Configure Dynamic VPN in Juniper SRX
Here I am going to explain and Configure Dynamic VPN in Juniper SRX Series. It is similar to the Remote access VPN or dial-up VPN in other vendors. The dynamic VPN is used to access the Protected Resources in somewhere securely by the remote users as it establishes policy-based IPSEC VPN tunnel between the remote clients and SRX device. The configuration here is configured in SRX210 with Junos11.4 and the same configuration will support on later released version of the Junos and Branch SRX Series. The Clients side must have installation of the Junos pulse software. Junos Pulse establishes VPN between client and SRX device.Today I configure the dynamic VPN in Juniper SRX gateway.
Configure Dynamic VPN in Juniper SRX
There are 5 sections to configure dynamic VPN in SRX and to ssupport the dynamic VPN tunnel between clients and SRX. Beside the below mentioned configuration, I assume that the SRX is configured already with basic configuration. The Ike and https should be configured as inbound to the Untrust zone interface which is excluded in the following configuration.
1. Phase-I IKE VPN
2. Phase-II Ipsec VPN
3. Security Policy
4. Associating VPN users to dynamic- vpn
5. Access profile for authentication and IP address assignments for clients
Here I have used Device login name user and the host name of Firewall is lab which appears as user@lab followed by Pound (#) sign indicates that the configuration mode in Junos . Firstly, I am going to configure the VPN phase-I then Phase-II.
Phase– I (Ike VPN) configurations
user@lab#set security ike proposal phase1-prop authentication-method pre-shared-keys user@lab#set security ike proposal phase1-prop dh-group group5 user@lab#set security ike proposal phase1-prop authentication-algorithm sha1 user@lab#set security ike proposal phase1-prop encryption-algorithm 3des-cbc user@lab#set security ike proposal phase1-prop lifetime-seconds 28800 user@lab#set security ike policy ike-pol mode aggressive user@lab#set security ike policy ike-pol proposals phase1-prop user@lab#set security ike policy ike-pol pre-shared-key ascii-text <preshared-key> user@lab#set security ike gateway dyn-vpn-gw ike-policy ike-pol user@lab#set security ike gateway dyn-vpn-gw dynamic hostname client-vpn user@lab#set security ike gateway dyn-vpn-gw dynamic ike-user-type shared-ike-id user@lab#set security ike gateway dyn-vpn-gw external-interface ge-0/0/0 user@lab#set security ike gateway dyn-vpn-gw xauth access-profile user-auth-profilePhase-II (Ipsec VPN) configurations
user@lab#set security ipsec proposal phase2-prop protocol esp user@lab#set security ipsec proposal phase2-prop authentication-algorithm hmac-sha1-96 user@lab#set security ipsec proposal phase2-prop encryption-algorithm 3des-cbc user@lab#set security ipsec proposal phase2-prop lifetime-seconds 86400 user@lab#set security ipsec policy ipsec-pol perfect-forward-secrecy keys group5 user@lab#set security ipsec policy ipsec-pol proposals phase2-prop user@lab#set security ipsec vpn dynamic-vpn ike gateway dyn-vpn-gw user@lab#set security ipsec vpn dynamic-vpn ike ipsec-policy ipsec-pol user@lab#set security ipsec vpn dynamic-vpn establish-tunnels immediatelyTo access protected resources, there should be traffic passing policy from untrust zone to trust zone where the protected resourece is located, is configured as follows.
Security Policy configurations
user@lab#set security policies from-zone untrust to-zone trust policy dynvpn match source-address any user@lab#set security policies from-zone untrust to-zone trust policy dynvpn match destination-address any user@lab#set security policies from-zone untrust to-zone trust policy dynvpn match application any user@lab#set security policies from-zone untrust to-zone trust policy dynvpn then permit tunnel ipsec-vpn dynamic-vpnTo configure the user name, password and authentication for the user to access the protected resources, following is the configuration. Here I configure the network 192.168.4.0/24 is located as protected resources which is accessed by remote users ClientA and ClientB and the network 192.168.0.0/29 is assigend to the client when the VPN establish between the client and the SRX device.
