Binding; Monitor Management On Screenos Devices Using Manual Key Vpn - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Table 58: Device-Level Manual Key VPN Properties (continued)
Device-Level Manual Key
VPN Properties
IPsec Protocol

Binding

Monitor Management on ScreenOS Devices Using Manual Key VPN

Copyright © 2010, Juniper Networks, Inc.
Your Action
Specify the IPsec protocol and algorithm you want to use for data authentication and/or
encryption. Because this information is static for each VPN member, they do not need to negotiate
for communication.
AH—Use Authentication Header to authenticate the VPN traffic, but not encrypt the traffic.
If you select AH, you must also specify the key or password that AH uses in the authentication
algorithm.
NOTE: All passwords handled by NSM are case-sensitive.
ESP—Use Encapsulating Security Payload to authenticate and encrypt the VPN traffic. If you
select ESP, because ESP uses keys to encrypt and decrypt data, you must also specify the
key or password that the VPN node uses to send and receive VPN data through the VPN
tunnel.
You can bind the VPN tunnel to a tunnel interface or tunnel zone to increase the number
of available interfaces in the security device. To use a tunnel interface and/or tunnel zone
in your VPN, you must first create the tunnel interface or zone on the device; for details,
see "Routing-Based VPN Support Using Tunnel Interfaces and Tunnel Zones Overview"
on page 215 and "Configuring a Tunnel Interface" on page 87.
None—Select none when you do not want to bind the VPN tunnel to a tunnel interface
or zone.
Tunnel Interface—Select a preconfigured tunnel interface on the security device to
bind the VPN tunnel to the tunnel interface. The security device routes all VPN traffic
through the tunnel interface to the protected resources. The user is able to set the
DSCP marking and DSCP value. The DSCP value ranges from 0 through 63.
Tunnel Zone—Select a preconfigured tunnel zone on the security device to bind the
VPN tunnel directly to the tunnel zone. The tunnel zone must include one or more
numbered tunnel interfaces; when the security device routes VPN traffic to the tunnel
zone, the traffic uses one or more of the tunnel interfaces to reach the protected
resources.
You can enable VPN Monitor and configure the monitoring parameters for the device.
Monitoring is off by default. Enable the VPN Monitor in RealTime Monitor to display
statistics for the VPN tunnel as described in Table 59 on page 234.
Chapter 8: Configuring VPNs
233