Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual page 14

Configuring ScreenOS Devices Guide
xiv
Device-Level AutoKey IKE VPN: Using VPN Rule Configuration Overview . . . . . 230
Device-Level Manual Key VPN: Using XAuth Users Overview . . . . . . . . . . . . . . . . 231
Device-Level Manual Key VPN: Using Routing-Based VPN Overview . . . . . . . . . 231
Device-Level Manual Key VPN: Using VPN Configuration Overview . . . . . . . . . . 232
Device-Level Manual Key VPN Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Monitor Management on ScreenOS Devices Using Manual Key VPN . . . . . . 233
Device Level Manual Key VPN: Using VPN Rule Configuration Overview . . . . . . 234
Device Level L2TP VPN: Using L2TP Users Configuration Overview . . . . . . . . . . 235
Device Level L2TP VPN: Using L2TP Configuration Overview . . . . . . . . . . . . . . . 235
Device Level L2TP VPN: Using VPN Rule Configuration Overview . . . . . . . . . . . . 236
Creating Device Level L2TP-over-Autokey IKE VPNs Overview . . . . . . . . . . . . . . 237
Adding VPN Rules to a Security Policy Overview . . . . . . . . . . . . . . . . . . . . . . . . . 237
Configuring the VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Configuring the Security Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Assigning and Installing the Security Policy . . . . . . . . . . . . . . . . . . . . . . . . . 238
Example: Creating Device Level VPN Type 1 (NSM Procedure) . . . . . . . . . . . . . . 238
Example: Creating Device Level VPN Type 2 (NSM Procedure) . . . . . . . . . . . . . . 243
Example: Creating Device Level VPN Type 3 (NSM Procedure) . . . . . . . . . . . . . . 245
L2TP and Xauth Local Users Configuration Overview . . . . . . . . . . . . . . . . . . . . . 247
Configuring L2TP Local Users (NSM Procedure) . . . . . . . . . . . . . . . . . . . . . . . . . 247
XAuth Users Authentication Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Vsys Configurations in NSM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Virtual Router Configurations for Root and Vsys Overview . . . . . . . . . . . . . . . . . . 251
Zone Configurations for Root and Vsys Overview . . . . . . . . . . . . . . . . . . . . . . . . . 251
Interface Configurations for Root and Vsys Overview . . . . . . . . . . . . . . . . . . . . . . 252
Viewing Root and Vsys Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Managing Inter-Vsys Traffic with Shared DMZ Zones . . . . . . . . . . . . . . . . . . . . . . 253
Example: Routing Traffic to Vsys Using VLAN IDs (NSM Procedure) . . . . . . . . . . 254
Example: Routing Traffic to Vsys Using IP Classification (NSM Procedure) . . . . 256
Layer 2 Vsys Configuration Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Assigning L2V VLAN IDs (NSM Procedure) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
L2V VLAN Groups in NSM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Predefined L2V Zones in NSM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
L2V Interface Management in NSM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Configuring L2V VLAN Management Interfaces . . . . . . . . . . . . . . . . . . . . . . . 261
Configuring L2V Aggregate Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Converting L2V to VLAN Trunking (NSM Procedure) . . . . . . . . . . . . . . . . . . . . . . 262
Configuring Crypto-Policy Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Certificate Authentication Support in NSM Overview . . . . . . . . . . . . . . . . . . . . . 267
Self-Signed Certificates in NSM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Local Certificate Validation of ScreenOS Devices Overview . . . . . . . . . . . . . . . . 268
Generating Certificate Requests to ScreenOS Devices (NSM Procedure) . . . . . 269
Loading Local Certificate into NSM Management System . . . . . . . . . . . . . . . . . . 270
Installing Local Certificates Using SCEP in NSM . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Manual Installation of Local Certificates in NSM . . . . . . . . . . . . . . . . . . . . . . . . . 272
Certificate Authority Configuration in NSM Overview . . . . . . . . . . . . . . . . . . . . . . 272
Installing CA Certificates Using SCEP in NSM . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Manual Installation of CA Certificates in NSM . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Copyright © 2010, Juniper Networks, Inc.