Table of Contents
Advertisement
JUNOS OS 10.4 Release Notes
112
syn-check-required: The syn-check-required value will override the global value
no-syn-check.
To configure per-policy TCP options, the respective global options must be turned off;
otherwise, the commit check will fail. If global TCP options are disabled and SYN flood
protection permits the first packet, then the per-policy TCP options will control whether
SYN check and/or sequence check are performed.
NOTE:
The per-policy SYN check required option will not override the behavior of
the
set security flow tcp-session no-syn-check-in-tunnel
Disabling the global SYN check reduces the effectiveness of the device In
defending against packet flooding.
VPNs
IKE and IPsec predefined proposals for dynamic VPN—This feature is supported on
SRX100, SRX210, SRX220, SRX240, and SRX650 devices.
In earlier releases, the administrators had to configure individual Internet Key Exchange
(IKE) and IP Security (IPsec) proposals for all IKE and IPsec policy configurations. This
procedure was tedious and time consuming when the administrators had to configure
many VPN policies because they had to configure custom proposals for all IKE and
IPsec configurations.
Junos OS Release 10.4 supports proposal-set configuration in IKE and IPsec; the
administrator can select basic, compatible, or standard proposal sets for dynamic VPN
clients. Each proposal set consists of two or more predefined proposals. The server
selects one predefined proposal from the set configured and pushes it to the client in
the client configuration. The client uses this proposal in negotiations with the server
to establish the connection.
The default values for IKE and IPsec security association (SA) rekey timeout are as
follows:
For IKE SA, the rekey timeout is 28800 seconds.
For IPsec SA, the rekey timeout is 3600 seconds.
The basic use cases of proposals are as follows:
IKE and IPsec both use proposal sets.
The server selects a predefined proposal from the proposal set and sends it to the
client, along with the default rekey timeout value.
IKE uses a proposal set, and IPsec uses a custom proposal.
The server sends a predefined IKE proposal from the configured IKE proposal set to
the client, along with the default rekey timeout value. For IPsec, the server sends the
setting that is configured in the IPsec proposal.
IKE uses a custom proposal, and IPsec uses a proposal set.
CLI command.
Copyright © 2011, Juniper Networks, Inc.
Advertisement
Table of Contents
