Configuring Required Routing-Based Vpn Components Overview; Overview - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Configuring Required Routing-Based VPN Components Overview

Related
Documentation
Routing-Based VPN Support Using Tunnel Interfaces and Tunnel Zones Overview
Copyright © 2010, Juniper Networks, Inc.
A route-based VPN requires two components:
Tunnel interface or zone
Route (static or dynamic)
For VPNs created with VPN Manager, you create the VPN first to autogenerate the tunnel
interfaces, and then create the routes on the device itself using those tunnel interfaces.
For VPNs created at the device level, you can create the tunnel interfaces and routes
before or after configuring the VPN.
Routing-Based VPN Support Using Tunnel Interfaces and Tunnel Zones Overview on
page 215
Routing-Based VPN Support Using Static and Dynamic Routes Overview on page 216
Policy-Based VPN Creation Using Remote Access Server Users Overview on page 213
A VPN requires a physical or virtual interface on the security device, and each security
device supports a specific number of physical and virtual interfaces. To support multiple
VPNs on a device, you might want to create tunnel interfaces and tunnel zones to increase
the number of available interfaces on the device.
NOTE: VPN Manager automatically creates the necessary tunnel interfaces
for route-based VPNs. For device-level VPNs, you can create the tunnel
interfaces before or after creating the VPN.
If you do not need to do network address translation (NAT), use unnumbered interfaces.
Tunnel Interfaces—A tunnel interface handles VPN traffic between the VPN tunnel
and the protected resources. You can create numbered tunnel interfaces that use
unique IP addresses and netmasks, or unnumbered tunnel interfaces that do not have
their own IP address and netmask (unnumbered tunnel interface borrows the IP address
of the default interface of the security zone).
Tunnel Zones—A tunnel zone is a logical construction that includes one or more
numbered tunnel interfaces. You must bind the VPN tunnel to the tunnel zone (not
the numbered tunnel interfaces); the VPN tunnel uses the default interface for the
tunnel zone. In a policy-based VPN, you can link:
A single VPN tunnel to multiple tunnel interfaces
Multiple VPN tunnels to a single tunnel interface
For details on tunnel interfaces and tunnel zones, see "Routing-Based VPN Support Using
Tunnel Interfaces and Tunnel Zones Overview" on page 215.
Chapter 7: Planning and Preparing VPNs
215