Description

This article contains information on configuring a tunnel policy for the local site of a site-to-site policy-based VPN on a J Series or SRX Series device.

Solution

Refer to example network diagram below:

alt
  Site A                                                                                              Site B

When creating a policy-based VPN, a tunnel policy is needed to permit the traffic and determine the IPSec VPN to use to encrypt/decrypt the traffic.  VPN traffic must traverse two security zones such that the policy is for interzone traffic (as opposed to intrazone). So lets take the example below.
Site A:
  • 192.168.10.1 is the IP assigned to interface ge-0/0/0.0, and the interface is a member of zone "trust" facing 192.168.10.0/24 subnet.
  • 172.16.10.1 is the IP assigned to interface ge-0/0/3.0 and interface is a member of zone "untrust" facing the Internet..
Site B:
  • 192.168.20.1 is the IP assigned to interface ge-0/0/0.0, and the interface is a member of zone "trust" facing 192.168.20.0/24 subnet.
  • 172.16.20.1 is the IP assigned to interface ge-0/0/3.0 and interface is a member of zone "untrust" facing the Internet.
Assume that on Site A, hosts on "siteA" 192.168.10.0/24 need to be able to reach any host on Site B,"siteB" 192.168.20.0/24 network across the VPN.  Also assume that the VPN needs to be bi-directional which means that Site A also needs to be able to reach hosts on Site B.  Also, assume that IKE phase 1 and phase 2 are already configured with ipsec-vpn name of "remote-vpn".  Both sides of the diagram can be configured similarly, so for the purposes of this article, only the Left side configuration will be shown. 

There are three basic steps to create a tunnel policy.
  1. Create address book entry if none already exists.
  2. (Optional) Create custom application, if no pre-defined applications encompass the protocol or ports needed.
  3. Create the tunnel policy which specifies from and to zones,  Source Address, Destination Address, Application, IPSec VPN and Pair Policy if bi-directional.

1. Creating an address book entry.
J-Web :
  1. Go to Configure> Security >Policy Elements >Address Book 
  2. To add an address book entry for each zone, click on Add
  3. Click on the zone for which you would like to add an address book entry (example: zone trust ).
  4. If address book entry required does not exist, then click Add...
  5. In the Address Name field specify a name (example: " siteA" ).  Note, the name must be a string beginning with a letter and consisting of letters, numbers, dashes and/or underscores.
  6. In IP Address/Prefix , enter the IP address/subnet mask (example: 192.168.10.0/24 ).
     or
    In DNS Name , specify a fully qualified domain name.  Note, the J Series or SRX Series device must have a working DNS server configured to resolve the domain name.
  7. Click OK . 
  8. Repeat steps 3-7 for zone untrust Address Book entry " siteB ". Click OK again to return to the Security Policies screen.
CLI :
root@SiteA> set security zones security-zone trust address-book address siteA 192.168.10.0/24
root@SiteA> set security zones security-zone untrust address-book address siteB 192.168.20.0/24
2. (Optional) If a predefined application cannot be used, create a custom application.
J-Web:
  1. From Configure > Security > Policy Elements  screen, click on Applications .
  2. Select Custom-Applications tab.
  3. Click Add...
  4. Specify Application Name (example: tcp1500 ), then click ' + ' (plus box) for Configure top level options .
  5. Click on Match IP protocol pull down and choose tcp .
  6. Enter 1500 in the freeform field for Destination port (not the pull down field).  Note, since the application can use any source port then it is not necessary to also specify source port for the application.
  7. Click OK .  Then click OK again to return to the Security Policies screen.
CLI:
root@SiteA> set applications application tcp1500 protocol tcp
root@SiteA> set applications application tcp1500 destination-port 1500
Note that if allowing all applications to traverse the VPN then no custom application is needed since pre-defined application "any" already exists.  So, for this example the above step is not necessary.

 
3. Create bi-directional tunnel policies to permit the traffic.
J-Web:
  1. From Configure >Security > Policy  screen, click Apply Policy
  2. In Zone Direction , select From Zone trust and To Zone untrust.
  3. Click Add a Policy .
  4. Specify Policy Name (example: "vpnpolicy-tr-unt" ), then click ' + ' (plus box) for Match Criterias .
  5. Select Source Address Book "siteA" object on the right side and click alt (left arrow) to add to the Matched list.
  6. Select Destination Address Book "siteB" object and click alt (left arrow) to add to the Matched list.
  7. Select Application " any" and click alt (left arrow) to add to the Matched list. 
  8. For Policy Action , select Permit from the pull down. Note, this will show more options. 
  9. For IPSec-VPN Tunnel select configured IPSec profile "remote-vpn" from the pull down.  Do NOT specify Pair Policy at this time as this will need to be done when other direction policy is created.
  10. Click OK to commit changes.
  11. Repeat steps 2-9 above for the from-zone "untrust" to-zone "trust" tunnel policy (Source and Destination addresses will be the reverse).
  12. Specify the Pair Policy with the name of your local to remote policy "vpnpolicy-tr-unt" . 
  13. Click OK to commit changes.  Then click OK again to return to main policy configuration screen.
  CLI:
root@SiteA> set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt match source-address siteA
root@SiteA> set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt match destination-address siteB
root@SiteA> set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt match application any
root@SiteA> set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt then permit tunnel ipsec-vpn remote-vpn
root@SiteA> set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt then permit tunnel pair-policy vpnpolicy-unt-tr

root@SiteA> set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr match source-address siteB
root@SiteA> set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr match destination-address siteA
root@SiteA> set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr match application any
root@SiteA> set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr then permit tunnel ipsec-vpn remote-vpn
root@SiteA> set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr then permit tunnel pair-policy vpnpolicy-tr-unt

note: The ordering of policies is important. Junos on a J Series or SRX Series device will perform a policy lookup from top to bottom until a match is found.  At that point no further policy lookup occurs.  Therefore if a permit all policy exists then be sure that the tunnel policy is above the permit all policy.  If not then the tunnel policy will never be reached.  To re-arrange policy order, use the Move up or down option in the Security Policies screen in JWeb or the Insert command in CLI. For more information on policy ordering, refer to KB10120-How to change the order of policies on a J Series or SRX Series device [juniper.net]

