Manual Key VPN Tunnel Configuration

Juniper Networks supports IPSec technology for creating VPN tunnels with two kinds of key creation mechanisms:

With Manual Keys, administrators at both ends of a tunnel configure all the security parameters. This is a viable technique for small, static networks where the distribution, maintenance, and tracking of keys is not difficult. However, safely distributing Manual Key configurations across great distances poses security issues. Aside from passing the keys face-to-face, you cannot be completely sure that the keys have not been compromised while in transit. Also, whenever you want to change the key, you are faced with the same security issues as when you initially distributed it.

To Create a Manual Key VPN

Enter the necessary information in the following fields:

VPN Tunnel Name: The name identifying this VPN tunnel definition. Choose a descriptive name to help you identify the VPN tunnel. The name must be unique and is limited to 20 characters.

Gateway IP: The public IP address of the remote peer.

Security Index (HEX Number): A pair of local and remote security index numbers that uniquely distinguishes a particular encrypted tunnel from the others being used at the same time. Only a hexadecimal value greater than 3000 is accepted. The local security index serves as the other end's remote security index and vice versa. If you enter "Value_A Value_B", the other end of the tunnel must switch the order of the two components, as in "Value_B Value_A".

Outgoing Interface: Select the interface that you want to use to terminate the VPN tunnel on the local device from the Outgoing Interface drop-down list.

Note: The IP address of the outgoing interface is what the remote peer uses as the remote gateway address in its VPN configuration.

Select ESP-CBC or AH. Encapsulating Security Payload (ESP) provides both encryption and authentication of an IP packet. Authentication Header (AH) provides authentication only.

ESP-CBC

Encryption Algorithm: An algorithm used for encryption. You can select NULL, DES-CBC, AES-CBC (128 bits), 3DES-CBC, AES-CBC (192 bits), or AES-CBC (256 bits).

HEX Key: A hexadecimal value used to perform the authentication hash algorithm. For MD5, the key must be 16 bytes long. For SHA-1, the key must be 20 bytes long. (Two hexadecimal characters equal one byte.) In the fields to the right of the HEX Key radio button, enter a key with the appropriate length.

Generate Key by Password: The NetScreen device provides assistance in creating the hexadecimal key by allowing a password to define the generation of the hex key.

Note: The use of the password feature is a convenience and might lead to similar keys.

Authentication Algorithm: An algorithm used for authenticating the content of the encrypted IP packets. You can leave this field as NULL to omit authentication, or select either MD5 or SHA-1 from the drop-down menu.

HEX Key (16/20 Bytes): An encryption key for the algorithm specified. Each field of the key is 8 bytes long represented in hexadecimal (HEX) notation. (The key is 16 characters long with two characters used to describe one byte in HEX.) For DES, only the left-most value needs to be defined. For 3DES, all three values must be defined.

Generate Key by Password: You can direct the NetScreen device to generate a key for your selected hash algorithm based on a password that you enter. If you wish to use this option, select the Generate Key by Password radio button and enter a password in the corresponding field.

Note: The use of the password feature is a convenience and might lead to similar keys.

AH

The authentication header (AH) is used to verify a packet's authenticity. The header contains a cryptographic checksum calculated via a hash-based message authentication code (HMAC) coupled with MD5 or SHA-1. You can select either of these algorithms from the drop-down box.

Hash Algorithm: The hash algorithm is selectable. You can use either MD5 or SHA1. MD5 requires a 16-byte key; SHA1 requires a 20-byte key. In the fields to the right of the HEX Key radio button, enter a key with the appropriate length.

HEX Key (16/20 Bytes): A hexadecimal value used to perform the authentication hash algorithm. For MD5, the key must be 16 bytes long. For SHA-1, the key must be 20 bytes long. (Two hexadecimal characters equal one byte.) In the fields to the right of the HEX Key radio button, enter a key with the appropriate length.

Note: The use of the password feature is a convenience and might lead to similar keys.

Click OK to save your changes.
Click Advanced to complete the Manual Key VPN Tunnel configuration. For more information, see Manual Key VPN Tunnel Advanced Configuration.