Configuring Security Associations for IPsec on an ES PIC
To use IPsec security services, you create an SA between hosts. An SA is a simplex connection that allows two hosts to communicate with each other securely by means of IPsec. You can configure two types of SAs:
Manual—Requires no negotiation; all values, including the keys, are static and specified in the configuration. As a result, each peer must have the same configured options for communication to take place. For information about how to configure a manual SA, see Configuring Manual IPsec Security Associations for an ES PIC.
Dynamic—Specify proposals to be negotiated with the tunnel peer. The keys are generated as part of the negotiation and therefore do not need to be specified in the configuration. The dynamic SA includes one or more proposal statements, which allow you to prioritize a list of protocols and algorithms to be negotiated with the peer. For information about how to configure a dynamic SA, see Associating the Configured Security Association with a Logical Interface.
Note:The Junos OS does not perform a commit check when an SA name referenced in the Border Gateway Protocol (BGP) protocol section is not configured at the [edit security ipsec] hierarchy level.
We recommend that you configure no more than 512 dynamic security associations per ES Physical Interface Card (PIC).
To configure an SA for IPsec for an ES PIC, include the security-association statement at the [edit security ipsec] hierarchy level:
[edit security ipsec] security-associationsa-name;
You configure a dynamic SA for the AS and MultiServices PICs at the [edit services ipsec-vpn rule rule-name term term-name then dynamic], [edit services ipsec-vpn ike], and [edit services ipsec-vpn ipsec] hierarchy levels.
For more information, see the “IPsec Services Configuration Guidelines” chapter of the Junos OS Services Interfaces Library for Routing Devices.
Tasks to configure SAs for IPsec for an ES PIC are:
Configuring the Description for an SA
To specify a description for an IPsec SA, include the description statement at the edit security ipsec security-association sa-name] hierarchy level:
[edit security ipsec security-association sa-name] descriptiondescription;
Configuring IPsec Transport Mode
In transport mode, the data portion of the IP packet is encrypted, but the IP header is not. Transport mode can be used only when the communication endpoint and cryptographic endpoint are the same. Virtual private network (VPN) gateways that provide encryption and decryption services for protected hosts cannot use transport mode for protected VPN communications. You configure manual SAs, and you must configure static values on both ends of the SA.
When you use transport mode, the Junos OS supports both BGP and OSPFv3 for manual SAs.
To configure IPsec security for transport mode, include the mode statement with the transport option at the edit security ipsec security-association sa-name] hierarchy level:
[edit security ipsec security-association sa-name] mode transport;
To apply tunnel mode, you configure manual SAs in transport mode and then reference the SA by name at the [edit protocols bgp] hierarchy level to protect a session with a given peer.
You can configure BGP to establish a peer relationship over encrypted tunnels.
Configuring IPsec Tunnel Mode
You use tunnel mode when you use preshared keys with IKE to authenticate peers, or digital certificates with IKE to authenticate peers.
When you use preshared keys, you manually configure a preshared key, which must match that of its peer. With digital certificates, each router is dynamically or manually enrolled with a certificate authority (CA). When a tunnel is established, the public keys used for IPsec are dynamically obtained through IKE and validated against the CA certificate. This avoids the manual configuration of keys on routers within the topology. Adding a new router to the topology does not require any security configuration changes to existing routers.
To configure the IPsec in tunnel mode, include the mode statement with the tunnel option at the edit security ipsec security-association sa-name] hierarchy level:
[edit security ipsec security-association sa-name] mode tunnel;
The Junos OS supports both both BGP and OSPFv3 in transport mode.
To enable tunnel mode, follow the steps in these sections: