O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

10.4. Route-Based VPN with Dynamic Peer and Static Routing

Problem

You want to create a VPN tunnel between a remote site and the hub site where the remote site receives a DIP address from the service provider.

Solution

Use a route-based VPN approach and an IPSec Aggressive mode configuration. Enable the VPN monitor to keep the tunnel active.

Hub site configuration

For the hub site configuration, first create address entries for local and remote subnets:

	Corp-VPN-Hub-> set address trust local_lan 10.140.10.0/24
	Corp-VPN-Hub->set address vpn denton_lan 10.70.1.0/24

Next, create the zone and interface:

	Corp-VPN-Hub-> set zone name vpn
	Corp-VPN-Hub-> set interf tun.21 zone vpn
	Corp-VPN-Hub->set interface tun.21 ip unnumbered interface eth0/3

Then, configure the VPN Phase-1 and Phase-2 parameters:

	Corp-VPN-Hub-> set ike gateway denton dynamic s1_denton@xyzcorp.com
	               Aggressive outgoing-interface eth0/3 preshare juniper123
	               sec-level standard
	Corp-VPN-Hub-> set vpn denton gateway denton sec-level standard
	Corp-VPN-Hub->set vpn denton bind interface tun.21

Enable the VPN monitor and rekey options:

	Corp-VPN-Hub-> set vpn denton monitor rekey

Next, create the bidirectional policies:

	Corp-VPN-Hub-> set policy from trust to vpn local_lan denton_lan any
	               permit policy id = 5
	Corp-VPN-Hub->set pol from vpn to trust denton_lan local_lan any
	               permit policy id = 6

Now, configure the routes to use the tunnel for the destination subnet:

	Corp-VPN-Hub-> set route 10.70.1.0/24 interface tun.21
	Corp-VPN-Hub->save

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required