Win XP SP3 Japanese Ed. NCP IPSec client Hub L3 SW SRX100 Policy base VPN fe-0/0/0 vlan.0 Win 2003 SVR /

Size: px

Start display at page:

Download "Win XP SP3 Japanese Ed. NCP IPSec client Hub L3 SW SRX100 Policy base VPN fe-0/0/0 vlan.0 Win 2003 SVR /"

みちしげひめい
9 years ago
Views:

1 SRX dial-up VPN (NCP )

2 Win XP SP3 Japanese Ed. NCP IPSec client Hub L3 SW SRX100 Policy base VPN fe-0/0/0 vlan.0 Win 2003 SVR / / /24 Test devices SRX100 JUNOS 10.2 Client Windows XP SP3 Japanese Edition NCP client Ver.9.20 Build 33 Windows 7 Ultimate Japanese Edition NCP client Ver.9.20 Build 33 2 Copyright 2010 Juniper Networks, Inc.

4 SRX - IKE (PRESHARED-KEY) ike { proposal pre-g2-aes128-sha { authentication-method pre-shared-keys; dh-group group2; authentication-algorithm sha1; encryption-algorithm aes-128-cbc; policy NCP_ike_policy { mode aggressive; proposals pre-g2-aes128-sha; pre-shared-key ascii-text "$9$jbkmT69pRhrz3hrev7Nik."; ## SECRET-DATA gateway NCP_p1 { ike-policy NCP_ike_policy; dynamic { user-at-hostname "[email protected]"; dead-peer-detection; external-interface fe-0/0/0.0; xauth access-profile radius-auth; ipsec { proposal g2-esp-aes128-sha { protocol esp; authentication-algorithm hmac-sha1-96; encryption-algorithm aes-128-cbc; policy NCP_ipsec_policy { perfect-forward-secrecy { keys group2; proposals g2-esp-aes128-sha; vpn NCP_p2 { ike { gateway NCP_p1; ipsec-policy NCP_ipsec_policy; 4 Copyright 2010 Juniper Networks, Inc.

5 SRX XAUTH - (PRESHARED-KEY) policies { from-zone untrust to-zone trust { policy NCP_IPSec { match { source-address any; destination-address any; application any; then { permit { tunnel { ipsec-vpn NCP_p2; log { session-init; access { profile radius-auth { authentication-order radius; radius-server { { secret "$9$V.sgJikP36AGD6Ap0hcbs2"; ## SECRET-DATA source-address ; 5 Copyright 2010 Juniper Networks, Inc.

6 SRX (PRESHARED-KEY) [edit] show display set no-more set version 10.2B3.3 set system host-name SRX100-vpn set system time-zone Asia/Tokyo set system root-authentication encrypted-password "$1$xDjciVll$zJ38YGxJgNRtlsS77Wdko1" set system name-server "$1$AVWl7szn$EtuXUTHqnLgb1JKK1j/Ob1" set system services ssh set system services telnet set system services web-management http interface vlan.0 set system services web-management https system-generated-certificate set system services web-management https interface vlan.0 set interfaces interface-range interfaces-trust member fe-0/0/1 set interfaces interface-range interfaces-trust member fe-0/0/2 set interfaces interface-range interfaces-trust member fe-0/0/3 set interfaces interface-range interfaces-trust member fe-0/0/4 set interfaces interface-range interfaces-trust member fe-0/0/5 set interfaces interface-range interfaces-trust member fe-0/0/6 set interfaces interface-range interfaces-trust member fe-0/0/7 set interfaces interface-range interfaces-trust unit 0 family ethernet-switching vlan members vlan-trust set interfaces fe-0/0/0 unit 0 family inet address /24 set interfaces vlan unit 0 family inet address /24 set routing-options static route /0 next-hop set protocols stp set security ike proposal pre-g2-aes128-sha authentication-method pre-shared-keys set security ike proposal pre-g2-aes128-sha dh-group group2 set security ike proposal pre-g2-aes128-sha authentication-algorithm sha1 set security ike proposal pre-g2-aes128-sha encryption-algorithm aes-128-cbc set security ike policy NCP_ike_policy mode aggressive set security ike policy NCP_ike_policy proposals pre-g2-aes128-sha set security ike policy NCP_ike_policy pre-shared-key ascii-text "$9$jbkmT69pRhrz3hrev7Nik." 6 Copyright 2010 Juniper Networks, Inc.

