group (Security Group VPN)
Syntax
group name {
anti-replay-time-window milliseconds;
description description;
group-id number;
ike-gateway gateway-name;
ipsec-sa name {
match-policy policy-name {
destination ip-address/netmask;
destination-port number;
protocol number;
source ip-address/netmask;
source-port number;
}
proposal proposal-name;
}
member-threshold number;
server-cluster {
ike-gateway gateway-name;
retransmission-period seconds;
server-role (root-server | sub-server);
}
server-member-communication {
certificate certificate-id;
communication-type (unicast);
encryption-algorithm (aes-128-cbc | aes-192-cbc | aes-256-cbc);
lifetime-seconds seconds;
number-of-retransmission number;
retransmission-period seconds;
sig-hash-algorithm (sha-256 | sha-384);
}
}
Hierarchy Level
[edit security group-vpn server]
Description
Configure group VPN on the group server. Group VPNv2 is supported on SRX300, SRX320, SRX340, SRX345, SRX550HM, SRX1500, SRX4100, SRX4200, and SRX4600 devices and vSRX Virtual Firewall instances.
Options
name—Name
of the group.
anti-replay-time-window milliseconds—Configure antireplay time in milliseconds. Specify a value from 1 to 60,000.We recommend that NTP be configured on Group VPNv2 devices to ensure proper antireplay operation.
Group members that are running on vSRX Virtual Firewall instances on a host machine where the hypervisor is running under a heavy load may experience issues that can be corrected by reconfiguring the
anti-replay-time-windowvalue. If data that matches the IPsec policy on the group member is not being transferred, check theshow security group-vpn member ipsec statisticsoutput for D3P errors. Make sure that NTP is operating correctly. If there are errors, adjust theanti-replay-time-windowvalue.description description—Description of the group.group-id number—Identifier for this group VPN. Specify a value from 1 to 4,294,967,295.ike-gateway gateway-name—Define the group member for Phase 1 negotiation. There can be multiple instances of this option configured. When a group member sends its registration request to the server, the server checks to see that the member is configured for the group.ipsec-sa name—Configure the group SAs to be downloaded to members. There can be multiple group SAs downloaded to group members.member-threshold number—Specify the maximum number of group VPN members that can be accepted in the group. The samemember-thresholdvalue must be configured on the root-server and all sub-servers in a group server cluster.The maximum number you can configure for a group is dependent upon the group server platform. Also, the sum of the
member-thresholdnumbers for all groups configured on the group server must not exceed the capacity of the group server platform.server-cluster—Configure the Group Domain of Interpretation (GDOI) group controller/key server (GCKS) cluster for the specified group. All servers in a group VPN server cluster must be SRX Series Firewalls.server-member-communication—Enable and configure server to member communication. When these options are configured, group members receive new keys before current keys expire.
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 10.2
member-threshold option introduced in Junos OS Release 15.1X49-D30 for vSRX
Virtual Firewall.