Security Dynamic-VPN configurations
user@lab#set security dynamic-vpn force-upgrade user@lab#set security dynamic-vpn access-profile user-auth-profile user@lab#set security dynamic-vpn clients all remote-protected-resources 192.168.4.0/24 user@lab#set security dynamic-vpn clients all remote-exceptions 0.0.0.0/0 user@lab#set security dynamic-vpn clients all ipsec-vpn dynamic-vpn user@lab#set security dynamic-vpn clients all user ClientA user@lab#set security dynamic-vpn clients all user ClientBAccess profile for authentication and IP address assignments
user@lab#set access profile user-auth-profile client ClientA firewall-user password <pasword> user@lab#set access profile user-auth-profile client ClinetB firewall-user password <password> user@lab#set access profile user-auth-profile address-assignment pool vpnaccess-pool user@lab#set access address-assignment pool vpnaccess-pool family inet network 192.168.0.0/29 user@lab#set access address-assignment pool vpnaccess-pool family inet xauth-attributes primary-dns 8.8.8.8/32 user@lab#set access address-assignment pool vpnaccess-pool family inet xauth-attributes secondary-dns 4.2.2.2/32 user@lab#set access firewall-authentication web-authentication default-profile user-auth-profile Following command verify the vpn tunnel, status, users and the version of Junos pulse installed- user@lab>show security ike security-associations
- user@lab>show security ipsec security-associations
- user@lab>show security ike active-peer
- user@lab>show security dynamic-vpn users
- user@lab>show security dynamic-vpn client version
The configuration appears as follows when execute the show command
user@lab# show security ike
proposal phase1-prop {
authentication-method pre-shared-keys;
dh-group group5;
authentication-algorithm sha1;
encryption-algorithm 3des-cbc;
lifetime-seconds 28800;
}
policy ike-pol {
mode aggressive;
proposals phase1-prop;
pre-shared-key ascii-text “$9$pijHuIhylMXNdlKNbwsoaFn/CtOEhrvWxcSaU”; ## SECRET-DATA
}
gateway dyn-vpn-gw {
ike-policy ike-pol;
dynamic {
hostname client-vpn;
ike-user-type shared-ike-id;
}
external-interface ge-0/0/0;
xauth access-profile user-auth-profile;
}
user@lab# show security ipsec
proposal phase2-prop {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 86400;
}
policy ipsec-pol {
perfect-forward-secrecy {
keys group5;
}
proposals phase2-prop;
}
vpn dynamic-vpn {
ike {
gateway dyn-vpn-gw;
ipsec-policy ipsec-pol;
}
establish-tunnels immediately;
}
user@lab# show security policies from-zone untrust to-zone trust
policy dynvpn {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
tunnel {
ipsec-vpn dynamic-vpn;
}
}
}
}
user@lab# show security dynamic-vpn
force-upgrade;
access-profile user-auth-profile;
clients {
all {
remote-protected-resources {
192.168.4.0/24;
}
remote-exceptions {
0.0.0.0/0;
}
ipsec-vpn dynamic-vpn;
user {
ClientA;
ClienB;
}
}
}
user@lab# show access
profile user-auth-profile {
client ClientA{
firewall-user {
password “$9$Bhn1clKvLNVYWLHmT3tpWLx7-w”; ## SECRET-DATA
}
}
client ClientB {
firewall-user {
password “$9$yFbrMX7Nb2oGdbT39pREdbsYgJ”; ## SECRET-DATA
}
}
address-assignment {
pool vpnaccess-pool;
}
}
address-assignment {
pool vpnaccess-pool {
family inet {
network 192.168.0.0/29;
xauth-attributes {
primary-dns 8.8.8.8/32;
secondary-dns 4.2.2.2/32;
}
}
}
}
firewall-authentication {
web-authentication {
default-profile user-auth-profile;
}
}
user@lab#