close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
- play_arrow Services Overview
  - Adaptive Services and Multiservices Interfaces Overview
  - Packet Flow Through the Adaptive Services or Multiservices PIC
- play_arrow Services Configuration Overview
play_arrow Network Address Translation
- play_arrow NAT Overview
- play_arrow Stateful NAT64
  - Stateful NAT64
- play_arrow Static Source NAT
  - Static Source NAT
- play_arrow Static Destination NAT
  - Static Destination NAT
- play_arrow Network Address Port Translation
  - Network Address Port Translation
- play_arrow Deterministic NAT
  - Deterministic NAT
- play_arrow NAT Protocol Translation
  - NAT Protocol Translation
  - Example: Configuring the DNS ALG Application on MX-SPC3 service card
- play_arrow IPv4 Connectivity Across IPv6-Only Network Using 464XLAT
  - IPv4 Connectivity Across IPv6-Only Network Using 464XLAT
- play_arrow Port Control Protocol
  - Port Control Protocol
- play_arrow Secured Port Block Allocation
  - Secured Port Block Allocation
  - Secured Port Block Allocation Interim Logging
- play_arrow Port Forwarding
  - Port Forwarding
- play_arrow Dynamic Address-Only Source Translation
  - Dynamic Address-Only Source Translation
- play_arrow Inline NAT
  - Inline NAT
- play_arrow Stateless Source Network Prefix Translation for IPv6
  - Stateless Source Network Prefix Translation for IPv6
- play_arrow Monitoring NAT
  - Monitoring NAT
- play_arrow Packet Translation and GRE Tunneling
  - Packet Translation and GRE Tunneling
play_arrow Transitioning to IPv6 Using MAP-E and MAP-T
- play_arrow Transitioning to IPv6 Using MAP-E and MAP-T
  - Mapping of Address and Port with Encapsulation (MAP-E)
  - Equal Cost Multiple Path (ECMP) support for Mapping of Address and Port with Encapsulation (MAP-E)
- Mapping of Address and Port with Translation (MAP-T)
play_arrow Transition to IPv6 With Softwires
- play_arrow Transition to IPv6 With 6to4 Softwires
  - Softwires Configuration Overview
  - 6to4 Softwires
- play_arrow Transition to IPv6 With DS-Lite Softwires
  - DS-Lite Softwires
- play_arrow Transition to IPv6 With 6rd Softwires
  - Configuring a 6rd Softwire
- play_arrow Transition to IPv6 With Inline Softwires
  - Inline 6rd and 6to4 Softwires
- play_arrow Monitoring and Troubleshooting Softwires
  - Monitoring and Troubleshooting Softwires
play_arrow ALGs
- play_arrow ALGs
  - ALG Overview
  - ALG Applications
play_arrow Access Security
- play_arrow Stateful Firewalls
  - Stateful Firewalls
  - Monitoring Stateful Firewalls
- play_arrow IDS on MS-DPC
  - IDS on MS-DPC
- play_arrow Network Attack Protection on MS-MPC and MS-MIC
  - Network Attack Protection on MS-MPC and MS-MIC
play_arrow IPsec Tunnels
- play_arrow IPsec Overview
  - IPsec Overview
- play_arrow Inline IPsec
  - Inline IPsec
- play_arrow IPsec Tunnels With Static Endpoints
- play_arrow IPsec Tunnels With Dynamic Endpoints
  - IPsec Tunnels With Dynamic Endpoints
- - Inline IPsec
play_arrow CoS on Services Cards
- play_arrow CoS on Services Cards
  - Class of Service on Services Interfaces
- play_arrow Class of Service on Link Services Interfaces
  - Class of Service on Link Services Interfaces
play_arrow Inter-Chassis Redundancy for NAT and Stateful Firewall Flows
- play_arrow Configuring Inter-Chassis MS-MPC and MS-MIC for NAT and Stateful Firewall (Release 16.1 and later)
  - Inter-Chassis Stateful Synchronization for Long Lived NAT and Stateful Firewall Flows (MS-MPC, MS-MIC) (Release 16.1 and later)
  - Service Redundancy Daemon
- play_arrow Configuring Inter-Chassis Stateful Synchronization for NAT and Stateful Firewall (Release 15.1 and earlier)
  - Inter-Chassis High Availability for MS-MIC and MS-MPC (Release 15.1 and earlier)
play_arrow Multilinks
- play_arrow Link Services Interface Redundancy
  - Link Services Interface Redundancy
- play_arrow Link Bundling
  - Inline Multlink Services
play_arrow Traffic Load Balancer
- play_arrow Traffic Load Balancer
  - Traffic Load Balancer
play_arrow Services Card Redundancy
- play_arrow Services Card Redundancy for MS-MPC and MS-MIC
  - Load Balancing and High Availability With Aggregated Multiservices Interfaces on MS-MPC and MS-MIC
- play_arrow Services Card Redundancy for Multiservices PIC
  - Configuring AS or Multiservices PIC Redundancy
play_arrow Voice Services
- play_arrow Voice Services
  - Voice Services
play_arrow Layer 2 PPP Tunnels
- play_arrow Layer 2 Tunneling of PPP Packets
  - Layer 2 Tunneling of PPP Packets
play_arrow URL Filtering
- play_arrow URL Filtering
  - URL Filtering
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

