Configuring Tunnel Interfaces And Tunnel Zones; Configuring Static And Dynamic Routes - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide
566
For VPNs created with VPN Manager, you create the VPN first to autogenerate the tunnel
interfaces, then create the routes on the device itself using those tunnel interfaces. For
VPNs created at the device level, you can create the tunnel interfaces and routes before
or after configuring the VPN.

Configuring Tunnel Interfaces and Tunnel Zones

A VPN requires a physical or virtual interface on the security device, and each security
device supports a specific number of physical and virtual interfaces. To support multiple
VPNs on a device, you might want to create tunnel interfaces and tunnel zones to increase
the number of available interfaces on the device.
NOTE: VPN Manager automatically creates the necessary tunnel interfaces
for route-based VPNs. For device-level VPNs, you can create the tunnel
interfaces before or after creating the VPN.
If you do not need to do address translation (NAT), use unnumbered.
Tunnel Interfaces—A tunnel interface handles VPN traffic between the VPN tunnel and
the protected resources. You can create numbered tunnel interfaces that use unique
IP addresses and netmasks, or unnumbered tunnel interfaces that do not have their
own IP address and netmask (unnumbered tunnel interface borrows the IP address
of the default interface of the security zone).
Tunnel Zones—A tunnel zone is a logical construction that includes one or more
numbered tunnel interfaces. You must bind the VPN tunnel to the tunnel zone (not
the numbered tunnel interfaces); the VPN tunnel uses the default interface for the
tunnel zone. In a policy-based VPN, you can link:
A single VPN tunnel to multiple tunnel interfaces
Multiple VPN tunnels to a single tunnel interface
For details on tunnel interfaces and tunnel zones, see the Network and Security Manager
Configuring ScreenOS and IDP Devices Guide.

Configuring Static and Dynamic Routes

A security device must know the path, or route, between each protected resource or
security device in the VPN before it can forward packets from the source network to the
destination network on the other side of the tunnel. To specify the route, you can use
static routes, which define a specific, unchanging path between two VPN nodes, or
dynamic routes, which define an algorithm that dynamically determines the best path
between two VPN nodes.
NOTE: If you are using VPN Manager to create the route-based VPNs, you
create the routes after autogenerating the VPN. If you are creating a
device-level VPN, you can create the routes after configuring the tunnel
interfaces.
Copyright © 2010, Juniper Networks, Inc.