Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual page 662

Network and Security Manager Administration Guide
612
Do not set Fragment Bit in the Outer Header—The Fragment Bit controls how the IP
packet is fragmented when traveling across networks.
Clear. Use this option to enable IP packets to be fragmented.
Set. Use this option to ensure that IP packets are not fragmented.
Copy. Select to use the same option as specified in the internal IP header of the
original packet.
IPSec Protocol—Specify the IPSec protocol and algorithm you want to use for data
authentication and/or encryption. Because this information is static for each VPN
member, they do not need to negotiate for communication.
AH. Use Authentication Header to authenticate the VPN traffic, but not encrypt the
traffic. If you select AH, you must also specify the key or password that AH uses in
the authentication algorithm.
NOTE: All passwords handled by NSM are case-sensitive.
ESP. Use Encapsulating Security Payload to authenticate and encrypt the VPN traffic.
If you select ESP, because ESP uses keys to encrypt and decrypt data, you must also
specify the key or password that the VPN node uses to send and receive VPN data
through the VPN tunnel.
Binding
You can bind the VPN tunnel to a tunnel interface or tunnel zone to increase the number
of available interfaces in the security device. To use a tunnel interface and/or tunnel zone
in your VPN, you must first create the tunnel interface or zone on the device; for details,
see "Configuring Tunnel Interfaces and Tunnel Zones" on page 566 and the Network and
Security Manager Configuring ScreenOS and IDP Devices Guide.
None—Select none when you do not want to bind the VPN tunnel to a tunnel interface
or zone.
Tunnel Interface—Select a preconfigured tunnel interface on the security device to
bind the VPN tunnel to the tunnel interface. The security device routes all VPN traffic
through the tunnel interface to the protected resources.
Tunnel Zone—Select a preconfigured tunnel zone on the security device to bind the
VPN tunnel directly to the tunnel zone. The tunnel zone must include one or more
numbered tunnel interfaces; when the security device routes VPN traffic to the tunnel
zone, the traffic uses one or more of the tunnel interfaces to reach the protected
resources.
Monitor
You can enable VPN Monitor and configure the monitoring parameters for the device.
Monitoring is off by default. To enable the VPN Monitor in Realtime Monitor to display
statistics for the VPN tunnel, configure the following:
Copyright © 2010, Juniper Networks, Inc.