Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual page 263

Copyright © 2010, Juniper Networks, Inc.
In this example, a manual key tunnel provides a secure communication channel between
offices in Tokyo and Paris. The trust zones at each site are in NAT mode. The trust and
untrust security zones are in the trust-vr routing domain, and the untrust zone interface
(ethernet3) serves as the outgoing interface for the VPN tunnel.
To set up the tunnel, you must configure the security devices at both ends of the tunnel.
First, you create the VPN components that you use to build the VPN, such as the security
devices and the shared address objects. Next, you create the tunnel interfaces for each
device and configure the VPN tunnel. You must also add the necessary static routes on
each device to create the VPN tunnel. Finally, you create firewall rules in a security policy
to control VPN traffic between the two sites.
Figure 1: RB Site-to-Site VPN, MK Example Overview
Add the Tokyo and Paris security devices (for details on adding devices, see "Adding
1.
Devices" in the Network and Security Manager Administration Guide). Begin by
configuring the Tokyo device with the following interfaces:
Ethernet1 is the trust IP (10.1.1.1/24) in the trust zone.
Ethernet3 is the untrust IP (1.1.1.1/24) in the untrust zone.
Configure the Paris device with the following interfaces:
2.
Ethernet1 is the trust IP (10.2.2.1/24) in the trust zone.
Ethernet3 is the untrust IP (2.2.2.2/24) in the untrust zone.
Create the address objects that you use in the VPN rule in the firewall rulebase (for
3.
details on creating VPN rules, see the "Adding VPN Rules to a Security Policy Overview"
on page 237).
Add the Tokyo trust LAN (10.1.1.0/24) as an network address object. In Address Objects,
4.
click the Add icon and select Network. Configure the following settings, and then click
OK:
For Name, enter Tokyo Trust LAN.
For IP Address/Netmask, enter 10.1.1.0/24.
Chapter 8: Configuring VPNs
239