O'Reilly logo

JUNOS Cookbook by Aviva Garrett

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

3.2. Configuring IPSec Dynamic SAs

Problem

You want IPSec to automatically generate keys and negotiate the SA parameters.

Solution

Use dynamic IPSec to automatically generate keys and negotiate SAs. First, create an IKE SA proposal and policy:

	[edit security ike proposal site1-site2-ike-proposal]
	aviva@router1# set authentication-method pre-shared-keys
	aviva@router1# set dh-group group1
	aviva@router1# set authentication-algorithm sha1
	aviva@router1# set encryption-algorithm 3des-cbc
	aviva@router1# up
	[edit security ike]
	aviva@router1# edit policy 10.0.97.62
	[edit security ike policy 10.0.97.62]
	aviva@router1# set proposals site1-site2-ike-proposal
	aviva@router1# set pre-shared-key ascii-text $1991poPPix

Next, create an IPSec SA negotiation proposal and policy:

	[edit security ipsec proposal site1-site2-ipsec-proposal]
	aviva@router1# set protocol bundle
	aviva@router1# set authentication-algorithm hmac-sha1-96
	aviva@router1# set encryption-algorithm 3des-cbc
	aviva@router1# up
	[edit security ipsec]
	aviva@router1# edit policy site1-site2-ipsec-policy
	[edit security ipsec policy site1-site2-ipsec-policy]
	aviva@router1# set perfect-forward-secrecy keys group1
	aviva@router1# set proposals site1-site2-ipsec-proposal

Then, associate the policy with the dynamic SA:

	[edit security ipsec]
	aviva@router1# set security-association site1-site2-dynamic mode tunnel
	aviva@router1# set security-association site1-site2-dynamic dynamic replay-window-size 64
	aviva@router1# set security-association site1-site2-dynamic ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required