junipervpn
This is a pretty n00b question.
I am integrating a system with a TelCo. The TelCo's policy requires that all communication must be done over VPN using Juniper's SSG-5 firewall. My current host does not allow me to host additional hardware.
Is it possible to have a software based VPN which would be compatible with Juniper's VPN or do they have their own proprietary protocol?
And my favorite method (no java applet required):
Presumably:
your url: 'https://some.site.com/dana-na/auth/url_default/welcome.cgi' (or whatever)
your username=username
your password=password
you know your realm or you can find it from the web page or with:
-
REALM=$(wget -q --no-check-certificate -O - 'https://some.site.com/dana-na/auth/url_default/welcome.cgi' | sed -n 's/.*<input\( [^>]*name="realm" [^>]*\)>.*/\1/p' | sed -n 's/.* value="\([^"]*\)".*/\1/p')
After you login, download the following jar (should be done one time only):
https://some.site.com/dana-cached/nc/ncLinuxApp.jar
and unzip it to ~/.juniper_networks/network_connect
Get some new libraries for your 64bit machine yum install glibc.i686 zlib.i686 nss-mdns.i686
Go to ~/.juniper_networks/network_connect and
sudo chown root:root ncsvc
sudo chmod 6711 ncsvc
chmod 744 ncdiag
chmod +x getx509certificate.sh
Get your certificate:
./getx509certificate.sh some.site.com company.cert
And connect:
./ncsvc -h some.site.com -u username -p password -r REALM -f ./company.cert
For some sites I noticed that you also need to put the -U switch:
./ncsvc -h some.site.com -u username -p password -r REALM -f ./company.cert -U 'https://some.site.com/dana-na/auth/url_default/welcome.cgi'
the feature you are looking for is called Dynamic VPN in the Juniper World, the model you are refering to (SRX1400) is the first high end model on the datacenter level, they do no support Dynamic VPN.
never the less you can use Shrew a VPN client witch is free.
here is a sample configuration to use shrew on junos 10.4
## Last changed: 2011-01-17 21:14:39 MST
version 10.4R1.9;
system {
login {
user admin {
uid 2002;
class super-user;
}
}
services {
ssh;
telnet;
web-management {
http;
}
}
syslog {
user * {
any emergency;
}
file messages {
any notice;
authorization info;
}
file traffic-log {
any any;
match RT_FLOW;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.4.4.1/24;
}
}
}
ge-0/0/1 {
unit 0 {
family inet {
address 4.4.4.1/24;
}
}
}
fe-0/0/7 {
unit 0 {
family inet {
address 192.168.180.39/24;
}
}
}
}
security {
ike {
proposal RemoteVPNPolicy1 {
authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm md5;
encryption-algorithm 3des-cbc;
lifetime-seconds 86400;
}
policy RemoteVPNIKE {
mode aggressive;
proposals RemoteVPNPolicy1;
pre-shared-key ascii-text "$9$ywMeMXVwgUjq7-jqmfn6revW7-"; # SECRET-DATA
}
policy t400-ike-policy {
mode aggressive;
proposals RemoteVPNPolicy1;
pre-shared-key ascii-text "$9$IcPhyKX7V4aUM8aUjH5TRhSrM8"; # SECRET-DATA
}
inactive: gateway RemoteVPN {
ike-policy RemoteVPNIKE;
dynamic user-at-hostname "remote@domain.com";
external-interface ge-0/0/1.0;
}
gateway t400-ike-gw {
ike-policy t400-ike-policy;
dynamic {
user-at-hostname "remote@domain.com";
connections-limit 50;
ike-user-type shared-ike-id;
}
external-interface ge-0/0/1.0;
xauth access-profile t400-access;
}
}
ipsec {
proposal RemoteVPNIPSec {
protocol esp;
authentication-algorithm hmac-md5-96;
encryption-algorithm 3des-cbc;
}
policy RemoteVPNIPSec {
proposals RemoteVPNIPSec;
}
policy t400-ipsec-policy {
proposals RemoteVPNIPSec;
}
inactive: vpn RemoteVPN {
ike {
gateway RemoteVPN;
ipsec-policy RemoteVPNIPSec;
}
establish-tunnels on-traffic;
}
vpn t400-vpn {
ike {
gateway t400-ike-gw;
ipsec-policy t400-ipsec-policy;
}
}
}
zones {
security-zone corp {
interfaces {
fe-0/0/7.0 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
}
security-zone trust {
address-book {
address hq-net-10-4-4 10.4.4.0/24;
}
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
}
security-zone untrust {
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
}
}
policies {
from-zone untrust to-zone trust {
policy RemoteVPN {
match {
source-address any;
destination-address hq-net-10-4-4;
application any;
}
then {
permit {
tunnel {
ipsec-vpn t400-vpn;
}
}
log {
session-init;
session-close;
}
count;
}
}
}
}
}
access {
address-pool t400-pool {
address-range low 192.168.40.200 high 192.168.40.250 mask 55.255.255.0;
primary-dns 10.4.4.75;
}
profile t400-access {
authentication-order password;
client joe {
firewall-user {
password "$9$K9QWX-YgJHqfVwqfTzCAvWLxVw"; ## SECRET-DATA
}
}
address-assignment {
pool t400-assign-pool;
}
}
address-assignment {
pool t400-assign-pool {
family inet {
network 192.168.40.0/24;
range t400-range {
low 192.168.40.101;
high 192.168.40.149;
}
xauth-attributes {
primary-dns 10.4.4.85/32;
}
}
}
}
}
Best Answer
Juniper Netscreen SSG-5s use standard IPSec. As long as you have an IPSec VPN software client you should be able to connect to the SSG. Keep in mind however that software IPSec VPN clients are sometimes flaky if they are free or you have to buy one to pay for the stability.
You may run into could compatibility problems depending on the software client and how the SSG is configured. Trying to troubleshoot this from the software client side can usually be difficult depending on the level of verbosity in the debug output of your client as opposed to an SSG firewall.