Create a Remote Access VPN—Juniper Secure Connect

Name

Enter a name for the remote access connection. This name will be displayed as the end users realm name in the Juniper Secure Connect Client.

Description

Enter a description. This description will be used for the IKE and IPsec proposals, policies, remote access profile, client configuration, and NAT rule set.

During edit the IPsec policy description will be displayed. IPsec policy and remote access profile descriptions will be updated.

Routing Mode

This option is disabled for the remote access.

Default mode is Traffic Selector (Auto Route Insertion).

Authentication Method

Select an authentication method from the list that the device uses to authenticate the source of Internet Key Exchange (IKE) messages:

• EAP-MSCHAPv2 (Username & Password)—Uses the user account credentials verified by the RADIUS server (for external user authentication) to authenticate for network access.

• EAP-TLS (Certificate)—Uses the TLS public key certificate authentication mechanism within EAP to provide mutual client-server and server-client authentication. With EAP-TLS, both the client and the server must be assigned a digital certificate signed by a Certificate Authority (CA) that they both trust.

  Note:

  Starting in Junos OS Release 23.1R1, EAP-TLS is not available in Juniper Secure Connect > Remote User.

• Pre-shared Key (Username & Password)—A secret key shared between the two peers, is used during authentication to identify the peers to each other.

  Note:

  Starting in Junos OS Release 23.2R1, when you create or edit the Juniper Secure Connect VPNs, the ike-user-type is group-ike-id. This helps to enable you with the multi device access. This is not supported for SRX300 line of Firewalls and SRX550HM Firewall.

Auto-create Firewall Policy

If you select Yes, a firewall policy is automatically created between internal zone and tunnel interface zone with local protected networks as source address and remote protected networks as destination address.

Another firewall policy will be created visa-versa.

If you choose No, you don’t have a firewall policy option. You need to manually create the required firewall policy to make this VPN work.

Remote User

Displays the remote user icon in the topology. Click the icon to configure the Juniper Secure Connect client settings.

For more information on the fields, see Table 2.

Local Gateway

Displays the local gateway icon in the topology. Click the icon to configure the local gateway.

For more information on the fields, see Table 3.

IKE and IPsec Settings

Configure the custom IKE or IPsec proposal and the custom IPsec proposal with recommended algorithms or values.

For more information on the fields, see Table 6.

Default Profile

Enable this option to use the configured VPN name as remote access default profile.

Connection Mode

Select one of the following options from the list to establish the Juniper Secure Connect client connection:

• Manual—You need manually connect to the VPN tunnel every time you log in.

• Always—You are automatically connected to the VPN tunnel every time you log in.

The default connection mode is Manual.

SSL VPN

Enable this option to establish SSL VPN connection from the Juniper Secure Connect Client to the SRX Series Firewall.

By default, this option is enabled.

Biometric authentication

Enable this option to authenticate the client system using unique configured methods.

An authentication prompt is displayed when you connect in the client system. The VPN connection will only be initiated after successful authentication through the method configured for Windows Hello (fingerprint recognition, face recognition, PIN entry, and so on).

Windows Hello must be preconfigured on the client system if the Biometric authentication option is enabled.

Dead Peer Detection

Enable the dead peer detection (DPD) option to allow the Juniper Secure Connect client to detect if the SRX Series Firewall is reachable.

Disable this option to allow the Juniper Secure Connect client to detect till the SRX Series Firewall connection reachability is restored.

This option is enabled by default.

DPD Interval

Enter the amount of time that the peer waits for traffic from its destination peer before sending a dead-peer-detection (DPD) request packet. The Range is 2 through 60 seconds and default is 60 seconds.

DPD Threshold

Enter the maximum number of unsuccessful dead peer detection (DPD) requests to be sent before the peer is considered unavailable. The Range is 1 through 5 and default is 5.

Certificates

Enable Certificates to configure certificate options on Secure Client Connect.

Expiry Warning

Enable this option to display the certificate expiry warning on the Secure Connect Client.

