This article explains how to configure a site-to-site route-based VPN on a SRX which is running Junos FIPS software.

When attempting to commit the VPN configuration on a SRX device running Junos-FIPS, the following error messages are reported:

The VPN configuration on the SRX running Junos-FIPS has additional requirements from that of the one on a regular Junos software.

It is mandatory to configure both authentication and encryption algorithms under the security  hierarchy for the SRX devices running Junos FIPS software.

Note : The minimum encryption required for FIPS is 3DES, and the minimum authentication is SHA-1. Also, only Diffie-Helman Group 5 or higher is supported; you cannot use DH Group 1 or 2.

Below is a sample configuration for the VPN:

root@650# show | no-more 
## Last changed: 2012-05-29 14:23:06 PDT
version 10.4R4.5;
system {
    host-name SRX-650;
    domain-name jnpr.net;
    root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
    }
    services {
        ssh;
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 10.0.0.1/24;
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family inet {
                address 20.0.0.1/30;
            }
        }
    }
    st0 {
        unit 0 {
            family inet;
        }
    }
}
routing-options {
    static {
        route 10.0.0.0/24 next-hop st0.0;
    }
}
security {
    ike {
        proposal ike_proposal {
            authentication-method pre-shared-keys;
            dh-group group5;
            authentication-algorithm sha1;
            encryption-algorithm 3des-cbc;
        }
        policy ike_policy {
            proposals ike_proposal;
            pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
        }
        gateway ike_gw {
            ike-policy ike_policy;
            address 20.0.0.2;
            external-interface ge-0/0/2;
        }
    }
    ipsec {
        proposal ipsec_proposal {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm 3des-cbc;
        }
        policy ipsec_policy {
            proposals ipsec_proposal;
        }
        vpn vpn1 {
            bind-interface st0.0;
            ike {
                gateway ike_gw;
                ipsec-policy ipsec_policy;
            }
            establish-tunnels immediately;
        }
    }
    zones {
        functional-zone management;
        security-zone untrust {
            interfaces {
                ge-0/0/2.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    ping;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone vpn {
            interfaces {
                st0.0;
            }
        }
    }
    policies {
        from-zone vpn to-zone trust {
            policy allow {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone vpn {
            policy allow-out {
                match {
                     source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

Verification :

root@650# run show version 
Hostname: SRX-650
Model: srx650
JUNOS Software Release [10.4R4.5] (FIPS edition)

root@650# run show security ike security-associations    
Index   Remote Address  State  Initiator cookie  Responder cookie  Mode
5547004 20.0.0.2        UP     42ce99fcdb708d91  95f356affe614cfc  Main         

[edit]
root@650# run show security ipsec security-associations 
  Total active tunnels: 1
  ID    Gateway          Port  Algorithm       SPI      Life:sec/kb  Mon vsys
  <131073 20.0.0.2       500   ESP:3des/sha1   f4864a9d 3595/ unlim   -   root
  >131073 20.0.0.2       500   ESP:3des/sha1   bbf45f29 3595/ unlim   -   root

[edit]
root@650# run show interfaces st0 terse 
Interface               Admin Link Proto    Local                 Remote
st0                     up    up  
st0.0                   up    up   inet    

Note: No additional hardware is required to run Junos-FIPS.

• Junos-FIPS Configuration Guide for Security Devices