Configuring Tunnel Interfaces And Tunnel Zones; Configuring Static And Dynamic Routes - Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide
542

Configuring Tunnel Interfaces and Tunnel Zones

A VPN requires a physical or virtual interface on the security device, and each security
device supports a specific number of physical and virtual interfaces. To support multiple
VPNs on a device, you might want to create tunnel interfaces and tunnel zones to increase
the number of available interfaces on the device.
NOTE: VPN Manager automatically creates the necessary tunnel interfaces for
route-based VPNs. For device-level VPNs, you can create the tunnel interfaces before
or after creating the VPN.
If you do not need to do address translation (NAT), use unnumbered.
Tunnel Interfaces—A tunnel interface handles VPN traffic between the VPN tunnel and
the protected resources. You can create numbered tunnel interfaces that use unique
IP addresses and netmasks, or unnumbered tunnel interfaces that do not have their
own IP address and netmask (unnumbered tunnel interface borrows the IP address
of the default interface of the security zone).
Tunnel Zones—A tunnel zone is a logical construction that includes one or more
numbered tunnel interfaces. You must bind the VPN tunnel to the tunnel zone (not
the numbered tunnel interfaces); the VPN tunnel uses the default interface for the
tunnel zone. In a policy-based VPN, you can link:
A single VPN tunnel to multiple tunnel interfaces
Multiple VPN tunnels to a single tunnel interface
For details on tunnel interfaces and tunnel zones, see the Network and Security Manager
Configuring ScreenOS and IDP Devices Guide.

Configuring Static and Dynamic Routes

A security device must know the path, or route, between each protected resource or
security device in the VPN before it can forward packets from the source network to the
destination network on the other side of the tunnel. To specify the route, you can use
static routes, which define a specific, unchanging path between two VPN nodes, or
dynamic routes, which define an algorithm that dynamically determines the best path
between two VPN nodes.
NOTE: If you are using VPN Manager to create the route-based VPNs, you create the
routes after autogenerating the VPN. If you are creating a device-level VPN, you can
create the routes after configuring the tunnel interfaces.
To create a static route, you must manually create a route for each tunnel on each device.
For VPNs with more than just a few devices, Juniper Networks highly recommends using
a dynamic routing protocol to automatically determine the best route for VPN traffic:
To route between different networks over the Internet, use Border Gateway Protocol
(BGP); to route within the same network, use Open Shortest Patch First (OSPF). For
Copyright © 2010, Juniper Networks, Inc.