Editing The Vpn Configuration; Editing Vpn Overrides; Vpn Manager Examples; Example: Configuring An Autokey Ike, Policy-Based Site-To-Site Vpn - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

VPN Manager Examples

Example: Configuring an Autokey IKE, Policy-Based Site-to-Site VPN

586

Editing the VPN Configuration

To add or delete a member, edit any VPN parameter, or reconfigure the VPN topology,
select the VPN and click OK. Make your changes, then click Save to regenerate the VPN.
NOTE: After you click Save, you cannot revert your changes to a VPN.

Editing VPN Overrides

If you add, edit, or delete an override, the VPN link automatically updates the
autogenerated rules to reflect those edits.
This section provides examples of common VPN types:
"Example: Configuring an Autokey IKE, Policy-Based Site-to-Site VPN" on page 586
"Example: Configuring an Autokey IKE RAS, Policy-Based VPN" on page 591
"Example: Configuring an Autokey IKE, Route-Based Site-to-Site VPN" on page 594
"Example: Configuring XAuth Authentication with External User Group" on page 597
The following sections provide step-by-step instructions on creating each VPN type.
NOTE: For examples on creating a Manual Key VPN, see "Device-Level VPN
Examples" on page 616.
An AutoKey IKE VPN connects protected resources using AutoKey IKE. Use this VPN type
to connect and control traffic between two security devices. In this example, an AutoKey
IKE tunnel using a pair of certificates (one at each end of the tunnel) provides the secure
connection between the Tokyo and Paris offices. For the Phase 1 and 2 security levels,
you specify the Phase 1 proposal as rsa-g2-3des-sha and select the predefined
"Compatible" set of proposals for Phase 2. It is assumed that both participants already
have RSA certificates and are using Entrust as the certificate authority (CA). All zones
are in the trust-vr.
Configure security devices.
1.
a. Configure the Tokyo device with the following interfaces:
Ethernet1 is the Trust IP (10.1.1.1/24) in the Trust zone.
Ethernet3 is the Untrust IP (1.1.1.1/24) in the Untrust zone.
b. Configure the Paris device with the following interfaces:
Copyright © 2010, Juniper Networks, Inc.