For When You Can't Have The Real Thing
[ start | index | login ]
start > Netscreen > VPN Tunnel Interfaces

VPN Tunnel Interfaces

Created by dave. Last edited by dave, 12 years and 263 days ago. Viewed 10,563 times. #3
[diff] [history] [edit] [rdf]

Creating a VPN Tunnel Interface

These notes appear to be for ScreenOS 5.x. They should work more or less the same for 6.x although some options might appear on different screens.

Scenario: Firewall A -> Internet -> Firewall B

Log into Firewall A through the web interface

Configure your tunnel interface

  • Click Network -> Interfaces
  • Make sure the dropdown in the top left says Tunnel IF, and click New.
  • Select the Untrust zone. You need this because the tunnel doesn't have its own IP address, it is going to use the Untrust IP address so that the remote side can find it. (Original source notes: I put mine in the Untrust zone because I want all of my VPN traffic to run through my Untrust->Trust policy)
  • Click unnumbered and select the untrust interface
  • click OK
Configure your VPN Gateway
  • Click VPNs -> AutoKey Advanced -> Gateway
  • click New
  • Name the gateway "FirewallB-gw"
  • I always select the custom security level, you´ll see why in a following step
  • Enter the public IP address of Firewall B
  • Carefully enter your preshared key
  • select untrust for your outgoing interface
  • click advanced
  • select User defined (custom)
  • in the first dropdown select pre-g2-aes128-sha
  • click return at the bottom
  • click OK at the bottom
Create the VPN
  • on the menu on the left select VPNs -> Autokey IKE
  • click New
  • name it FirewallB-vpn
  • select Custom
  • leave predefined checked and select your FirewallB-GW in the dropdown
  • click Advanced
  • select custom
  • in the first dropdown, select g2-esp-aes128-sha
  • turn on replay protection
  • Bind to tunnel interface, and select your tunnel interface you created in step 2
  • turn on VPN monitor (this will bring up the VPN right away and keep it up even when there´s no traffic on it)
  • click Return
  • click OK
Routing: You need to add routes to the remote network. You can configure the tunnel interfaces to run OSPF, or you can add a static. I will tell you how to add a static.
  • on the menu click Network -> Routing -> Destination
  • click new
  • type in the network address behind Firewall B
  • Select Gateway
  • Select your tunnel interface in the dropdown
  • click ok
Policy: Add your policy to allow access to/from the remote network. If you are not in NAT mode on your trust interface, make sure you check position at top when creating a Trust->Untrust rule, or it will NAT the traffic to your untrust IP or DIP pool and then send it across the tunnel, which you probably don´t want. Create an Untrust->Trust policy which allows access from the Network behind FirewallB to hosts or the network behind FirewallB. You probably want to allow Ping at a minimum.

Firewall B: Repeat these steps on Firewall B. Substituting Firewall A´s data. The VPN should pop up and everything should work. You can also use the little wizard thing, but I haven´t tried it. If you use it, I don´t think it picks the most secure cipher for P1 and P2, this is why we set this up manually. If one or both of your Netscreens is behind something that does NAT, you will also have to turn on NAT traversal on both ends.

If you don´t want static routes and want to use OSPF instead, you can create an OSPF instance under the trust VR. Make sure you add the tunnel interfaces and your internal interfaces to it, and tell it to advertise your private networks. You will then have to go under each interface that you added, and turn on OSPF. On tunnel interfaces, you can enable demand circuit and add it to the area, apply the changes, and then Enable OSPF on it.

(>>Source with some cleanup)

Work In Progress

14:26 <work> You don't "bind" the VPN to the tunnel interface.  It' has something to do with NHTB (Next Hop Table).  But by default that doesn't come up, I don't see how you associate the tunnel with the remote VPN gateway.
14:26 <work> err. VPN.
14:28 <work> Ah, OK.
14:28 <work> Bind the VPN to the tunnel.
14:29 <work> THen go to the tunnel, NHTB, and add the VPN and next-hop (the IP address of the remote gateway).
14:30 <work> NOW you should be able to add the policy.
14:30 <work> … or not.
14:31 <work> why not?
14:35 <work> OH.  You don't "Tunnel" if you are using a "tunnelling interface".  You route, which means you get a single-way policy.
14:43 <work> So you have to do the other half of the policy yourself.
14:43 <work> AND you have to set up the routes in the routing table yourself.
14:43 <work> Set the Interface to be the tunnel interface, with no defined IP gateway.
no comments | post comment
This is a collection of techical information, much of it learned the hard way. Consider it a lab book or a /info directory. I doubt much of it will be of use to anyone else.

Useful: | Copyright 2000-2002 Matthias L. Jugel and Stephan J. Schmidt