Related Documentation
Understanding Junos VPN Site Secure
Junos VPN Site Secure is a suite of IPsec features supported on multiservices line cards (MS-DPC, MS-MPC, and MS-MIC), and was referred to as IPsec services in Junos releases earlier than 13.2. In Junos OS Release 13.2 and later, the term IPsec features is used exclusively to refer to the IPsec implementation on Adaptive Services and Encryption Services PICs. This topic provides you an overview of Junos VPN Site Secure, and has the following sections:
 | Note: For a list of the IPsec and IKE standards supported by the Junos OS, see the Junos OS Hierarchy and RFC Reference. |
IPsec
The IPsec architecture provides a security suite for the IP version 4 (IPv4) and IP version 6 (IPv6) network layers. The suite provides such functionality as authentication of origin, data integrity, confidentiality, replay protection, and nonrepudiation of source. In addition to IPsec, the Junos OS also supports the Internet Key Exchange (IKE), which defines mechanisms for key generation and exchange, and manages security associations (SAs).
IPsec also defines a security association and key management framework that can be used with any network-layer protocol. The SA specifies what protection policy to apply to traffic between two IP-layer entities. IPsec provides secure tunnels between two peers.
Security Associations
To use IPsec security services, you create SAs between hosts. An SA is a simplex connection that enables two hosts to communicate with each other securely by means of IPsec. There are two types of SAs:
- Manual SAs require no negotiation; all values, including the keys, are static and specified in the configuration. Manual SAs statically define the security parameter index (SPI) values, algorithms, and keys to be used, and require matching configurations on both ends of the tunnel. Each peer must have the same configured options for communication to take place.
- Dynamic SAs require additional configuration. With dynamic SAs, you configure IKE first and then the SA. IKE creates dynamic security associations; it negotiates SAs for IPsec. The IKE configuration defines the algorithms and keys used to establish the secure IKE connection with the peer security gateway. This connection is then used to dynamically agree upon keys and other data used by the dynamic IPsec SA. The IKE SA is negotiated first and then used to protect the negotiations that determine the dynamic IPsec SAs.
IKE
IKE is a key management protocol that creates dynamic SAs; it negotiates SAs for IPsec. An IKE configuration defines the algorithms and keys used to establish a secure connection with a peer security gateway.
IKE performs the following tasks:
- Negotiates and manages IKE and IPsec parameters.
- Authenticates secure key exchange.
- Provides mutual peer authentication by means of shared secrets (not passwords) and public keys.
- Provides identity protection (in main mode).
Two versions of the IKE protocol (IKEv1 and IKEv2) are supported now. IKE negotiates security attributes and establishes shared secrets to form the bidirectional IKE SA. In IKE, inbound and outbound IPsec SAs are established and the IKE SA secures the exchanges. Starting with Junos OS Release 11.4, both IKEv1 and IKEv2 are supported by default on all M Series, MX Series, and T Series routers. IKE also generates keying material, provides Perfect Forward Secrecy, and exchanges identities.
Comparison of IPsec on ES PICs and Junos VPN Site Secure on Multiservices LIne Cards
Table 1 compares the top-level configuration of IPsec features on the ES PIC interfaces, and IPsec on the Adaptive Services PICs and Junos VPN Site Secure on Multiservices Line Cards .
Table 1: Statement Equivalents for ES and AS Interfaces
ES PIC Configuration | AS and MultiServices Line Cards Configuration |
|---|---|
[edit security ipsec]proposal {...} | [edit services ipsec-vpn ipsec]proposal {...} |
[edit security ipsec]policy {...} | [edit services ipsec-vpn ipsec]policy {...} |
[edit security ipsec]security-association sa-dynamic {...} | [edit services ipsec-vpn rule rule-name]term term-name match-conditions {...}then dynamic {...}] |
[edit security ipsec]security-association sa-manual {...} | [edit services ipsec-vpn rule rule-name]term term-name match-conditions {...}then manual {...}] |
[edit security ike]proposal {...} | [edit services ipsec-vpn ike]proposal {...} |
[edit security ike]policy {...} | [edit services ipsec-vpn ike]policy {...} |
Not available | [edit services ipsec-vpn]rule-set {...} |
Not available | [edit services ipsec-vpn]service-set {...} |
[edit interfaces es-fpc/pic/port]tunnel source address | [edit services ipsec-vpn service-set set-name ipsec-vpn local-gateway address] |
[edit interfaces es-fpc/pic/port]tunnel destination address | [edit services ipsec-vpn rule rule-name]remote-gateway address |
| Note: Although many of the same statements and properties are valid on both platforms (MultiServices and ES), the configurations are not interchangeable. You must commit a complete configuration for the PIC type that is installed in your router. |
