close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

group (Security Group VPN)

date_range 20-Nov-23

arrow_backward

arrow_forward

Syntax

group name {
    anti-replay-time-window milliseconds;
    description description;
    group-id number;
    ike-gateway gateway-name;
    ipsec-sa name {
        match-policy policy-name {
            destination ip-address/netmask;
            destination-port number;
            protocol number;
            source ip-address/netmask;
            source-port number;
        }
        proposal proposal-name;
    }
    member-threshold number;
    server-cluster {
        ike-gateway gateway-name;
        retransmission-period seconds;
        server-role (root-server | sub-server);
    }
    server-member-communication {
        certificate certificate-id;
        communication-type (unicast);
        encryption-algorithm (aes-128-cbc | aes-192-cbc | aes-256-cbc);
        lifetime-seconds seconds;
        number-of-retransmission number;
        retransmission-period seconds;
        sig-hash-algorithm (sha-256 | sha-384);
    }
}

Hierarchy Level

content_copy zoom_out_map
[edit security group-vpn server]

Description

Configure group VPN on the group server. Group VPNv2 is supported on SRX300, SRX320, SRX340, SRX345, SRX550HM, SRX1500, SRX4100, SRX4200, and SRX4600 devices and vSRX Virtual Firewall instances.

Options

name—Name of the group.

anti-replay-time-window milliseconds—Configure antireplay time in milliseconds. Specify a value from 1 to 60,000.

We recommend that NTP be configured on Group VPNv2 devices to ensure proper antireplay operation.

Group members that are running on vSRX Virtual Firewall instances on a host machine where the hypervisor is running under a heavy load may experience issues that can be corrected by reconfiguring the anti-replay-time-window value. If data that matches the IPsec policy on the group member is not being transferred, check the show security group-vpn member ipsec statistics output for D3P errors. Make sure that NTP is operating correctly. If there are errors, adjust the anti-replay-time-window value.
description description—Description of the group.
group-id number—Identifier for this group VPN. Specify a value from 1 to 4,294,967,295.
ike-gateway gateway-name—Define the group member for Phase 1 negotiation. There can be multiple instances of this option configured. When a group member sends its registration request to the server, the server checks to see that the member is configured for the group.
ipsec-sa name—Configure the group SAs to be downloaded to members. There can be multiple group SAs downloaded to group members.
member-threshold number—Specify the maximum number of group VPN members that can be accepted in the group. The same member-threshold value must be configured on the root-server and all sub-servers in a group server cluster.

The maximum number you can configure for a group is dependent upon the group server platform. Also, the sum of the member-threshold numbers for all groups configured on the group server must not exceed the capacity of the group server platform.
server-cluster—Configure the Group Domain of Interpretation (GDOI) group controller/key server (GCKS) cluster for the specified group. All servers in a group VPN server cluster must be SRX Series Firewalls.
server-member-communication—Enable and configure server to member communication. When these options are configured, group members receive new keys before current keys expire.

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 10.2

member-threshold option introduced in Junos OS Release 15.1X49-D30 for vSRX Virtual Firewall.

arrow_backward PREVIOUS group (RPF Selection)

NEXT arrow_forward group (Static Subscribers)

Junos CLI Reference

ON THIS PAGE

group (Security Group VPN)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

group (Security Group VPN)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Related Documentation

Stay in touch