close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Port Security
- play_arrow Port Security Overview
  - Overview of Port Security
play_arrow IPSec
- play_arrow Understanding IPsec and Security Associations
- play_arrow IPsec Configurations and Examples
- play_arrow Configuring IPsec Security Associations
- play_arrow Using Digital Certificates for IPsec
- play_arrow Additional IPsec Options
- play_arrow Configuring IPsec Dynamic Endpoints
- play_arrow Additional ES and AS PIC Configuration Examples
play_arrow Digital Certificates
- play_arrow Configuring Digital Certificates
- play_arrow Configuring SSH and SSL Router Access
play_arrow Trusted Platform Module
- Trusted Platform Module Overview
play_arrow MACsec
- play_arrow Understanding MACsec
  - Understanding Media Access Control Security (MACsec)
  - Media Access Control Security (MACsec) over WAN
- play_arrow MACsec Examples
play_arrow MAC Limiting and Move Limiting
- play_arrow MAC Limiting and Move Limiting Configurations and Examples
play_arrow DHCP Protection
play_arrow IP Source Guard
- play_arrow Understanding IP Source Guard
- play_arrow IP Source Guard Examples
play_arrow IPv6 Access Security
- play_arrow Neighbor Discovery Protocol
  - IPv6 Neighbor Discovery Inspection
- play_arrow SLAAC Snooping
  - IPv6 Stateless Address Auto-configuration (SLAAC) Snooping
- play_arrow Router Advertisement Guard
play_arrow Control Plane Distributed Denial-of-Service (DDoS) Protection and Flow Detection
- play_arrow Control Plane DDoS Protection
- play_arrow Flow Detection and Culprit Flows
play_arrow Unicast Forwarding
- play_arrow Unicast Reverse Path Forwarding
- play_arrow Unknown Unicast Forwarding
  - Understanding and Preventing Unknown Unicast Forwarding
play_arrow Storm Control
- play_arrow Understanding and Using Storm Control
play_arrow Malware Protection
- play_arrow Juniper Malware Removal Tool
  - Juniper Malware Removal Tool
  - How to use the Juniper Malware Removal Tool
play_arrow Configuration Statements and Operational Commands
- Security Services Configuration Statements
- Junos CLI Reference Overview

list Table of Contents

English

Configuring an IKE Policy

date_range 24-Nov-23

arrow_backward

arrow_forward

Configuring an IKE Policy for Preshared Keys

An IKE policy defines a combination of security parameters (IKE proposals) to be used during IKE negotiation. It defines a peer address, the preshared key for the given peer, and the proposals needed for that connection. During the IKE negotiation, IKE looks for an IKE policy that is the same on both peers. The peer that initiates the negotiation sends all its policies to the remote peer, and the remote peer tries to find a match.

A match is made when both policies from the two peers have a proposal that contains the same configured attributes. If the lifetimes are not identical, the shorter lifetime between the two policies (from the host and peer) is used. The configured preshared key must also match its peer.

To ensure that at least one proposal will match a remote peer’s proposal, you can create multiple, prioritized proposals at each peer. Do this by configuring the proposal(s) and associating them with an IKE policy, and, optionally, prioritizing the list in the policy statement, where they are evaluated in list order.

Include the policy statement at the [edit security ike] hierarchy level and specify an IPsec tunnel destination as the peer address:

[edit security ike]
policy ike-peer-address;

Tasks for configuring an IKE policy are:

Configuring the Description for an IKE Policy
Configuring the Mode for an IKE Policy
Configuring the Preshared Key for an IKE Policy
Associating Proposals with an IKE Policy

Configuring the Description for an IKE Policy

To specify a description for an IKE policy, include the description statement at the [edit security ike policy ike-peer-address] hierarchy level:

[edit security ike policy ike-peer-address]
description description;

Configuring the Mode for an IKE Policy

IKE policy has two modes: aggressive and main. By default, main mode is enabled. Main mode uses six messages, in three exchanges, to establish the IKE SA. (These three steps are IKE SA negotiation, a Diffie-Hellman key exchange, and authentication of the peer.) Main mode also allows a peer to hide its identity.

