Table of Contents
Advertisement
Network and Security Manager Administration Guide
Creating Protected Resources
Editing Protected Resources
Configuring IKE Proposals
428
You can have more than one protected resource for a single address or range of addresses.
That way you can individually manage different services traffic to the same destination
separately.
To add a protected resource object:
In the navigation tree, select VPN Manager > Protected Resources . In the main display
1.
area, click the Add icon to display the Protected Resource dialog box.
Enter a name for the protected resource.
2.
Select the services you want to permit to this resource, such as FTP, HTTP, NFS, and
3.
so on. Select Any to permit all services.
Select the initiator of the permitted service: Server, a Client, or Both.
4.
Select the address object or address group for the resource.
5.
Add the security device through which traffic can reach the protected resource:
6.
a. In the Security Gateway area, click the icon to display the Security Gateway dialog
box.
b. Select security device or device group
c. Select the security zone on the security device that contains the address objects.
d. Click OK to add the security gateway to the protected resource.
You can add multiple security gateways to provide redundant access for the protected
resource.
You can edit protected resources to accommodate changes in your network:
If you make changes to a protected resource object that is used in a VPN, NSM
automatically generates new configuration and propagates your changes to all affected
security devices.
If you change the security device that protects a resource, NSM removes the previous
security device from all affected VPNs and adds the new security device. However,
NSM does not configure the VPN topology for the new security device—you must
reconfigure the topology to include the new device manually.
In an AutoKey IKE VPN, you can use the Internet Key Exchange (IKE) protocol to generate
and distribute encryption keys and authentication algorithms to all VPN nodes. IKE
automatically generates new encryption keys for the traffic on the network, and
automatically replaces those keys when they expire. Because IKE generates keys
automatically, you can give each key a short life span, making it expire before it can be
Copyright © 2010, Juniper Networks, Inc.
Advertisement
Table of Contents