7 SRX (PRESHARED-KEY) set security ike gateway NCP_p1 ike-policy NCP_ike_policy set security ike gateway NCP_p1 dynamic user-athostname set security ike gateway NCP_p1 dead-peer-detection set security ike gateway NCP_p1 external-interface fe- 0/0/0.0 set security ike gateway NCP_p1 xauth access-profile radius-auth set security ipsec proposal g2-esp-aes128-sha protocol esp set security ipsec proposal g2-esp-aes128-sha authentication-algorithm hmac-sha1-96 set security ipsec proposal g2-esp-aes128-sha encryptionalgorithm aes-128-cbc set security ipsec policy NCP_ipsec_policy perfectforward-secrecy keys group2 set security ipsec policy NCP_ipsec_policy proposals g2- esp-aes128-sha set security ipsec vpn NCP_p2 ike gateway NCP_p1 set security ipsec vpn NCP_p2 ike ipsec-policy set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces vlan.0 set security zones security-zone untrust address-book address /32 set security zones security-zone untrust screen untrustscreen set security zones security-zone untrust host-inboundtraffic system-services all set security zones security-zone untrust host-inboundtraffic system-services ike set security zones security-zone untrust interfaces fe- 0/0/0.0 7 Copyright 2010 Juniper Networks, Inc. set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit set security policies from-zone untrust to-zone trust policy NCP_IPSec match source-address any set security policies from-zone untrust to-zone trust policy NCP_IPSec match destination-address any set security policies from-zone untrust to-zone trust policy NCP_IPSec match application any set security policies from-zone untrust to-zone trust policy NCP_IPSec then permit tunnel ipsec-vpn NCP_p2 set security policies from-zone untrust to-zone trust policy NCP_IPSec then log session-init set access profile radius-auth authentication-order radius set access profile radius-auth radius-server secret "$9$V.sgJikP36AGD6Ap0hcbs2" set access profile radius-auth radius-server source-address set vlans vlan-trust vlan-id 2 set vlans vlan-trust l3-interface vlan.0

10 IPSEC (NCP) Gateway (Tunnel Endpoint) SRX IP IKE Policy IKE P1 IPSec Policy IKE P2 Exch Mode Main/Aggressive mode PFS Group DH Policy Lifetime P1/P2 Policy Editor P1/P2 10 Copyright 2010 Juniper Networks, Inc.

15 XAUTH ( ) access { profile Local-auth { authentication-order password; client ipsec01 { firewall-user { password "$9$7MdwgGDkTz6oJz69A1INdb"; ## SECRET-DATA User 15 Copyright 2010 Juniper Networks, Inc.

17 BACKUP SLIDE using certificate

18 1. CA CA 5. # set security pki ca-profile private-ca ca-identity "COLORS CLASS 1 CA! CA > request security pki ca-certificate load filename rubyca.pem ca-profile private-ca! CA > request security pki generate-key-pair certificate-id srx100-vpn size 2048! > request security pki generate-certificate-request certificate-id srx100-vpn domain-name srx100- vpn.juniper.local ip-address [email protected] subjec t CN=srx100- vpn.juniper.local,ou=remotevpn,ou=srx,o="juniper Networks",L=Shinju ku,st=tokyo,c=jp! (CSR) > request security pki local-certificate load certificat e load certificate-id srx100-vpn file name srx100- vpn.pem! 18 Copyright 2010 Juniper Networks, Inc.

IPSEC-VPN IPsec(Security Architecture for Internet Protocol) IP SA(Security Association, ) SA IKE IKE 1 1 ISAKMP SA( ) IKE 2 2 IPSec SA( 1 ) IPs

IPSEC VPN IPSEC-VPN IPsec(Security Architecture for Internet Protocol) IP SA(Security Association, ) SA IKE 1 2 2 IKE 1 1 ISAKMP SA( ) IKE 2 2 IPSec SA( 1 ) IPsec SA IKE Initiator Responder IPsec-VPN ISAKMP