juniper Networks, Inc.
Chapter 12: Configuring VPNs