Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

MOD_VPN

SUMMARY This section describes how the MOD_VPN works.

MOD_VPN Overview

The MOD_VPN describes the security requirements for a VPN Gateway. This is defined to be a device at the edge of a private network that terminates an IPsec tunnel (support IPsec on tunnel mode), which provides device authentication, confidentiality, and integrity of information traversing a public or untrusted network. This mode is intended to provide a minimal, baseline set of requirements that are targeted at mitigating well defined and described threats to VPN Gateway technology. This introduction describes the features of a compliant Target of Evaluation (TOE), and also discusses how to use the MOD_VPN in conjunction with the NDcPPv2.

Note:

For IPsec connection be unintentionally broken, clear the IPsec session with following commands. It re-initiates and establishes the IPsec session.

Supported IPsec-IKE Algorithms

Your device supports the following IPsec-IKE algorithms:

Supported encryption algorithms for IPsec

Supported encryption algorithms for IKE

Supported IKE DH groups

Supported IPsec authentication algorithm

Supported IKE authentication algorithms

Supported authentication methods

Configure VPN on a Device Running Junos OS

This section describes a sample configurations of an IPsec VPN on a Junos OS device using the following IKE authentication methods:

Figure 1 illustrates the VPN topology used in all the examples described in this section. Here, H0 and H1 are the host, and R0 and R1 are the two endpoints of the IPsec VPN tunnel.

Figure 1: VPN Topology VPN Topology

Table 1 provides a complete list of the supported IKE protocols, tunnel modes, Phase 1 negotiation mode, authentication method or algorithm, encryption algorithm, DH groups supported for the IKE authentication and encryption (Phase1, IKE Proposal), and for IPsec authentication and encryption (Phase2, IPsec Proposal). The listed protocols, modes, and algorithms are supported and required for 21.2R2 Common Criteria.

Table 1: VPN Combination Matrix

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

pre-shared-keys

sha-256

group14

aes-128-cbc

IKEv2

    

rsa-signatures-2048

sha-384

group15

aes-128-gcm
     

ecdsa-signatures-256

sha-512

group16

aes-192-cbc
     

ecdsa-signatures-384

  

group19

aes-256-cbc
     

ecdsa-signatures-521

  

group20

aes-256-gcm
         

group21

  
         

group24

  

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

hmac-sha-256-128

group14

ESP

aes-128-cbc

IKEv2

    

hmac-sha-384

group15

  

aes-128-gcm
     

hmac-sha-512

group16

  

aes-192-cbc
       

group19

  

aes-192-gcm
       

group20

  

aes-256-cbc
       

group21

  

aes-256-gcm
       

group24

    
Note:

The following sections provide sample configurations of IKEv1 IPsec VPN examples for selected algorithms. Authentication algorithms can be replaced in the configurations to accomplish the user’s desired configurations. Use set security ike gateway gw-name version v2-only command for IKEv2 IPsec VPN.

Configuring an IPsec VPN with a Preshared Key for IKE Authentication

In this section, you configure devices running Junos OS for IPsec VPN using a preshared key as the IKE authentication method. The algorithms used in IKE or IPsec authentication, or encryption is shown in Table 2

Table 2: IKE or IPsec Authentication Example

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

pre-shared-keys

sha-256

group14

aes-256-cbc

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

hmac-sha-256-128

group14

ESP

aes-256-cbc
Note:

A device running Junos OS uses certificate-based authentication or preshared keys for IPsec. TOE accepts ASCII preshared or bit-based keys up to 255 characters (and their binary equivalents) that contain uppercase and lowercase letters, numbers, and special characters such as !, @, #, $, %, ^, &, *, (, and ). The device accepts the preshared text keys and converts the text string into an authentication value as per RFC 2409 for IKEv1 or RFC 4306 for IKEv2, using the PRF that is configured as the hash algorithm for the IKE exchanges. The Junos OS does not impose minimum complexity requirements for preshared keys. Hence, users are advised to carefully choose long preshared keys of sufficient complexity.

Configuring IPsec VPN with Preshared Key as IKE Authentication on the Initiator

  1. Configure the IKE proposal:
    Note:

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  2. Configure the IKE policy:

    Note:

    Here, ike-policy1 is the IKE policy name and ike-proposal1 is the IKE proposal name given by the authorized administrator.
    Note:

    You must enter and reenter the preshared key when prompted. For example, the preshared key can be Modvpn@jnpr1234.
    Note:

    The preshared key can alternatively be entered in hexadecimal format. For example:

    Enter the hexadecimal preshared key value.

  3. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  4. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  5. Configure the IKE:

    Note:

    Here, gw1 is an IKE gateway name, 20.1.1.2 is the peer VPN endpoint IP, 20.1.1.1 is the local VPN endpoint IP, and xe-0/0/2 is a local outbound interface as the VPN endpoint. The following additional configuration is also needed in the case of IKEv2.