This option is enabled by default.

Warning Interval

Enter the interval (days) at which the warning to be displayed.

Range is 1 through 90. Default value is 60.

Pin Req Per Connection

Enable this option to enter the certificate pin on very connection.

This option is enabled by default.

Save username

Starting in Junos OS Release 22.1R1, you can enable this option to save the remote username.

Save password

Starting in Junos OS Release 22.1R1, you can enable this option to save both the remote username and password.

Windows Logon

Enable this option to provide users to securely log on to the Windows domain before logging on to the Windows system. The client supports domain logon using a credential service provider after establishing a VPN connection to the company network.

Domain Name

Enter the system domain name on to which the Users Machine logs.

Mode

Select one of the following options from the list to log on to Windows domain.

• Manual—You must manually enter your logon data on the Windows logon screen.

• Automatic—The client software transfers the data entered here to the Microsoft logon interface (Credential Provider) without your action.

Disconnect at Logoff

Enable this option to shut down the connection when the system switches to hibernation or standby mode. When the system resumes from hibernation or standby mode the connection has to be re-established.

Flush Credential at Logoff

Enable this option to delete username and password from the cache. You must reenter the username and password.

Lead Time Duration

Enter the lead time duration to initialize time between network logon and domain logon.

After the connection is set up, the Windows logon will only be executed after the initialization time set here has elapsed.

EAP Authentication

Enable this option to execute EAP authentication prior to the destination dialog in the credential provider. Then, system will ask for the necessary PIN, regardless of whether EAP will be required for subsequent dial-in.

If this option is disabled, then EAP authentication will be executed after the destination selection.

Auto Dialog Open

Enable this option to select whether a dialog should open automatically for connection establishment to a remote domain.

If this option is disabled, then the password and PIN for the client will only be queried after the Windows logon.

Multi device access

Enable this option to connect you from multiple devices.

request system software add optional: //junos-ike.tgz

Enable this option to configure which applications, domains, or both can bypass the VPN tunnel. You can select the configured application bypass profiles in the grid view.

To add a new application bypass term:

1. Click the + icon.

2. Enter the following details:

   • Name—Enter a name for the term.

   • Description—Enter application bypass term description.

   • Protocol—Select the protocol available from the list. The following options are available:

     • TCP & UDP—Bypasses both TCP and UDP traffic.

     • TCP—Bypasses only TCP traffic.

     • UDP—Bypasses only UDP traffic.

     By default, TCP & UDP is selected.

   • Domain Type—Select the domain type available from the list. The following options are available:

     • Contains—Any domain name (for example, abc.com).

     • FQDN—Domain name contains the fully qualified domain name (for example, www.abc.com).

     • Wildcard—Domain name contains any subdomain (for example, .abc.com).

       When wildcard is selected, “.“ is prepopulated in the domain value field by default.

   • Domain Value—Enter the domain name to bypass VPN tunnel.

3. Click the tick icon to save the changes and create application bypass term. Click X to discard.

4. Click the edit icon available above the grid to edit the application bypass term and click the delete icon to delete any application bypass term.

   Note:

   When editing the remote user, if you toggle off Application Bypass, the configured Application bypass terms under the remote user will be deleted.

Select the compliance rule from the list which will be validated by the SRX Series Firewall to establish a VPN tunnel before a user logs in.

To create a new compliance rule, click Create. The Create Pre-Logon Compliance page appears. For the field information, see Create Pre-Logon Compliance.

Gateway is behind NAT

Enable this option when the local gateway is behind a NAT device.

NAT IP Address

Enter the public (NAT) IP address of the SRX Series Firewall.

External Interface

Select an outgoing interface from the list for which the client will connect to.

The list contains all available IP addresses if more than one IPv4 address is configured to the specified interface. The selected IP address will be configured as the local address under the IKE gateway.

Connection profile

This is a mandatory field. Enter the connection profile in the format FQDN or FQDN/Realm.

