Configuring the Juniper Firewall Device Side VPN With XAuth
| Knowledge Base ID: | KB4183 |
| Version: | 5.0 |
| Published: | 13 Nov 2008 |
| Updated: | 13 Nov 2008 |
| Categories: |
 Firewall/IPSec_VPN IPSec ScreenOS |
Configuring the Juniper Firewall Device Side VPN With XAuth
Problem:To configure the Juniper Firewall device side VPN with XAuth, perform the following steps:
Open the WebUI. For more information on accessing the WebUI, go to KB4060 - Accessing Your NetScreen, SSG, or ISG Firewall Using the WebUI .
From the ScreenOS options menu, click Objects, and then click to select IP Pools. 
Click New. 
From the Edit screen, enter an IP Pool Name, Start IP, and End IP.
For this example, we have entered an IP Pool Name of XAuthIPPool, a Start IP of 192.168.100.1, and an End IP of 192.168.100.100. You must enter an IP Pool that is different from any other assigned address on the Firewall device. 
Click OK.
From the ScreenOS options menu, click Objects, click Users, and then click to select Local. 
Click New. 
From Auth/IKE/L2TP/XAuth User, enter a User Name. For this example, we have entered xauthuser. 
From Status, click Enable.
Click IKE User, and then click to select Simple Identity. 
From IKE Identity, enter an IKE Identity. For this example, we have entered xauth@auth.com.
Click to select XAuth User, enter a User Password, and then Confirm Password. 
Click OK.
From the ScreenOS options menu, click VPNs, click AutoKey Advanced, and then click to select XAuth Settings. 
On the XAuth Settings page, from the IP Pool Name drop-down menu, click to select an IP Pool Name. For this example, we have selected xauthIPPool. 
If you decide to use External Authentication, use a third-party server such as Radius, Secure-ID or LDAP. If you decide to use the default Local Authentication Database on the Juniper Firewall, then you must select the IP Pool that you are going to use for the XAuth users under IP Pool Name, and enter the appropriate IP addresses for DNS and WINS. The other settings in this page are used for external authentication servers. For this example, we have entered a DNS Primary Server IP of 10.1.1.100, a DNS Secondary Server IP of 200.1.1.1, a WINS Primary Server IP of 10.1.1.100, and a WINS Secondary Server IP of 10.1.1.101.
Click Apply. 
From the ScreenOS options menu, click VPNs, click AutoKey Advanced, and then click to select Gateway. 
Click New. 
From the Edit page, enter a Gateway Name, and then click to select Custom. For this example, we have entered XAuthuserGate. 
From Remote Gateway Type, click to select Dialup User. From the User drop-down menu, click to select a User. For this example, we have selected xauthuser. 
From the Preshared Key text box, enter a Preshared Key. 
Click Advanced. The Outgoing Interface should be the outgoing interface that the XAuth users will use.
From Security Level, and from User Defined, click Custom. 
From Phase 1 Proposal, click to choose an encryption level, and then click Aggressive. If you are behind a NAT device, select Enable NAT-Traversal.
Click Enable XAuth, and then click to select Use Default. 
Select Use Default if you are using the local global XAuth settings. If you are going to use groups of users or the local to allow a more specific identification for the users and the group users, then you can select Local Authentication or External Authentication.
Click Return. 
Click OK. 
From the ScreenOS options menu, click VPNs, click AutoKey IKE. 
Click New. 
From the Edit page, and from VPN Name, enter a VPN Name. From Security Level, click Custom. For this example, we have entered XAuthuserIKE. 
From Remote Gateway, click Predefined, and then from the Remote Gateway drop-down menu, click a Remote Gateway. For this example, we have selected XAuthuserGate.
Click Advanced. 
From Security Level, and from User Defined, click Custom. 
From Phase 2 Proposal, click to choose an encryption level. For this example, we have chosen nopfs-esp-des-md5.
Click Return. 
Click OK. 
From the ScreenOS options menu, click Policies. 
In the From drop-down menu, click to select Untrust. From the To drop-down menu, click to select Trust. 
Click New.
From Source Address, click to select Address Book, and then in the Address Book drop-down menu, click to select Dial-Up VPN. 
From Destination Address, click to select Address Book, and then in the Address Book drop-down menu, select an IP Address/Netmask. For this example, we have selected 172.16.10.0/24.
From the Service drop-down menu, click ANY. From the Action drop-down menu, click Tunnel. 
From the Tunnel VPN drop-down menu, click to select a VPN. For this example, we have selected XAuthUserIKE.
Click to select Position at Top. 
Click OK.
Troubleshooting
