Example: Configuring An Autokey Ike, Policy-Based Site-To-Site Vpn - Juniper NETWORK AND SECURITY MANAGER 2010.3 - ADMINISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

Example: Configuring an Autokey IKE, Policy-Based Site-to-Site VPN

578
An AutoKey IKE VPN connects protected resources using AutoKey IKE. Use this VPN type
to connect and control traffic between two security devices. In this example, an AutoKey
IKE tunnel using a pair of certificates (one at each end of the tunnel) provides the secure
connection between the Tokyo and Paris offices. For the Phase 1 and 2 security levels,
you specify the Phase 1 proposal as rsa-g2-3des-sha and select the predefined
"Compatible" set of proposals for Phase 2. It is assumed that both participants already
have RSA certificates and are using Entrust as the certificate authority (CA). All zones
are in the trust-vr.
Configure security devices.
1.
a. Configure the Tokyo device with the following interfaces:
Ethernet1 is the Trust IP (10.1.1.1/24) in the Trust zone.
Ethernet3 is the Untrust IP (1.1.1.1/24) in the Untrust zone.
b. Configure the Paris device with the following interfaces:
Ethernet1 is the Trust IP (10.2.2.1/24) in the Trust zone.
Ethernet3 is the Untrust IP (2.2.2.2/24) in the Untrust zone.
Create the address objects that you will use to create Protected Resources (for
2.
details on creating or editing address objects,. If you imported a security device, the
address book objects configured on that device are automatically imported as
Aaddress objects into the NSM UI.
a. Add the Tokyo Trust LAN (10.1.1.0/24) as a network address object. In Address
Objects, click the Add icon and select Network. Configure the following, then
click OK:
For Name, enter Tokyo Trust LAN.
For IP Address/Netmask, enter 10.1.1.0/24.
For Color, select magenta.
For Comment, enter Tokyo Trust Zone.
b. Add the Paris Trust LAN (10.2.2.0/24) as a network address object. In Address
Objects, click the Add icon and select Network. Configure the following, then
click OK:
For Name, enter Paris Trust LAN.
For IP Address/Netmask, enter 10.2.2.0/24.
For Color, select magenta.
For Comment, enter Paris Trust Zone.
Create the Tokyo Protected Resources object. In Protected Resources (under VPN
3.
Manager), click the Add icon. Configure as shown in Figure 87 on page 579, then click
OK:
Copyright © 2010, Juniper Networks, Inc.