Connection profile can be any string and can have periods and slashes; 255 characters maximum.

IKE ID is automatically derived from connection profile.

Tunnel Interface

Select an interface from the list for the client to connect to.

Click Add to add a new interface. The Create Tunnel Interface page appears. For more information on creating a new tunnel interface, see Table 4.

Click Edit to edit the selected tunnel interface.

Pre-shared Key

Enter one of the following values of the preshared key:

• ascii-text—ASCII text key.

• hexadecimal—Hexadecimal key.

Local certificate

Select a local certificate from the list.

Local certificate lists only the RSA certificates.

User Authentication

This field is mandatory. Select the authentication profile from the list that will be used to authenticate user accessing the remote access VPN.

Click Add to create a new Profile. For more information on creating a new access profile, see Add an Access Profile.

SSL VPN Profile

Select the SSL VPN Profile from the list that will be used to terminate the remote access connections.

To create a new SSL VPN profile:

1. Click Add.

2. Enter the following details:

   • Name—Enter the name for an SSL VPN profile.

   • Logging—Enable this option to log for SSL VPN.

   • SSL Termination Profile—Select an SSL termination profile from the list.

     To add a new SSL termination profile:

     1. Click Add.

        The Create SSL Termination Profile page appears.

     2. Enter the following details:

        • Name—Enter a name for the SSL termination profile.

        • Server Certificate—Select a server certificate from the list.

          To add a certificate, click Add. For more information on adding a device certificate, see Add a Device Certificate.

          To import a certificate, click Import. For more information on importing a device certificate, see Import a Device Certificate.

        • Click OK.

     3. Click OK.

3. Click OK.

Source NAT Traffic

This option is enabled by default.

All traffic from the Juniper Secure Connect client is NATed to the selected interface by default.

If disabled, you must ensure that you have a route from your network pointing to the SRX Series Firewalls for handling the return traffic correctly.

Interface

Select an interface from the list through which the source NAT traffic pass through.

Protected Networks

Click +. The Create Protected Networks page appears.

Zone

Select a security zone from the list that will be used as a source zone in the firewall policy.

Global Address

Select the addresses from the Available column and then click the right arrow to move it to the Selected column.

Click Add to select the networks the Client can connect to.

The Create Global Address page appears. For more information on the fields, see Table 5.

Edit

Select the protected network you want to edit and click on the pencil icon.

The Edit Protected Networks page appears with editable fields.

Delete

Select the protected network you want to edit and click on the delete icon.

The confirmation message pops up.

Click Yes to delete the protected network.

Interface Unit

Enter the logical unit number.

Description

Enter a description for the logical interface.

Zone

Select a zone from the list to add it to the tunnel interface.

This zone is used in the auto-creation of the firewall policy.

Click Add to add a new zone. Enter zone name and description and click OK on the Create Security Zone page.

Routing Instance

Select a routing instance from the list.

Name

Enter a name for the global address. The name must be a unique string that must begin with an alphanumeric character and can include colons, periods, dashes, and underscores; no spaces allowed; 63-character maximum.

IP Type

Select IPv4.

IPv4 Address

Enter a valid IPv4 address.

Subnet

Enter the subnet for IPv4 address.

Encryption Algorithm

Select the appropriate encryption mechanism from the list.

Default value is AES-CBC 256-bit.

Authentication Algorithm

Select the authentication algorithm from the list. For example, SHA 256-bit.

DH group

A Diffie-Hellman (DH) exchange allows participants to generate a shared secret value. Select the appropriate DH group from the list. Default value is group19.

Lifetime Seconds

Select a lifetime duration (in seconds) of an IKE security association (SA).

Default value is 28,800 seconds. Range: 180 through 86,400 seconds.

Dead Peer Detection

Enable this option to send dead peer detection requests regardless of whether there is outgoing IPsec traffic to the peer.

DPD Mode

Select one of the options from the list:

• optimized—Send probes only when there is outgoing traffic and no incoming data traffic - RFC3706 (default mode).

