Table of Contents
Advertisement
Copyright © 2011, Juniper Networks, Inc.
New Features in Junos OS Release 10.4 for SRX Series Services Gateways and J Series Services Routers
The server sends a predefined IPsec proposal from the configured IPsec proposal
set to the client, along with the default rekey timeout value. For IKE, the server sends
the setting that is configured in the IKE proposal.
NOTE: If IPsec uses the standard proposal set and perfect forward secrecy
(PFS) is not configured, then the default PFS is set as group2. For other
proposal sets, PFS will not be set because it is not configured.
[Junos OS CLI Reference, Junos OS Security Configuration Guide]
Local authentication and IP address assignment for dynamic VPN—This feature is
supported on SRX100, SRX210, SRX220, SRX240, and SRX650 devices.
A client application sends an authentication request and a request for an IP address
on behalf of an unauthenticated client at the same time. The communication between
the client and AUTHD is minimized because the IP address request is not sent as a
separate message.
After successful local authentication, AUTHD performs the following tasks:
Assigns the address from the predefined (or statically assigned) address pools if
the address matches the criteria specified by the client application.
Assigns attributes such as wins server and name-server address.
Updates the associated client entry in the session database.
Note: For client applications that rely on a RADIUS or other external server for
authentication, AUTHD might not assign IP addresses.
This feature is used to perform the following:
Assign an IP address to the client after successful authentication.
Provide a mechanism in AUTHD for linking an address pool to a client profile and
assigning an IP address to the client from the pool.
Provide a mechanism in AUTHD for assigning IP version 4 (IPv4) addresses to the
users.
Provide different IP addresses for multiple logins by the same user.
Allow configuration changes in the address pool after address assignment.
Address pools are defined at the [edit access address-assignment] hierarchy.
[Junos OS CLI Reference, Junos OS Administration Guide for Security Devices]
Local IP address management for VPN XAuth support—This feature is supported on
SRX100, SRX210, SRX240, SRX650, J4350, and J6350 devices.
When you configure extended authentication (XAuth), you must enter the username
and password, after the Internet Key Exchange (IKE) phase 1 security association (SA)
is established. AUTHD verifies the credentials received from you.
113
Advertisement
Table of Contents