  6. Configure the VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  7. Configure service-set:

  8. Configure interfaces and routing-option:

Configuring IPsec VPN with Preshared Key as IKE Authentication on the Responder

  1. Configure the IKE proposal:

    Note:

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  2. Configure the IKE policy:

    Note:

    Here, ike-policy1 is the IKE policy name and ike-proposal1 is the IKE proposal name given by the authorized administrator.
    Note:

    You must enter and reenter the preshared key when prompted. For example, the preshared key can be Modvpn@jnpr1234.
    Note:

    The pre-share key could alternatively be entered in hexadecimal format. For example,

    Here, the hexadecimal preshared key can be cc2014bae9876543.

  3. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  4. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  5. Configure the IKE.

    Note:

    Here, gw1 is an IKE gateway name, 20.1.1.1 is the peer VPN endpoint IP, 20.1.1.2 is the local VPN endpoint IP, and xe-0/0/3 is a local outbound interface as the VPN endpoint. The following additional configuration is also needed in the case of IKEv2.

  6. Configure the VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  7. Configure service-set:

  8. Configure Interfaces and routing-option:

Configuring an IPsec VPN with an RSA Signature for IKE Authentication

The following section provides an example to configure Junos OS devices for IPsec VPN using RSA Signature as IKE Authentication method, whereas the algorithms used in IKE/IPsec authentication/encryption is as shown in the following table. In this section, you configure devices running Junos OS forIPsec VPN using an RSA signature as the IKE authentication method. The algorithms used in IKE or IPsec authentication or encryption is shown in Table 3

Table 3: IKE/IPsec Authentication and Encryption Example

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

rsa-signatures-2048

sha-256

group19

aes-128-cbc

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

hmac-sha-256-128

group19

ESP

aes-128-cbc

Configuring IPsec VPN with RSA Signature as IKE Authentication on the Initiator

  1. Configure the PKI. See Example: Configuring PKI.

  2. Generate the RSA key pair. See Example: Generating a Public-Private Key Pair.

  3. Generate and load the CA certificate. See Example: Loading CA and Local Certificates Manually.

  4. Load the CRL. See Example: Manually Loading a CRL onto the Device .

  5. Generate and load a local certificate. See Example: Loading CA and Local Certificates Manually.

  6. Configure the IKE proposal:

    Note:

    Here, ike-proposal1 is the name given by the authorized administrator.

  7. Configure the IKE policy:

    Note:

    Here, ike-policy1 IKE policy name given by the authorized administrator.

  8. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the name given by the authorized administrator.

  9. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the name given by the authorized administrator.

  10. Configure the IKE:

    Note:

    Here, 20.1.1.2 is the peer VPN endpoint IP, 20.1.1.1 is the local VPN endpoint IP, and xe-0/0/3 is the local outbound interface as VPN endpoint. The following configuration is also needed for IKEv2.

  11. Configure VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  12. Configure service-set:

  13. Configure interfaces and routing-option:

Configuring IPsec VPN with RSA Signature as IKE Authentication on the Responder

  1. Configure the PKI. See Example: Configuring PKI.

  2. Generate the RSA key pair. See Example: Generating a Public-Private Key Pair.

  3. Generate and load the CA certificate. See Example: Loading CA and Local Certificates Manually.

  4. Load the CRL. See Example: Manually Loading a CRL onto the Device .

  5. Generate and load a local certificate. See Example: Loading CA and Local Certificates Manually.

  6. Configure the IKE proposal:

    Note:

    Here, ike-proposal1 is the name given by the authorized administrator.

  7. Configure the IKE policy:

    Note:

    Here, ike-policy1 IKE policy name given by the authorized administrator.

  8. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the name given by the authorized administrator.

  9. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the name given by the authorized administrator.

  10. Configure the IKE:

    Note:

    Here, 20.1.1.1 is the peer VPN endpoint IP, 20.1.1.2 is the local VPN endpoint IP, and xe-0/0/4 is the local outbound interface as VPN endpoint. The following configuration is also needed for IKEv2.

  11. Configure VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  12. Configure service-set:

  13. Configure Interfaces and routing-option:

Configuring an IPsec VPN with an ECDSA Signature for IKE Authentication

In this section, you configure devices running Junos OS for IPsec VPN using an ECDSA signature as the IKE authentication method. The algorithms used in IKE or IPsec authentication or encryption are shown in Table 4.

