Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

IPsec VPN Overview

IPsec VPN provides a means to securely communicate with remote computers across a public WAN such as the Internet. A VPN connection can link two LANs using a site-to-site VPN or a remote dial-up user and a LAN. The traffic that flows between these two points passes through shared resources such as routers, switches, and other network equipment that comprise the public WAN. To secure VPN communication that passes through the WAN, you need to create an IPsec tunnel.

Juniper Security Director Cloud simplifies the management and deployment of IPsec VPNs. In general, VPN configurations are tedious and repetitive when deploying over a large number of SRX Series Firewalls. With Juniper Security Director Cloud, you can use VPN profiles to group common settings and apply the profiles to multiple VPN tunnel configurations across multiple SRX Series Firewalls. You can deploy site-to-site and hub-and-spoke VPNs. Juniper Security Director Cloud determines the necessary deployment scenarios and publishes the required configuration for all SRX Series Firewalls.

Juniper Security Director Cloud supports policy-based and route-based IPsec VPNs on SRX Series Firewalls. Policy-based VPNs are supported only in the site-to-site deployments, where you configure two endpoints. If you have two or more SRX Series Firewalls, then route-based VPNs offer more flexibility and scalability. To allow data to be securely transferred between a branch office and the corporate office, configure a policy-based or route-based IPsec VPN. For an enterprise-class deployment, configure a hub-and-spoke IPsec VPN.

Use route-based tunnel mode if:

  • Participating gateways are Juniper Networks products.

  • Either source or destination NAT must occur when traffic traverses the VPN.

  • Dynamic routing protocols must be used for VPN routing.

  • Primary and backup VPNs are required in the setup.

Use policy-based tunnel mode if:

  • The remote VPN gateway is a non-Juniper Networks device.

  • Access to the VPN must be restricted for specific application traffic.

When you create a policy-based or route-based IPsec VPN, a topology is displayed for a representation. You need to click the icons to configure the remote gateway.

Note:

  • Juniper Security Director Cloud views each logical system as any other security device and takes ownership of the security configuration of the logical system. In Juniper Security Director Cloud, each logical system is managed as a unique security device.

  • Juniper Security Director Cloud ensures that the tunnel interfaces are exclusively assigned to the individual logical systems of a device. No tunnel interface is assigned to more than one logical system of the same device.

  • Juniper Security Director Cloud does not support VPN over Point-to-Point Protocol over Ethernet (PPPoE).

IPsec VPN Topologies

The following IPsec VPNs are supported:

  • Site-to-Site VPNs—Connects two sites in an organization together and allows secure communications between the sites.

    Figure 1: Site-to-Site VPN Site-to-Site VPN

  • Hub-and-Spoke (establishment all peers)—Connects branch offices to the corporate office in an enterprise network. You can also use this topology to connect spokes together by sending traffic through the hub.

    Figure 2: Hub-and-Spoke (establishment all peers) Hub-and-Spoke (establishment all peers)

  • Hub-and-Spoke (establishment by spokes)—Auto-VPN supports an IPsec VPN aggregator called a hub that serves as a single termination point for multiple tunnels to remote sites called spokes. Auto-VPN allows network administrators to configure a hub for current and future spokes. No configuration changes are required on the hub when spoke devices are added or deleted, which allows administrators flexibility in managing large-scale network deployments.

    Figure 3: Hub-and-Spoke (establishment by spokes) Hub-and-Spoke (establishment by spokes)

  • Hub-and-Spoke (Auto Discovery VPN)—Auto Discovery VPN (ADVPN) is a technology that allows the central hub to dynamically inform spokes about a better path for traffic between two spokes. When both spokes acknowledge the information from the hub, the spokes establish a shortcut tunnel and change the routing topology for the host to reach the other side without sending traffic through the hub.

    Figure 4: Hub-and-Spoke (Auto Discovery VPN) Hub-and-Spoke (Auto Discovery VPN)

  • Remote Access VPN (Juniper Secure Connect)—Juniper Secure Connect provides secure remote access for the users to connect to the corporate networks and resources remotely using the Internet. Juniper Secure Connect downloads the configuration from SRX Services devices and chooses the most effective transport protocols during connection establishment.

    Figure 5: Remote Access VPN (Juniper Secure Connect) Remote Access VPN (Juniper Secure Connect)

Field Descriptions - IPsec VPNs Page

Table 1: IPsec VPN Main Page Fields

Field

Description

Name

The name of the IPsec VPN.

Description

The description of the IPsec VPN.

VPN Topology

The types of deployment topologies for IPsec VPN, such as site-to-site, hub-and-spoke, and remote access VPNs.

Profile Type

The type of VPN profile, such as Inline Profile or Shared Profile.

Profile Name

The name of the VPN profile.

The security parameters are defined in this profile to establish the VPN connection between two sites.

Tunnel Mode

The tunnel mode, such as Route Based or Policy Based.

Configuration State

The configuration state of the IPsec VPN.

Status

Displays the publish state of the VPN configuration.

You can verify your VPN configurations before updating the configuration to the device.

  • Deploy pending—The VPN is created but not deployed.
  • Deploy scheduled—The deployment of the VPN is scheduled.
  • Deploy in-progress— The deployment of the VPN is in progress.
  • Deploy successful—The configuration is deployed to all the devices involved in the VPN.
  • Redeploy required—Modifications are made to the VPN configuration after it is deployed.
  • Deploy failed—The deployment of the VPN failed.

Created by

The email address of the user who created the IPsec VPN.