Moxa Technologies EDR-G9010 Series, Руководство пользователя

Страница: 220 / 274

EDR-G9010 Series User Manual 220
Site-to-site IPsec VPN tunnel with Juniper systems
In this example, in order to establish a VPN tunnel, the central site router and remote site router have to
know the identity of each other and use the same authentication mechanism to verify each other. Here we
use a Juniper SSG5 as an example to elaborate how the Industrial Secure Router can build an IPsec VPN
connection with Juniper systems.
VPN Plan
•
All communication from the Central site network (192.168.127.0/24) to the Remote site Network
(192.168.128.0/24) needs to pass through the VPN tunnel.
•
The Intranet Network is 10.10.10.0/24.
• The configuration of the WAN/LAN interface for the Industrial Secure Routers and Juniper SSG5 is
shown in the following table.
Configuration EDR Series Juniper SSG5
Router Setting
WAN IP 10.10.10.100 10.10.10.200
LAN IP 192.168.127.254 192.168.128.254
Based on the requirements and VPN plan, the recommended configuration for the IPsec VPN connection is
shown in the following table:
Configuration EDR Series Juniper SSG5
Tunnel Setting
Connection Type Site to Site Site to Site
Remote VPN gateway 10.10.10.200 10.10.10.100
Startup mode Wait for Connection Start in Initial
Local Network/
Netmask 192.168.127.0/
255.255.255.0 192.168.128.0/
25.255.255.0
Remote Network/
Netmask 192.168.128.0/
25.255.255.0 192.168.127.0/
255.255.255.0
Identity
IP address
Local ID: 10.10.10.100
Remote ID: 10.10.10.200 IP address
Local ID: 10.10.10.200
Remote ID: 10.10.10.100
Key Exchange Authentication mode
Pre-Shared Key or X.509 with
CA Pre-Shared Key or X.509 with
CA
Data Exchange Encryption / Harsh 3DES/SHA-1 3DES/SHA-1
Note that to establish a VPN connection with Juniper systems, the Identity should set to “ IP Address ” and
the authentication mode should set to “ Pre-Shared Key ” or “ X.509 with CA ”. During the EDR Series
compliance test with the Juniper SSG5, all Identity modes except "IP Address” and all authentication modes
except “X.509 with CA” did not work with the Juniper SSG5. A summary of settings for VPN connections
with Juniper systems is listed in the table below.
EDR Series VPN settings for
compatibility with Juniper systems Authentication mode
Pre-shared Key
X.509 X.509 With CA
Identity
IP Address Supported Not supported Supported
FQDN
Not supported Key ID
Auto(with Cisco)