Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual page 623

Copyright © 2010, Juniper Networks, Inc.
tunnel interfaces. For details on creating routes, see the Network and Security Manager
Configuring ScreenOS and IDP Devices Guide.
Click the security devices link to display the route-based member selection dialog box.
Configure Tunnel Interface Settings—Select a Primary Zone, Secondary Zone, and
physical source interface for each security device. The selected zone passes VPN traffic
through the selected interface on the security device.
The Zone settings apply to all route-based members selected in the members
window.
If the Primary Zone is not defined or available on the security device, VPN traffic
automatically uses the Secondary Zone.
The Physical Source Interface is the default physical interface on the device that
transmits VPN traffic.
Configure Tunnel Options—ScreenOS 5.x and later devices support additional
functionality for handling VPN tunnels:
To use a single tunnel interface on each device for VPN traffic, enable Generate
Single Tunnel Interface for 5.x devices. When enabled, the security device uses the
route table and the next-hop tunnel binding table to link a specific destination to
one of a number of VPN tunnels bound to the same tunnel interface. By mapping
the next-hop gateway IP address specified in the route table entry to a specific VPN
tunnel in the NHTB table, the device can use one tunnel interface for all VPN traffic
through the device. This option is enabled by default.
To create entries in the Next Hop Tunnel Binding (NHTB) table, enable Generate
NHTB entries for 5.x devices. When this option is selected, VPN Manager
autogenerates NHTB entries for each VPN tunnel.
NOTE: If you are using a single interface for all VPN traffic on the device
but you do not select this option, you must manually add the NHTB routes
in the NHTB table, or configure BGP to automatically create the entries
for you. This option is disabled by default.
Select Dial Backup to enable NetScreen-5GT security devices to use the serial port as
a backup termination point for the VPN tunnel. When this option is enabled, VPN
Manager automatically generates the termination point for the serial interface during
VPN creation (you do not need to select the serial interface manually when configuring
Termination Points).
Configure Members—Click the Add icon to select the predefined security devices you
want to include in the VPN. After you have added the device to the VPN, you can
double-click the device and configure overrides for the default tunnel interface zone,
the physical source interface. For devices running ScreenOS 5.x and later, you can also
enable/disable single tunnel interface and NHTB entries.
Chapter 12: Configuring VPNs
573