Table 4: IKE or IPsec Authentication and Encryption Example

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 1 Proposal (P1, IKE)

Authentication Method

Authentication Algorithm

DH Group

Encryption Algorithm

IKEv1

Main

Route

ecdsa-signatures-256

sha-384

group14

aes-256-cbc

IKE Protocol

Tunnel Mode

Phase1 Negotiation Mode

Phase 2 Proposal (P2, IPsec)

Authentication Algorithm

DH Group (PFS)

Encryption Method

Encryption Algorithm

IKEv1

Main

Route

No Algorithm

group14

ESP

aes-256-gcm

Configuring IPsec VPN with ECDSA signature IKE authentication on the Initiator

  1. Configure the PKI. See, Example: Configuring PKI.

  2. Generate the ECDSA key pair. See Example: Generating a Public-Private Key Pair.

  3. Generate and load CA certificate. See Example: Loading CA and Local Certificates Manually.

  4. Load CRL. See Example: Manually Loading a CRL onto the Device .

  5. Generate and load a local certificate. See Example: Loading CA and Local Certificates Manually.

  6. Configure the IKE proposal:

    Note:

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  7. Configure the IKE policy:

  8. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  9. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  10. Configure IKE:

    Note:

    Here, gw1 is an IKE gateway name, 20.1.1.2 is the peer VPN endpoint IP, 20.1.1.1 is the local VPN endpoint IP, and xe-0/0/3 is a local outbound interface as the VPN endpoint. The following configuration is also needed for IKEv2.

  11. Configure the VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  12. Configure service-set:

  13. Configure Interfaces and routing-option:

Configuring IPsec VPN with ECDSA signature IKE authentication on the Responder

  1. Configure the PKI. See, Example: Configuring PKI.

  2. Generate the ECDSA key pair. See Example: Generating a Public-Private Key Pair.

  3. Load the CRL. See Example: Manually Loading a CRL onto the Device .

  4. Generate and load CA certificate. See Example: Loading CA and Local Certificates Manually.

  5. Configure the IKE proposal:

    Note:

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  6. Configure the IKE policy:

  7. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  8. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  9. Configure the IKE:

    Note:

    Here, gw1 is an IKE gateway name, 20.1.1.1 is the peer VPN endpoint IP, 20.1.1.2 is the local VPN endpoint IP, and xe-0/0/4 is a local outbound interface as the VPN endpoint. The following configuration is also needed for IKEv2.

  10. Configure the VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  11. Configure service-set:

  12. Configure Interfaces and routing-option:

Configuring Firewall Rules

MX devices allow configuring firewall filter to allow or reject specific traffic.

Figure 2: IPsec VPN with Firewall Filters IPsec VPN with Firewall Filters

The following procedures explain how to configure IPSec VPN and firewall rules.

For Firewall Filters configuration guide see, Firewall Filters Overview, Chapter 2.

Configuring IPsec VPN with Firewall Filters on the Initiator

  1. Configure the IKE proposal:

    Note:

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  2. Configure the IKE policy:

    Note:

    Here,ike-policy1 is the IKE policy name and ike-proposal1 is the IKE proposal name

    given by the authorized administrator.
    Note:

    You must enter and reenter the preshared key when prompted. For example, the preshared key can be Modvpn@jnpr1234.
    Note:

    The preshared key can alternatively be entered in hexadecimal format. For example:

    Enter the hexadecimal preshared key value.

  3. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  4. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  5. Configure the IKE:

    Note:

    Here, gw1 is an IKE gateway name, 20.1.1.2 is the peer VPN endpoint IP, 20.1.1.1 is the local VPN endpoint IP, and xe-0/0/2 is a local outbound interface as the VPN endpoint. The following additional configuration is also needed in the case of IKEv2.

  6. Configure the VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  7. Configure service-set:

  8. Configure interfaces and routing-option:

  9. Configuring Firewall Filters:

Configuring IPsec VPN with Firewall Filters on the Responder

  1. Configure the IKE proposal:

    Note:

    Here, ike-proposal1 is the IKE proposal name given by the authorized administrator.

  2. Configure the IKE policy:

    Note:

    Here, ike-policy1 is the IKE policy name and ike-proposal1 is the IKE proposal name given by the authorized administrator.
    Note:

    You must enter and reenter the preshared key when prompted. For example, the preshared key can be Modvpn@jnpr1234.
    Note:

    The preshared key can alternatively be entered in hexadecimal format. For example:

    ere, the hexadecimal preshared key can be cc2014bae9876543.

  3. Configure the IPsec proposal:

    Note:

    Here, ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  4. Configure the IPsec policy:

    Note:

    Here, ipsec-policy1 is the IPsec policy name and ipsec-proposal1 is the IPsec proposal name given by the authorized administrator.

  5. Configure the IKE:

    Note:

    Here, gw1 is an IKE gateway name, 20.1.1.2 is the peer VPN endpoint IP, 20.1.1.1 is the local VPN endpoint IP, and xe-0/0/3 is a local outbound interface as the VPN endpoint. The following additional configuration is also needed in the case of IKEv2.

  6. Configure the VPN:

    Note:

    Here, vpn1 is the VPN tunnel name given by the authorized administrator.

  7. Configure service-set:

  8. Configure interfaces and routing-option:

  9. Configuring Firewall Filters:

Sample IPsec VPN Log

Sample Firewall Filters log