Category Archives: dynamic-vpn

JNCIE-SEC : Dynamic VPN

In today’s post I will write about how we can setup Dynamic VPN connection
towards an SRX device in several scenarios This is part of my JNCIE-SEC
studies although I am falling very behind my schedule:( Let’s get started:

IPsec VPNs

Implementation of IPsec VPNs
Multipoint tunnels
Policy and route-based VPNs
Traceoptions
Dual and backup tunnels
On-demand tunnels
DRP over a tunnel
Dynamic VPNs
Certificate-based VPNs
PKI
Interoperability with 3rd party devices

Scenario1: Client receives an IP address which is already used inside the local network by other clients and split tunneling active
Scenario2: Client also accesses the Internet through the tunnel, if the term is correct no-split tunneling

Continue reading →

JWEB and Dynamic VPN page

2 Replies

There seems to be a confusion about how JWEB and dynamic VPN authentication page are working in parallel.
I hope to give some tips I know in this post. For example, if you have the following config, what does it really mean for JWEB?

[edit]
root@srx# show system services
web-management {
    https {
        system-generated-certificate;
        interface [ ge-0/0/0.0 ge-0/0/1.0 ];
    }
}

[edit]

root@srx# show system services

web-management {

https {

system-generated-certificate;

interface [ ge-0/0/0.0 ge-0/0/1.0 ];

}

This config enforces that JWEB web service can only be served on the configured ge-0/0/0.0 and ge-0/0/1.0 interfaces. Of course if the https service is allowed on the security zone that these interfaces belong to. So far so good but what happens if you enable dynamic VPN service for which you also provide an authentication page. In that case what happens to JWEB? In this case you should look at the IKE gateway stanza. For instance if you have the following IKE gateway config;

gateway gw-dyn-1 {
    ike-policy ike-dyn-pol1;
    dynamic {
        hostname dyn.rtoodtoo.nett;
        connections-limit 2;
    }
    external-interface <strong>ge-0/0/1.0</strong>;
    xauth access-profile dyn-vpn-prof1;
}

gateway gw-dyn-1 {

ike-policy ike-dyn-pol1;

dynamic {

hostname dyn.rtoodtoo.nett;

connections-limit 2;

}

external-interface <strong>ge-0/0/1.0</strong>;

xauth access-profile dyn-vpn-prof1;

}

Junos will disable JWEB on ge-0/0/1.0 interface and you will be redirected to the dynamic-vpn authentication page. What if the dynamic-vpn page itself returns a 404 not found error. In that case I would recommend you to check if you have proper configuration under “security dynamic-vpn” hierarchy. For example if you don’t have a config like below, you won’t get dynamic-vpn page but a 404 error.

root@srx# show security dynamic-vpn
access-profile vpn-prof;
clients {
    vpn-clients {
        remote-protected-resources {
            192.168.3.0/24;
        }
        remote-exceptions {
            0.0.0.0/0;
        }
        ipsec-vpn myvpn;
        user {
            john;
        }
    }
}

root@srx# show security dynamic-vpn

access-profile vpn-prof;

clients {

vpn-clients {

remote-protected-resources {

192.168.3.0/24;

}

remote-exceptions {

0.0.0.0/0;

}

ipsec-vpn myvpn;

user {

john;

}

I hope this helps someone out there. Of course if you see any mistake or have comments, don’t hesitate tell.

Dynamic VPN in SRX

10 Replies

Here is my simple dynamic vpn configuration. I have tested it and it works:) However I could only use windows clients in my setup although I tried so hard to get a working linux client, debugging didn’t provide me any useful information. Here is the config:

1) First configure profile config which contains users and ip assignments for the VPN.

[edit]
root@hub# show access
profile dyn-vpn-prof1 {
    client john {
        firewall-user {
            password "$9$5znCO1hKMXtuMX7-2gTz36tuBIEyev"; ## SECRET-DATA
       }
    }
    address-assignment {
        pool pool1;
    }
}
address-assignment {
    pool pool1 {
        family inet {
            network 192.168.200.0/24;
           range range1 {
                low 192.168.200.20;
                high 192.168.200.40;
            }
            xauth-attributes {
                primary-dns 8.8.8.8/32;
            }
        }
   }
}
firewall-authentication {
    web-authentication {
        default-profile dyn-vpn-prof1;
    }
}

[edit]

root@hub# show access

profile dyn-vpn-prof1 {

client john {

firewall-user {

password "$9$5znCO1hKMXtuMX7-2gTz36tuBIEyev"; ## SECRET-DATA

}

address-assignment {

pool pool1;

}

address-assignment {

pool pool1 {

family inet {

network 192.168.200.0/24;

range range1 {

low 192.168.200.20;

high 192.168.200.40;

}

xauth-attributes {

primary-dns 8.8.8.8/32;

}

firewall-authentication {

web-authentication {

default-profile dyn-vpn-prof1;

}

SET command output of access config

[edit]
root@hub# show access | display set
set access profile dyn-vpn-prof1 client john firewall-user password "$9$5znCO1hKMXtuMX7-2gTz36tuBIEyev"
set access profile dyn-vpn-prof1 address-assignment pool pool1
set access address-assignment pool pool1 family inet network 192.168.200.0/24
set access address-assignment pool pool1 family inet range range1 low 192.168.200.20
set access address-assignment pool pool1 family inet range range1 high 192.168.200.40
set access address-assignment pool pool1 family inet xauth-attributes primary-dns 8.8.8.8/32
set access firewall-authentication web-authentication default-profile dyn-vpn-prof1

[edit]

root@hub# show access | display set

set access profile dyn-vpn-prof1 client john firewall-user password "$9$5znCO1hKMXtuMX7-2gTz36tuBIEyev"

set access profile dyn-vpn-prof1 address-assignment pool pool1

set access address-assignment pool pool1 family inet network 192.168.200.0/24

set access address-assignment pool pool1 family inet range range1 low 192.168.200.20

set access address-assignment pool pool1 family inet range range1 high 192.168.200.40

set access address-assignment pool pool1 family inet xauth-attributes primary-dns 8.8.8.8/32

set access firewall-authentication web-authentication default-profile dyn-vpn-prof1

Continue reading →

Tech Notes / RtoDto.net

SRX,JunOS,Linux and security

Category Archives: dynamic-vpn

JNCIE-SEC : Dynamic VPN

JWEB and Dynamic VPN page

Dynamic VPN in SRX

1) First configure profile config which contains users and ip assignments for the VPN.