Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I appreciate any response as (to make a long story short) I've had a some trying times with this project I'm working on and am ready to be done with it. I'm trying to setup point to point VPN using two Junipers SS5 G's. I do have access to both devices, both locations have Static IP addresses, however, I cannot find a guide that does not either: A. Use IPSEC (which if I'm understood requires IPV6 to be enabled) or B. Use the same two juniper devices.

Again, I'm working with two Junipers SS5 G's, both running ScreenOS 6.1.0r2.0.

What's really confusing me is that there just seems to be too many options between binding different interfaces, creating tunnels, VPNs, and VR's. I just can't wrap my head around it. Please point me in the right direction.

Any and all help is appreciated, thank you for reading.

share|improve this question

1 Answer 1

IPSec is what you must use, and it does not require IPv6 in any way.

Juniper SSGs have very flexible logic when it comes to tunnels. This is good, because you can solve for many use cases, but also bad, because the configuration process is more complicated.

Juniper IPSEC tunnels come in two flavors: route-based and policy-based. Common between the two are the attributes used to establish the tunnel: peer IP address, encryption algorithms, security associations, etc - you need these with any type of tunnel. What's different is the process that allows the firewall to decide if the specific packet flow must be encrypted and placed into the tunnel. With route-based tunnels, you have routes that forward the flow into the tunnel; with policy-based tunnels, you create policies that select the flows for encryption.

Slightly overgeneralizing, I can say that policy-based tunnels are considered obsolete. Therefore, the further discussion will be focused on route-based firewalls. And everything described here must be done on both sides, using different names and IP addresses.

The first building block is the gateway. That's the firewall on the other side. Here we will call that gateway "Paris", specify its public IP address, negotiation mode, our external interface used to connect to it, preshared key, and predefined "standard" proposals:

fw-> set ike gateway "Paris" address 111.111.111.111 main outgoing-interface "ethernet0/0" preshare "verysecretkey" sec-level standard

Next, we configure the Phase-2 proposal, where we create the actual tunnel, specifying the gateway to use for the tunnel, our local IP block, and the remote IP block.

fw-> set vpn vpn_to_paris gateway Paris no-replay tunnel idletime 0 sec-level standard
fw-> set vpn vpn_to_paris proxy-id local-ip 192.168.0.0/24 remote-ip 192.168.1.0/24 "ANY"

This completes the IPSec-related part of the tunnel. Now we just need to make sure that we use it for the relevant traffic. Create a tunnel interface. It is a virtual interface that can be configured almost like a real one, but in most situations it is sufficient to create an unnumbered interface dependent on the real outside interface and assign it to a security zone used for your future policies that will control access between the two sites. It will usually look like this:

fw-> set interface tunnel.1 zone vpn
fw-> set interface tunnel.1 ip unnumbered interface eth0/0

Bind the tunnel to the interface and create a route that would send the traffic there:

fw-> set vpn vpn_to_paris bind interface tunnel.1
fw-> set route 192.168.1.0/24 interface tunnel.1

Now, all that's left to do is configure policies, if necessary. To control outbound traffic, create policies between "Trust" and "VPN" zones, to control traffic from the other site, create policies between "VPN" and "Trust" zones.

Recommended reading: ScreenOS Cookbook from O'Reilly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.