Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual page 13

Chapter 8
Copyright © 2010, Juniper Networks, Inc.
Defining VPN Members and Topology Using NSM . . . . . . . . . . . . . . . . . . . . . . . . 200
Traffic Protection Using Tunneling Protocol in NSM Overview . . . . . . . . . . . . . . 202
Traffic Protection Using IPsec Tunneling Protocol Overview . . . . . . . . . . . . . . . . 203
Using Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Using Encapsulating Security Payload (ESP) . . . . . . . . . . . . . . . . . . . . . . . . 203
Traffic Protection Using L2TP Tunneling Protocol Overview . . . . . . . . . . . . . . . . 205
VPN Tunnel Types Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
About Policy-Based VPNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
About Route-Based VPNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Defining VPN Checklist Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Defining Members and Topology in NSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Defining Traffic Types for Data Protection in NSM . . . . . . . . . . . . . . . . . . . . . . . . 207
Defining VPN Traffic Using Security Protocols in NSM . . . . . . . . . . . . . . . . . . . . . 208
Defining Tunnel Creation Methods in NSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Using VPN Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Creating Device-Level VPNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Preparing Basic VPN Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Preparing Required Policy-Based VPN Components Overview . . . . . . . . . . . . . . . 211
Policy-Based VPN Creation Using Address Objects and Protected Resources
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Configuring Address Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Configuring Protected Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Policy-Based VPN Creation Using Shared NAT Objects Overview . . . . . . . . . . . . 212
Policy-Based VPN Creation Using Remote Access Server Users Overview . . . . . 213
Authenticating RAS Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Configuring Group IKE IDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Configuring Required Routing-Based VPN Components Overview . . . . . . . . . . . 215
Routing-Based VPN Support Using Tunnel Interfaces and Tunnel Zones
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Routing-Based VPN Support Using Static and Dynamic Routes Overview . . . . . 216
Preparing Optional VPN Components Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Optional VPN Support Using Authentication Servers Overview . . . . . . . . . . . . . . 217
Optional VPN Support Using Certificate Objects Overview . . . . . . . . . . . . . . . . . 217
Configuring Local Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Configuring CA Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Configuring CRL Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Configuring VPNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Device Level VPN Types and Supported Configurations Overview . . . . . . . . . . . . 221
Device Level AutoKey IKE VPN: Using Gateway Configuration Overview . . . . . . . 221
ScreenOS Devices Gateway Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
ScreenOS Devices IKE IDs or XAuth Identification Number . . . . . . . . . . . . . 224
Security Methods for ScreenOS Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Device Level AutoKey IKE VPN: Using Routes Configuration Overview . . . . . . . . 227
Device-Level AutoKey IKE VPN: Using VPN Configuration Overview . . . . . . . . . . 227
Device-Level AutoKey IKE VPN Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
ScreenOS Security Measures Using VPN Configuration . . . . . . . . . . . . . . . . 228
Binding/ProxyID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Monitor Management on ScreenOS Devices Using AutoKey IKE VPN . . . . . 230
Table of Contents
xiii