[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

IPsec Overview

The JUNOS software supports IPsec. This section discusses the following topics, which provide background information about configuring IPsec:

For a list of the IPsec and IKE standards supported by the JUNOS software, see the JUNOS Hierarchy and RFC Reference.

IPsec

The IPsec architecture provides a security suite for the IP version 4 (IPv4) and IP version 6 (IPv6) network layers. The suite provides such functionality as authentication of origin, data integrity, confidentiality, replay protection, and nonrepudiation of source. In addition to IPsec, the JUNOS software also supports the Internet Key Exchange (IKE), which defines mechanisms for key generation and exchange, and manages security associations (SAs).

IPsec also defines a security association and key management framework that can be used with any network layer protocol. The SA specifies what protection policy to apply to traffic between two IP-layer entities. IPsec provides secure tunnels between two peers.

Security Associations

To use IPsec security services, you create SAs between hosts. An SA is a simplex connection that allows two hosts to communicate with each other securely by means of IPsec. There are two types of SAs:

Manual SAs require no negotiation; all values, including the keys, are static and specified in the configuration. Manual SAs statically define the security parameter index (SPI) values, algorithms, and keys to be used, and require matching configurations on both ends of the tunnel. Each peer must have the same configured options for communication to take place.
Dynamic SAs require additional configuration. With dynamic SAs, you configure IKE first and then the SA. IKE creates dynamic security associations; it negotiates SAs for IPsec. The IKE configuration defines the algorithms and keys used to establish the secure IKE connection with the peer security gateway. This connection is then used to dynamically agree upon keys and other data used by the dynamic IPsec SA. The IKE SA is negotiated first and then used to protect the negotiations that determine the dynamic IPsec SAs.

IKE

IKE is a key management protocol that creates dynamic SAs; it negotiates SAs for IPsec. An IKE configuration defines the algorithms and keys used to establish a secure connection with a peer security gateway.

IKE performs the following tasks:

Negotiates and manages IKE and IPsec parameters.
Authenticates secure key exchange.
Provides mutual peer authentication by means of shared secrets (not passwords) and public keys.
Provides identity protection (in main mode).

IKE consists of two phases. In the first phase, it negotiates security attributes and establishes shared secrets to form the bidirectional IKE SA. In the second phase, inbound and outbound IPsec SAs are established and the IKE SA secures the exchanges. IKE also generates keying material, provides Perfect Forward Secrecy, and exchanges identities.

Comparison of IPsec Services and ES Interface Configuration

Table 5 compares the top-level configuration of IPsec features on the ES PIC interfaces and on the AS or MultiServices PIC interfaces.

Table 5: Statement Equivalents for ES and AS Interfaces

ES PIC Configuration	AS and MultiServices PIC IPsec Configuration
`[edit security ipsec] proposal {...}`	`[edit services ipsec-vpn ipsec] proposal {...}`
`[edit security ipsec] policy {...}`	`[edit services ipsec-vpn ipsec] policy {...}`
`[edit security ipsec] security-association sa-dynamic {...}`	`[edit services ipsec-vpn rule rule-name] term term-name match-conditions {...} then dynamic {...}]`
`[edit security ipsec] security-association sa-manual {...}`	`[edit services ipsec-vpn rule rule-name] term term-name match-conditions {...} then manual {...}]`
`[edit security ike] proposal {...}`	`[edit services ipsec-vpn ike] proposal {...}`
`[edit security ike] policy {...}`	`[edit services ipsec-vpn ike] policy {...}`
Not available	`[edit services ipsec-vpn] rule-set {...}`
Not available	`[edit services ipsec-vpn] service-set {...}`
`[edit interfaces es-fpc/pic/port] tunnel source address`	`[edit services ipsec-vpn service-set set-name ipsec-vpn local-gateway address]`
`[edit interfaces es-fpc/pic/port] tunnel destination address`	`[edit services ipsec-vpn rule rule-name] remote-gateway address`

For more information about configuring IPsec services on an AS or MultiServices PIC, see IPsec Services Configuration Guidelines. For more information about configuring encryption services on an ES PIC, see Encryption Interfaces Configuration Guidelines.

Note: Although many of the same statements and properties are valid on both platforms, the configurations are not interchangeable. You must commit a complete configuration for the PIC type that is installed in your router.

[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]