I figured I would take a moment and recap theses past few posts and talk about the different methods now that we understand what they are. I also want to talk about some of the things to consider when choosing your approach.

Policy-Based with Security Policies

In our first post, we covered using security policies to establish and pass the traffic over the tunnel. There are a few challenges with this type of configuration is that you need to be keenly aware of.

You need to keep in mind that the order of security policies is critical. If you have a policy that permits or denies this traffic before the policy that says to tunnel the traffic, you will never send the traffic over the tunnel. Also, new security policies are always placed at the end of the current policies, so when you add a new VPN, you will need to remember to insert the new policy in the proper location.

This is the third and final post in the Policy-Based VPN series. In our first post, we configured a policy-based VPN using security policies tied to the UNTRUST interface. In our second post we used IPSec proxy-ids to define the tunneled traffic. This post will be covering the preferred method of Juniper policy-based VPNs, traffic-selectors.

The first part of this post is the setup of the labs, just like we did in the last post. If you want, you can skip down to where we delete the old configuration to see how the new configuration is done.

To recap, there are four different VPN configurations in this series:

• Uni-directional policy-based VPN (1st post)
• Bi-directional policy-based VPN (1st post)
• IPSEC proxy-identity route-based (2nd post).
• IPSEC Traffic selectors route-based (This post).

This is the second post in the Policy-Based VPN series. In our first post we configured a policy-based VPN using security policies tied to the UNTRUST interface. For this post, we will be using a route-based configuration that allows interoperability to the remote side configured as a policy-based VPN. This will also allow us to define a dedicated security zone for the VPN, hence helping to increase security. What we will be using in this post are proxy IDs to define local and remote networks.

The first part of this post is the setup of the labs, just like we did last time. If you want, you can skip down to where we delete the old configuration to see how the new configuration is done.

To recap, there are four different VPN configurations in this series:

• Uni-directional policy-based VPN (1st post)
• Bi-directional policy-based VPN (1st post)
• IPSEC proxy-identity route-based (Covered in this post)
• IPSEC Traffic selectors route-based (Coming soon)

Again, I will be using Juniper vLabs IPSEC VPN Policy-based lab for these posts. Feel free to head on over there and spin the lab up yourself when you are ready and kick the tires on these different configurations. Below is our diagram for the lab topology.

Policy-based VPNs are a pain most of the time, especially when compared to route-based VPNs. Many of the policy-based VPNs I run across today are legacy configurations dealing with ASA or interop between vendors where the one side only supported policy-based VPNs.

With Junos, there are four ways to configure VPNs to support policy-based VPN requirements. Two are a true policy-based VPN and the other two are actually route-based VPNs that support policy-based VPNs.

The four different VPN configuration options are:

• Uni-directional policy-based VPN (Covered in this post)
• Bi-directional policy-based VPN (Covered in this post at the end)
• IPSEC proxy-identity route-based (Coming soon)
• IPSEC Traffic selectors route-based (Coming soon)

There will be four posts in this series. The first post will cover the first two items listed above, the second will cover proxy-identity, the third will cover traffic-selectors, and the last post will be a wrap-up recap with pros and caveats to each option.

I will be using Juniper vLabs IPSEC VPN Policy-based lab for all these posts. We will only be working with one SRX to emulate what setting up a VPN would really be like. Feel free to head on over there and spin the lab up yourself when you are ready and kick the tires on these different configurations. Below is our diagram for the lab topology.