Aggressive mode also establishes an authenticated IKE SA and keys. However, aggressive mode uses half the number of messages, has less negotiation power, and does not provide identity protection. The peer can use the aggressive or main mode to start IKE negotiation; the remote peer accepts the mode sent by the peer.

To configure IKE policy mode, include the mode statement and specify aggressive or main at the [edit security ike policy ike-peer-address] hierarchy level:

[edit security ike policy ike-peer-address ]
mode (aggressive | main);

For Junos OS in FIPS mode, the aggressive option for IKEv1 is not supported with the mode statement at the [edit services ipsec-vpn ike policy policy-name] hierarchy level.

Configuring the Preshared Key for an IKE Policy

IKE policy preshared keys authenticate peers. You must manually configure a preshared key, which must match that of its peer. The preshared key can be an ASCII text (alphanumeric) key or a hexadecimal key.

A local certificate is an alternative to the preshared key. A commit operation fails if either a preshared key or a local certificate is not configured.

To configure an IKE policy preshared key, include the pre-shared-key statement at the [edit security ike policy ike-peer-address] hierarchy level:

[edit security ike policy ike-peer-address]
pre-shared-key (ascii-text key | hexadecimal key);

Associating Proposals with an IKE Policy

The IKE policy proposal is a list of one or more proposals associated with an IKE policy.

To configure an IKE policy proposal, include the proposals statement at the [edit security ike policy ike-peer-address] hierarchy level and specify one or more proposal names:

[edit security ike policy ike-peer-address]
proposals [ proposal-names ];

Example: Configuring an IKE Policy

Define two IKE policies: policy 10.1.1.2 and policy 10.1.1.1. Each policy is associated with proposal-1 and proposal-2.

content_copy zoom_out_map
[edit security]
ike {
    proposal proposal-1 {
        authentication-method pre-shared-keys;
        dh-group group1;
        authentication-algorithm sha1;
        encryption-algorithm 3des-cbc;
        lifetime-seconds 1000;
    }
    proposal proposal-2 {
        authentication-method pre-shared-keys;
        dh-group group2;
        authentication-algorithm md5;
        encryption-algorithm des-cbc;
        lifetime-seconds 10000;
    }
    proposal proposal-3 {
        authentication-method rsa-signatures;
        dh-group group2;
        authentication-algorithm md5;
        encryption-algorithm des-cbc;
        lifetime-seconds 10000;
    }
    policy 10.1.1.2 {
        mode main;
        proposals [ proposal-1 proposal-2 ];
        pre-shared-key ascii-text example-pre-shared-key;
    }
    policy 10.1.1.1 {
        local-certificate certificate-filename;
        local-key-pair private-public-key-file;
        mode aggressive;
        proposals [ proposal-2 proposal-3 ]
        pre-shared-key hexadecimal 0102030abbcd;
    }
}

Note:

Updates to the current IKE proposal and policy configuration are not applied to the current IKE SA; updates are applied to new IKE SAs.

If you want the new updates to take immediate effect, you must clear the existing IKE security associations so that they will be reestablished with the changed configuration. For information about how to clear the current IKE security association, see the CLI Explorer.

Note:

When configuring multiple IPSec tunnels between IPSec peers, the IPSec tunnels can terminate on multiple local addresses on a physical interface of an IPSec peer and vice-versa.

arrow_backward PREVIOUS Configuring IPsec Security Associations

NEXT arrow_forward Configuring an IPsec Proposal for an ES PIC

Security Services Administration Guide

ON THIS PAGE

Configuring an IKE Policy

Configuring an IKE Policy for Preshared Keys

Configuring the Description for an IKE Policy

Configuring the Mode for an IKE Policy

Configuring the Preshared Key for an IKE Policy

Associating Proposals with an IKE Policy

Example: Configuring an IKE Policy

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Security Services Administration Guide

ON THIS PAGE

Configuring an IKE Policy

Configuring an IKE Policy for Preshared Keys

Configuring the Description for an IKE Policy

Configuring the Mode for an IKE Policy

Configuring the Preshared Key for an IKE Policy

Associating Proposals with an IKE Policy

See Also

Example: Configuring an IKE Policy

See Also

Stay in touch