Description

This article provides information how to use a DN as the remote gateway identity in a certificate based VPN for SRX branch devices.

Symptoms

How to use a DN as the remote gateway identity in a certificate based VPN for SRX branch devices.

Solution


If the certificate does not have x503 extensions or the SubjectAlternativeName field, then you have to use the DN as the identity of the remote gateway. There are two ways of using this:

  1. Wildcard : Part of the DN can be used to identify the remote gateway: 
    root@# show security ike gateway testgw 
ike-policy testikepol;
dynamic {
    distinguished-name {
        wildcard CN=SRX6502;
    }
}
external-interface ge-0/0/2.0;
  2. Container : You have to use the full DN as in the certificates of the remote side: 
    root@# show security ike gateway testgw 
ike-policy testikepol;
dynamic {
    distinguished-name {
        container "C=US, DC=Lab, ST=MH, L=PuneSDB9, O=Juniper, OU=PTAC, CN=SRX6502";
        }
}
external-interface ge-0/0/2.0;
Note : The DN should contain spaces between all the fields. If the user omits the spaces, the tunnel does not comes up with identification failure.

Modification History

6/22/2012 - KB created

10/21/2024- KB Visibility changed to Public