• probe-idle-tunnel—Send probes same as in optimized mode and also when there is no outgoing and incoming data traffic.

• always-send—Send probes periodically regardless of incoming and outgoing data traffic.

DPD Interval

Select an interval (in seconds) to send dead peer detection messages. The default interval is 10 seconds. Range is 2 to 60 seconds.

DPD Threshold

Select a number from 1 to 5 to set the failure DPD threshold.

This specifies the maximum number of times the DPD messages must be sent when there is no response from the peer. The default number of transmissions is 5 times.

NAT-T

Enable this option for IPsec traffic to pass through a NAT device.

NAT-T is an IKE phase 1 algorithm that is used when trying to establish a VPN connection between two gateway devices, where there is a NAT device in front of one of the SRX Series Firewalls.

NAT Keep Alive

Select appropriate keepalive interval in seconds. Range: 1 to 300.

If the VPN is expected to have large periods of inactivity, you can configure keepalive values to generate artificial traffic to keep the session active on the NAT devices.

IKE Connection Limit

Enter the number of concurrent connections that the VPN profile supports.

Range is 1 through 4294967295.

When the maximum number of connections is reached, no more remote access user (VPN) endpoints attempting to access an IPsec VPN can begin Internet Key Exchange (IKE) negotiations.

IKEv2 Fragmentation

This option is enabled by default. IKEv2 fragmentation splits a large IKEv2 message into a set of smaller ones so that there is no fragmentation at the IP level. Fragmentation takes place before the original message is encrypted and authenticated, so that each fragment is separately encrypted and authenticated.

IKEv2 Fragment Size

Select the maximum size, in bytes, of an IKEv2 message before it is split into fragments.

The size applies to IPv4 message. Range: 570 to 1320 bytes.

Default value is 576 bytes.

Encryption Algorithm

Select the encryption method. Default value is AES-GCM 256-bit.

Authentication Algorithm

Select the IPsec authentication algorithm from the list. For example, HMAC-SHA-256-128.

Perfect Forward Secrecy

Select Perfect Forward Secrecy (PFS) from the list. The device uses this method to generate the encryption key. Default value is group19.

PFS generates each new encryption key independently from the previous key. The higher numbered groups provide more security, but require more processing time.

Lifetime Seconds

Select the lifetime (in seconds) of an IPsec security association (SA). When the SA expires, it is replaced by a new SA and security parameter index (SPI) or terminated. Default is 3,600 seconds. Range: 180 through 86,400 seconds.

Lifetime Kilobytes

Select the lifetime (in kilobytes) of an IPsec SA. Default is 256kb. Range: 64 through 4294967294.

Anti Replay

IPsec protects against VPN attack by using a sequence of numbers built into the IPsec packet—the system does not accept a packet with the same sequence number.

This option is enabled by default. The Anti-Replay checks the sequence numbers and enforce the check, rather than just ignoring the sequence numbers.

Disable Anti-Replay if there is an error with the IPsec mechanism that results in out-of-order packets, which prevents proper functionality.

Install Interval

Select the maximum number of seconds to allow for the installation of a rekeyed outbound security association (SA) on the device. Select a value from 1 to 10 seconds.

Idle Time

Select the idle time interval. The sessions and their corresponding translations time out after a certain period of time if no traffic is received. Range is 60 to 999999 seconds.

DF Bit

Select how the device handles the Don't Fragment (DF) bit in the outer header:

• clear—Clear (disable) the DF bit from the outer header. This is the default.

• copy—Copy the DF bit to the outer header.

• set—Set (enable) the DF bit in the outer header.

Copy Outer DSCP

This option enabled by default. This enables copying of Differentiated Services Code Point (DSCP) (outer DSCP+ECN) from the outer IP header encrypted packet to the inner IP header plain text message on the decryption path. Enabling this feature, after IPsec decryption, clear text packets can follow the inner CoS (DSCP+ECN) rules.