Minimum Security Association Configurations

date_range 20-Dec-24

arrow_backward

arrow_forward

The following sections show the minimum configurations necessary to set up security associations (SAs) for IPsec services:

Minimum Manual SA Configuration

To define a manual SA configuration, you must include at least the following statements at the [edit services ipsec-vpn rule rule-name term term-name then manual] hierarchy level:

[edit services ipsec-vpn rule rule-name term term-name then manual]
direction (inbound | outbound | bidirectional) {
    authentication {
        algorithm (hmac-md5-96 | hmac-sha1-96);
        key (ascii-text key | hexadecimal key);
    }
    encryption {
        algorithm algorithm;
        key (ascii-text key | hexadecimal key);
    }
    protocol (ah | esp | bundle);
    spi spi-value;
}

Minimum Dynamic SA Configuration

To define a dynamic SA configuration, you must include at least the following statements at the [edit services ipsec-vpn] hierarchy level:

[edit services ipsec-vpn]
ike {
    proposal proposal-name {
        authentication-algorithm (md5 | sha1 | sha-256);
        authentication-method pre-shared-keys;
        dh-group (group1 | group2 | group5 |group14 | group15 | group16 | group19 | group20 | group24);
        encryption-algorithm algorithm;
    }
    policy policy-name {
        proposals [ ike-proposal-names ];
        pre-shared-key (ascii-text key | hexadecimal key);
        version (1 | 2);
        mode (aggressive | main);
    }
}
ipsec {
    policy policy-name {
        proposals [ ipsec-proposal-names ];
    }
    proposal proposal-name {
        authentication-algorithm (hmac-md5-96 | hmac-sha1-96);
        encryption-algorithm algorithm;
        protocol (ah | esp | bundle);
    }
}

Note:

Starting with Junos OS Release 11.4, both IKEv1 and IKEv2 are supported by default on all M Series, MX Series, and T Series routers. The version statement at the [edit services ipsec-vpn ike policy name] hierarchy level allows you to configure the specific IKE version to be supported.
The mode statement at the [edit services ipsec-vpn ike policy name] hierarchy level is required only if the version option is set to 1.

You must also include the ipsec-policy statement at the [edit services ipsec-vpn rule rule-name term term-name then dynamic] hierarchy level.

arrow_backward PREVIOUS Inline IPsec

NEXT arrow_forward Configuring Security Associations

Adaptive Services Interfaces User Guide for Routing Devices

ON THIS PAGE

Minimum Security Association Configurations

Minimum Manual SA Configuration

Minimum Dynamic SA Configuration

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Adaptive Services Interfaces User Guide for Routing Devices

ON THIS PAGE

Minimum Security Association Configurations

Minimum Manual SA Configuration

Minimum Dynamic SA Configuration

Related Documentation

Stay in touch