Table of Contents
Advertisement
JUNOS OS 10.4 Release Notes
114
After successful authentication, AUTHD sends the following network parameters to
IKE or XAuth:
IP address
Domain Name System (DNS)
Windows Internet Naming Service (WINS)
The IP address can be drawn from a locally configured IP address pool. AUTHD requires
IKE or XAuth to release the IP address when it is no longer in use.
IKE provides a mechanism for establishing IP Security (IPsec) tunnels.
[Junos OS CLI User Guide, Junos OS Security Configuration Guide]
Support group Internet Key Exchange (IKE) IDs for dynamic VPN configuration —This
feature is supported on SRX100, SRX210, SRX220, SRX240, and SRX650 devices.
The existing design of the dynamic virtual private network (VPN) uses unique Internet
Key Exchange (IKE) ID for each user connection. For each user, VPN needs to be
configured with an individual IKE gateway, an IPsec VPN, and a security policy using
the IPsec VPN. This is cumbersome when there are a large number of users. The design
is modified to allow a number of users to share a set of IKE or IPsec VPN (or policy
configuration) using shared-ike-id or group-ike-id. This reduces the number of times
the VPN needs to be configured.
The shared-ike-id and group-ike-id allow you to configure VPN once for multiple users.
All users connecting through a shared-ike-id configuration use the same IKE ID and
preshared key. The user credentials are verified in the extended authentication (XAuth)
phase of AUTHD. The credential of a user is configured either in Radius or in the access
database of AUTHD.
When using group-ike-id or shared-ike-id for user connection management and
licensing, the users on the client PC must use the same user credentials for both
WebAuth and XAuth login (that is, the two client login windows) to prevent undesirable
behavior and incorrect CLI output on the server.
NOTE: We recommend that you use group-ike-id whenever possible.
For group-ike-id, a part of the configuration for a user IKE ID is common to the group.
The IKE ID is the concatenation of an individual part and the common part of IKE ID.
For example, a user can use a group-ike-id configuration with a common part
".juniper.net" and the individual part "X". The IKE ID can be "X.juniper.net". Httpd-gk
generates the individual part of the IKE ID.
The group-ike-id does not require extended authentication (XAuth). However, for
dynamic VPN, XAuth is needed to retrieve the network attributes such as IP address
for the client. Therefore, if XAuth is not configured for group-ike-id and the administrator
uses the IKE gateway in a dynamic VPN client, a warning message appears.
This feature introduces new commands for ike sa and dynamic-vpn and new options
in the IKE Gateway Add/Edit page of J-Web.
Copyright © 2011, Juniper Networks, Inc.
Advertisement
Table of Contents
