Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual page 599

Copyright © 2010, Juniper Networks, Inc.
Configure Tunnel Interface Settings—Select a Primary Zone, Secondary Zone, and
physical source interface for each security device. The selected zone passes VPN traffic
through the selected interface on the security device.
The Zone settings apply to all route-based members selected in the members
window.
If the Primary Zone is not defined or available on the security device, VPN traffic
automatically uses the Secondary Zone.
The Physical Source Interface is the default physical interface on the device that
transmits VPN traffic.
Configure Tunnel Options—ScreenOS 5.x and later devices support additional
functionality for handling VPN tunnels:
To use a single tunnel interface on each device for VPN traffic, enable Generate
Single Tunnel Interface for 5.x devices. When enabled, the security device uses the
route table and the next-hop tunnel binding table to link a specific destination to
one of a number of VPN tunnels bound to the same tunnel interface. By mapping
the next-hop gateway IP address specified in the route table entry to a specific VPN
tunnel in the NHTB table, the device can use one tunnel interface for all VPN traffic
through the device. This option is enabled by default.
To create entries in the Next Hop Tunnel Binding (NHTB) table, enable Generate
NHTB entries for 5.x devices. When this option is selected, VPN Manager
autogenerates NHTB entries for each VPN tunnel.
NOTE: If you are using a single interface for all VPN traffic on the device but you do not
select this option, you must manually add the NHTB routes in the NHTB table, or
configure BGP to automatically create the entries for you. This option is disabled by
default.
Select Dial Backup to enable NetScreen-5GT security devices to use the serial port as
a backup termination point for the VPN tunnel. When this option is enabled, VPN
Manager automatically generates the termination point for the serial interface during
VPN creation (you do not need to select the serial interface manually when configuring
Termination Points).
Configure Members—Click the Add icon to select the predefined security devices you
want to include in the VPN. After you have added the device to the VPN, you can
double-click the device and configure overrides for the default tunnel interface zone,
the physical source interface. For devices running ScreenOS 5.x and later, you can also
enable/disable single tunnel interface and NHTB entries.
After VPN Manager generates the tunnel interfaces, you must configure static or
dynamic routes on each VPN member to route traffic to other VPN members.
Chapter 11: Configuring VPNs
549