This article explains the differences between a policy-based VPN and a route-based VPN for Junos OS. In addition, it explains how to identify which type is configured for an existing VPN.

What type of VPN is configured, policy-based or route-based?

Policy-Based VPN

For an explanation of policy-based VPNs and examples of where policy-based VPNs can be used, refer to Understanding Policy-Based IPsec VPNs .

A tunnel is a means for delivering traffic between points A and B by using a security policy for both directing traffic into the tunnel and permitting or denying delivery of that traffic.

A policy-based VPN configuration includes a security policy whose action includes tunnel , and references a specific VPN.

Example

root@siteA# show security policies
           from-zone trust to-zone untrust {
            policy vpnpolicy-tr {
              match {
                source-address local-net;
                destination-address remote-net;
                application any;
              }
              then {
                permit {
                    tunnel {    <----------------------
                      ipsec-vpn ike-vpn-srx2;
                       }
                     }
                   }
                 }
               }

Route-Based VPN

For an explanation of route-based VPNs and examples of where route-based VPNs can be used, refer to Understanding Route-Based IPsec VPNs .

Important Points

• A tunnel is a means for delivering traffic between points A and B by using routes with next-hops that point towards the associated st0 interface.

• A security policy is used for either permitting or denying delivery of that traffic.

• The st0 interface can be numbered or unnumbered.

• St0 interfaces must be bound to a security zone.

A route-based VPN has no associated security policy with tunnel action. Instead, the VPN tunnel is bound to a secure tunnel interface (st0) by using the bind-interface command in the [security ipsec vpn vpn-name] hierarchy.

Example

root@siteA # show security ipsec 
...
vpn ike-vpn-srx1{
           bind-interface st0.0;   <----------------------
           ike {
              gateway gw-srx1;
              proxy-identity {
                  local 192.168.2.0/24;
                  remote 192.168.1.0/24;
                  service any;
                }
               ipsec-policy ipsec-phase2-policy;
             }
          establish-tunnels immediately;
        }

• A Policy-Based VPN makes sense for situations where only a single host (Dial-UP VPN) or one subnet or network needs to be accessible across the VPN.  If multiple subnets need to be accessible then a Route-Based VPN makes more sense.
• For interoperability with certain third-party VPN devices which do not support the concept of route-based VPNs, a Policy-Based VPN is mandatory if routing to multiple networks across the tunnel.
• A tunnel policy will always have an action of Permit and Tunnel.  A Deny action is not allowed.

Route Based :

• A Route-Based VPN is a configuration in which the policy does not reference a specific IPSec VPN. Instead, a VPN tunnel is indirectly referenced by a route in which the next-hop points to a specific Secure Tunnel (st0) interface. The st0 interface is associated with a specific IPSec VPN through the Bind-Interface command in the [security ipsec vpn vpn-name] hierarchy.
  
• The st0 interface can be numbered or unnumbered. If it is unnumbered, the st0 interface borrows the IP address from the security zone interface.
• A tunnel is a means for delivering traffic between points A and B, and a policy as a method for either permitting or denying the delivery of that traffic. Simply put, JUNOS-ES allows you the freedom to separate the regulation of traffic from the means of its delivery.
• If the st0 interface does not need to support Policy-Based NAT, then the st0 interface can be specified as unnumbered. An unnumbered ST interface must still be bound to a security zone.  An egress interface must also be bound to the security zone whose IP address the unnumbered st0 interface borrows.

A Route-Based VPNs must include the following configuration information:

• Secure Tunnel (st0) Interface
• Phase I VPN Gateway configuration (listed under Configuration > Quick Configuration > VPN > IKE on J-Web)
• Phase II VPN configuration (listed under Configuration > Quick Configuration > VPN > IPSec Autokey on J-Web); including:
  • Local and Remote Proxy ID 
  • IPSec configuration bound to st0 interface
• Route for remote network pointing to the st0 interface for the next-hop
  
• Policy specifying action of "Permit" to allow traffic, however an action of Deny is also allowed to block certain hosts.

For additional information, consult: KB10128 - How to configure VPN on a JUNOS-ES device [juniper.net]

2020-12-18: Minor, non-technical updates

2020-06-08: Article reviewed for accuracy; no changes required; article still valid

• [SRX] Resolution Guide - How to troubleshoot Problem Scenarios in VPN tunnels
• [SRX] How to troubleshoot a VPN that is up, but is not passing traffic