Prerequisite A—Verify that the router is ready for configuration.
- Select Configure > Interfaces.
- Verify the list has as many interface pairs as required, plus the management interface.
Step 1- Create a Phase 1 Proposal
- Select Configure > IPsec VPN > Auto Tunnel > Phase 1.
- Click Add.
The device displays the Add Proposal/IKE Proposal dialog.
- Define the proposal.
The Web Security Service supports many encryption combinations. See See Reference: IKE Encryption and Authentication Algorithms.
- Name the proposal.
- Authentication Algorithm—Select a supported value; for example, sha256.
- Authentication Method—Select pre-shared-keys.
- (Optional) Enter a Description the proposal. A descriptive name allows others in your organization to know the purpose.
- Diffie-Hellman (DH) Group—Select a supported group; for example, group5.
- Encryption Algorithm— Select a supported value; for example, aes-218-cbc.
- Lifetime seconds—Set to 48000.
- Click OK.
Step 2—Define the IKE Policy
- On the Configure > IPsec > VPN > Auto Tunnel > Phase 1 page, click the IKE Policy tab.
- Click Add. The device displays the Add Policy/IKE Policy dialog/tab.
- Configure the IKE policy to use the cloud phase 1 proposal defined in Step 1.
- Name the policy.
- Mode—Select main.
- Select User Defined; select the P1 Proposal from Step 1 and click the arrow to move it to the Selected list.
- Define the pre-shared key, which is the string that validates the encrypted tunnel between the router and the Web Security Service.
- Click the IKE Policy Options tab.
- Select Pre Shared Key.
- Select Ascii text and enter the key.
Tip: The PSK must be at least eight characters and cannot use special characters.
- Click OK.
Step 3—Create a Site to Site Tunnel gateway. You must also enable Dead Peer Detection and disable NAT Traversal
- On the Configure > IPsec > VPN > Auto Tunnel > Phase 1 page, click the IKE Gateway tab.
- Click Add.
The device displays the Add Gateway/IKE Gateway dialog/tab.
- Configure the gateway to use the IKE policy from Step 2.
- Name the gateway.
- Select the IKE Policy that you defined in Step 2.
- Select which External Interface connects to the Web Security Service.
- Select Site to Site Tunnel.
- Enter the primary Web Security ServiceIP Address.
Refer to this article to determine the closest Data Center to your network: https://support.symantec.com/en_US/article.TECH242979.html
- For the Local ID, select IP Address and enter the device's external IP address.
- Enable Dead Peer Detection and disable NAT Traversal.
- Click the IKE Gateway Options tab.
- Select Dead Peer Detection.
Select Always send. Set the Interval value to 10 and the Threshold value to 5.
- Select NAT-Traversal: Disable.
- Click OK.
Step 4—Define the cloud connection proposal (Phase 2) connection
- Select Configure > IPsec VPN > Dynamic VPN > IPSec Autokey.
- Click Add.
The device displays the Configure > Dynamic VPN page.
- Set the dynamic Phase 2 parameters.
- Name the Phase 2 proposal.
- (Optional) Enter a Description the proposal. A descriptive name allows others in your organization to know the purpose.
- Authentication Algorithm—Select hmac-sha1-96.
- Symantec recommends 3des-cbc for the Encryption Algorithm.
- Lifetime kilobytes—Symantec recommends 1000000.
- Lifetime seconds— Symantec recommends 14400.
- Protocol—Select esp, which ensures privacy (encryption) and source authentication and content integrity (authentication).
- Click OK.
Step 5—Define the IPsec policy
- Click the IPSec Policy tab.
- Click Add.
The device displays the Configure > Dynamic VPN page.
- Define the policy.
- Name the policy.
- (Optional) Enter a Description the proposal.
A descriptive name allows others in your organization to know the purpose for this policy.
- Perfect Forward Secrecy—Symantec recommends group5.
- For the Proposal, select User Defined and select the proposal you defined in Step 4.
- Click OK.
Step 6—Create the IPsec gateway
- Click the IPSec AutoKey tab.
- Click Add.
The device displays the Configure > Dynamic VPN page.
- Configure the VPN connection to use the cloud gateway and VPN policy.
- Name the VPN.
- Remote gateway—Select the gateway you created in Step 3.
- IPSec policy—Select the gateway you created in Step 5.
- Establish tunnels—Select on-traffic.
This option consumes fewer resources, as tunnels are established only when needed.
- Click OK.
Step 7—Define policy that routes HTTP traffic to the Web Security Service
- Select Configure > Security > Policy > FW Policies.
- Click Add.
The device displays the Add Policy/Policy page.
- Create policy that routes HTTP traffic to the Web Security Service.
- Name the policy.
- From Zone—Select trust.
- To Zone—Select untrust.
- Source Address—Select all applicable subnets ~or~ if you created a Policy Element that contains your internal subnets, select it.
- Destination Address—Select any.
- Application—Select junos-http.
This is the default element that includes TCP traffic on port 80.
- Policy Action—Select permit.
When you select this, the SRX interface displays the Permit Action tab.
Proceed to the next step to complete the policy.
- Select the Web Security Service VPN profile that you created in Step 6.3.
- Click OK.
Step 8—Repeat Step 7 for the HTTPS protocol
In Step 7.3.f, select junos-https.
Failover Configuration
If you are sending traffic to Singapore, which currently requires two IP address configurations, or you want to provide a layer of failover for other connection issues, use the CLI to add the following:
set security ike gateway BC_Cloud_Gatewaysecondary_cloud_IP
The output is:
gateway cloud_access_ike_gateway {
ike-policy BC_Cloud_Gateway;
address [ primary_cloud_IPsecondary_cloud_IP ];