How do I create an IKE VPN and limit it by a specific port?

Only allow custom service through the VPN Allow Lotus Notes (Port 1352) in a VPN

This solution applies to NetScreen-Remote:

It is best to demonstrate this through an example.  Assume we want to create a VPN that only allows Lotus Notes, Port 1352. The Notes server is on network 10.1.1.0/24. Assume the NetScreen firewall's untrust interface IP address is 1.1.1.1

On the NetScreen:

1. Click Objects > Services > Custom
2. Click New
   1. Service: Lotus-Notes
   2. TCP
      1. Source Port: 1024-65535
      2. Destination Port: 1352-1352
   3. Click OK
3. Create Dial Up VPN User: Click Objects > Users > Local
4. Click New
   1. Username: Notes-User
   2. Click IKE User
   3. Click Simple Identity
   4. IKE Identity: [email protected]
   5. Click OK
5. Click VPNs > AutoKey Advanced > Gateway
   1. Gateway Name: P1-Notes
   2. Click Dialup User:
      1. User: Notes-User
   3. Preshared Key: netscreen
   4. Security Level: Click Custom
   5. Click Advanced
      1. Phase 1 Proposal: pre-g2-3des-sha
      2. Mode (Initiator): Aggressive
      3. Click Return
   6. Click OK.
6. Click VPNs > AutoKey IKE
   1. VPN Name: P2-Notes
   2. Remote Gateway: Predefined: P1-Notes
   3. Security Level: Custom
   4. Click Advanced
      1. Phase 2 Proposal: nopfs-esp-3des-sha
      2. Click Return
   5. Click OK
7. Click Policy
   1. Click From Zone Untrust to Zone Trust
   2. Click New
      1. Source Address Book: Dial-Up VPN
      2. Destination Address Book: 10.1.1.0/24
      3. Service: Lotus-Notes
      4. Action: Tunnel
      5. Tunnel VPN: P2-Notes
      6. Click OK

On the NetScreen-Remote side:

1. Launch NetScreen-Remote Security Policy Editor
2. Create New Policy by clicking the New Connection icon on upper left corner. We'll call this new connection Corporate
3. On Remote Party Identity and Addressing
4. ID Type: IP Subnet
5. Subnet: 10.1.1.0
6. Netmask: 255.255.255.0
7. Protocol: Click TCP
8. Port: Click Field next to Port, and enter Notes. Hit the tab button, and the field next to Notes will appear.  Enter 1352
9. Click Connect using Secure Gateway Tunnel
10. ID Type: IP Address: 1.1.1.1
11. Expand the connection Corporate
12. Click Security Policy
    1. Select Phase 1 Negotiation Mode: Aggressive
    2. Select Enable Perfect Forward Secrecy (PFS)
    3. PFS Key Group: Diffie-Hellman Group 2
    4. De-select "Enable Replay Detection"
13. Select My Identity
14. Select Certificate: None
15. ID Type: Email address: [email protected]
16. Port: Select Notes
17. Click Pre-Shared Key
18. Click Enter Key
19. Enter the Pre-shared key netscreen
20. Click OK
21. Expand Security Policy
22. Expand Authentication (Phase 1)
23. Select Proposal 1
    1. Encryption Alg: Triple DES
    2. Hash Alg: MD5
    3. SA Life: Unspecified
    4. Key Group: Diffie-Hellman Group 2
24. Expand Key Exchange (Phase 2)
25. Select Proposal 1
    1. Encrypt Alg. Triple DES
    2. Hash Alg. MD5
    3. Encapsulation: Tunnel
26. Click Save

Here is the problem or goal:

• Only allow custom service through the VPN
• Allow Lotus Notes (Port 1352) in a VPN
• How do I create an IKE VPN and limit it by a specific port?

Applicable Products:

• NetScreen-Remote

Applicable Software Versions:

• 7.0
• 7.1
• 8.0
• 8.1
• 8.2