”note:" src="/kb/images/public/shared/note.gif" /> For additional information regarding configuration of IKE phase 1 and phase 2, consult: KB10128 - How to configure IPSec VPN on a JUNOS-ES device [juniper.net]
There are three basic steps to creating a tunnel policy.
  1. Create Address Book Entry if none already exists.
  2. Create Application entry if no pre-defined applications encompass the protocol or ports needed.
  3. Create the tunnel policy which specifies from and to zones,  Source Address, Destination Address, Application, IPSec VPN and Pair Policy if bi-directional.

Creating an address book entry.
From J-Web:
  1. Goto Configuration > Quick Configuration > Security Policies .
  2. To add an address book entry for each zone, click on Create Address Books .
  3. Click on the zone for which you would like to add an address book entry (example: zone trust ).
  4. If address book entry required does not exist, then click Add...
  5. In the Address Name field specify a name (example: " local-net" ).  Note, the name must be a string beginning with a letter and consisting of letters, numbers, dashes and underscores.
  6. In IP Address/Prefix , enter the IP address/subnet mask (example: 192.168.10.0/24 ).
     or
    In DNS Name , specify a fully qualified domain name.  Note, the JUNOS-ES device must have a working DNS server configured to resolve the domain name.
  7. Click OK . 
  8. Repeat steps 3-7 for zone untrust Address Book entry " remote-net ". Click OK again to return to the Security Policies screen.
From CLI:
    set security zones security-zone trust address-book address local-net 192.168.10.0/24
    set security zones security-zone untrust address-book address remote-net 192.168.20.0/24

    Creating a custom Application if applicable.
    From J-Web:
    1. From Configuration > Quick Configuration > Security Policies screen, click on Applications / Application Sets .
    2. Select Custom-Applications tab.
    3. Click Add...
    4. Specify Application Name (example: tcp1500 ), then click alt (plus box) for Configure top level options .
    5. Click on Match IP protocol pull down and choose tcp .
    6. Enter 1500 in the freeform field for Destination port (not the pull down field).  Note, since the application can use any source port then it is not necessary to also specify source port for the application.
    7. Click OK .  Then click OK again to return to the Security Policies screen.
    From CLI:
      set applications application tcp1500 protocol tcp
      set applications application tcp1500 destination-port 1500       Note that if allowing all applications to traverse the VPN then no custom application is needed since pre-defined application "any" already exists.  So for this example the above step is not necessary.


      Creating bi-directional tunnel  policies to permit the traffic.
      From J-Web:
      1. From Configuration > Quick Configuration > Security Policies screen, click Policies .
      2. In Zone Direction , select From Zone trust and To Zone untrust.
      3. Click Add a Policy .
      4. Specify Policy Name (example: "vpnpolicy-tr-unt" ), then click alt (plus box) for Match Criterias .
      5. Select Source Address Book "local-net" object on the right side and click alt (left arrow) to add to the Matched list.
      6. Select Destination Address Book "remote-net" object and click alt (left arrow) to add to the Matched list.
      7. Select Application " any" and click alt (left arrow) to add to the Matched list. 
      8. For Policy Action , select Permit from the pull down. Note, this will show more options. 
      9. For IPSec-VPN Tunnel select configured IPSec profile "remote-vpn" from the pull down.  Do NOT specify Pair Policy at this time as this will need to be done when other direction policy is created.
      10. Click OK to commit changes.
      11. Repeat steps 2-9 above for the from-zone "untrust" to-zone "trust" tunnel policy (Source and Destination addresses will be the reverse).
      12. Specify the Pair Policy with the name of your local to remote policy "vpnpolicy-tr-unt" . 
      13. Click OK to commit changes.  Then click OK again to return to main policy configuration screen.
      From CLI:
        set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt match source-address local-net
        set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt match destination-address remote-net
        set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt match application any
        set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt then permit tunnel ipsec-vpn remote-vpn
        set security policies from-zone trust to-zone untrust policy vpnpolicy-tr-unt then permit tunnel pair-policy vpnpolicy-unt-tr

        set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr match source-address remote-net
        set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr match destination-address local-net
        set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr match application any
        set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr then permit tunnel ipsec-vpn remote-vpn
        set security policies from-zone untrust to-zone trust policy vpnpolicy-unt-tr then permit tunnel pair-policy vpnpolicy-tr-unt

        ”note: The ordering of policies is important.  JUNOS-ES will perform policy lookup from top to bottom until a match is found.  At that point no further policy lookup occurs.  Therefore if a permit all policy exists then be sure that the tunnel policy is above the permit all policy.  If not then the tunnel policy will never be reached.  To re-arrange policy order, use the Move up or down option in the Security Policies screen in JWeb or the Insert command in CLI.

        Related Information