Juniper SRX240 Dynamic
VPN配置指南
修订记录
日期 2010-3-16 2010-4-12 修订版本 1.0 2.0 初稿 修订 描述 作者 卢 泓 卢 泓
神州数码(深圳)有限公司
目 录
1 JUNIPER SRX240 Dynamic VPN配置拓扑图 ...................................................................... 3 2 概述....................................................................................................................................... 3 3 配置步骤 ............................................................................................................................... 4
3.1 Access configuration.................................................................................................... 4 3.2 Https configuration ..................................................................................................... 4 3.3 IKE/IPSEC configuration ............................................................................................... 4 3.4 Dynamic VPN configuration ........................................................................................ 4 3.5 Policy configuration ..................................................................................................... 4 step1: Access configuration ....................................................................................................... 5 Step2 HTTPS configuration - HTTPS配置 ........................................................................... 6 step3 IKE/IPSEC configuration ................................................................................................ 6 Step4 Dynamic VPN configuration –动态VPN的配置实例 ..................................................... 9 Step5 policy configuration-策略配置 .................................................................................. 10 4 测试..................................................................................................................................... 22 5 SRX Dynamic VPN排错 ..................................................................................................... 26 6结论...................................................................................................................................... 28
1 JUNIPER SRX240 Dynamic VPN配置拓扑图
Protected-Resources :192.168.3.0/24CISCO ACS Radius Server60.60.60.1电信VPN远程拔号用户
Address Pool will be delivered to dynamic VPN users_192.168.5.0/24Ge-0/0/15.0 192.168.3.252/24SRX240Ge-0/0/1.0220.249.253.134/27Ge-0/0/0.0218.17.165.49/26网通VPN远程拔号用户
2 概述
JUNIPER SRX系列防火墙Dynamic VPN是一种无客户的IPSEC VPN。客户端的PC无须安装拔号软件就可以与VPN网关建立VPN隧道。实际上，当客户端WEB认证通过之后，SRX会自动下推一个客户端软件到客户端PC机上。 类似于，JUNIPER SA会下推一个NC(NETWORK CONNECT)客户端软件到客户端。但是DYNAMIC VPN功能现在只有若干个SRX平台支持，并且此功能需要FEATURE LICENSE来支持才能激活。
平台支持
Feature License支持
JUNIPER SRX需要LICENSE来激活Dynamic VPN功能，请确认SRX上有相应的LICENSE KEY root# run show system license License usage:
Licenses Licenses Licenses Expiry Feature name used installed needed
dynamic-vpn 0 50 0 permanent
Licenses installed:
License identifier: JUNOS247349 License version: 2
Valid for device: AG3209AA0265 Features:
dynamic-vpn-50-clients - Dynamic VPN permanent
3 配置步骤
3.1 Access configuration
定义ACCESS PROFILE，可以定义本地数据库认证和外部RADIUS SERVER认证。
3.2 Https configuration
用来激活SRX上的HTTPS服务。
3.3 IKE/IPSEC configuration
用来配置IPSEC VPN PHASE I和PHASE II阶段的具有参数。
3.4 Dynamic VPN configuration
用来定义受保护的资源，Protected Resources定义能够通过IPSEC VPN TUNNEL访问的网段。
3.5 Policy configuration
用来定义防火墙的策略，通过策略来控制通过IPSEC VPN访问的流量。