an IKE Proposal. You must manually configure a preshared key, which must match that
of its peer. The preshared key can be an ASCII text (alphanumeric) key or a hexadecimal
key.
To configure the preshared key in an IKE policy, include the pre-shared-keys statement
and a key at the [edit services ipsec-vpn ike policy policy-name] hierarchy level:
[edit services ipsec-vpn ike policy policy-name]
pre-shared-key (ascii-text key | hexadecimal key);
ACX Series routers support ascii-text key.
Configuring IPsec Rules
To configure an IPsec rule, include the rule statement and specify a rule name at the [edit
services ipsec-vpn] hierarchy level:
[edit services ipsec-vpn]
rule rule-name {
match-direction input;
term term-name {
from {
destination-address address;
ipsec-inside-interface interface-name;
source-address address;
}
then {
backup-remote-gateway address;
dynamic {
ike-policy policy-name;
ipsec-policy policy-name;
}
initiate-dead-peer-detection;
dead-peer-detection {
interval seconds;
threshold number;
}
manual {
direction (inbound | outbound | bidirectional) {
authentication {
algorithm (hmac-sha-256-128| hmac-sha1-96);
key (ascii-text key | hexadecimal key);
}
auxiliary-spi spi-value;
encryption {
algorithm algorithm;
key (ascii-text key | hexadecimal key);
}
protocol esp;
spi spi-value;
}
}
no-anti-replay;
remote-gateway address;
}
1105Copyright © 2017, Juniper Networks, Inc.
Chapter 33: Configuring IPsec
To Next Page
General
