Article Detail

Description

This article goes over the following scenario:

Set up two or more Juniper Secure Connect VPNs that will use the same external IP address on the SRX. With or without multiple domains.

Solution

The configuration for each VPN will be exactly as normal, each with its own IKE config, IPSec config, ST interface, Remote-Access config, and Access Profile config.

See the following example config:

https://www.juniper.net/documentation/us/en/software/secure-connect/secure-connect-administrator-guide/topics/task/secure-connect-vpn-IKEv1-radius-cli-procedure.html

The catch is the remote-access config.

On setups with just one VPN, the name of the remote-access profile is not really relevant, because there's only one VPN, if a JSC client tries to connect to the IP address of the SRX, there's only one JSC VPN to choose from.

When setting up two or more JSC VPNs, the remote-access profile name will be used as an "ID" so the SRX can know which connection is for which VPN.

Pre-23.1R1:

Using the remote-access profile's name you can assign to each VPN a realm.

Example: https://192.168.0.1/engineering, where engineering is the realm.

So for example, let's say that you have a setup of SRX with one JSC VPN, and you want to add another one, and, the IP address of the SRX, which is 10.10.10.1, is not related to a domain. This means that to connect from the JSC client, something like this would be no be input: https://10.10.10.1.

Now that you are creating a new VPN/ream what would need to be done, is to:

1. Change the existing VPN's remote-access profile name to something like WhateverRealmNameYouWant, let's say you choose Original as the realm name. The config would look like this:

set security remote-access profile Original ipsec-vpn JUNIPER_SECURE_CONNECT

set security remote-access profile Original access-profile Juniper_Secure_Connect

set security remote-access profile Original client-config JUNIPER_SECURE_CONNECT

As you can see name of the remote-access profile will be used as the realm name for the connection. At this point, to connect to the VPN related to the realm "Original" the URL for the JSC Client App would be https://10.10.10.1/Original.

2. Create a new JSC VPN, with its own IKE gateway, IPSec VPN config, its own st interface, etc, and most importantly with the same external interface as the Original VPN. On this new VPN, you name the remote with a realm that will identify the VPN, let's say you choose "New" as realm name, the config would look like this

set security remote-access profile New ipsec-vpn JUNIPER_SECURE_CONNECT_NEW

set security remote-access profile New access-profile Juniper_Secure_Connect_New

set security remote-access profile New client-config JUNIPER_SECURE_CONNECT_NEW

At this point, to connect to the VPN related to the realm "New" the URL for the JSC Client App would be https://10.10.10.1/New.

You can select one of the profiles to be the default profile, which means that if on JSC Client you don't specify a realm, the connection will be made with that default profile's VPN. The command would be "set security remote-access default-profile default-profile"

Here's the full example config:

set system host-name JSC-Test

set system services web-management https interface ge-0/0/5.0

set system services web-management https pki-local-certificate TOP-JSC-3

set system services web-management https interface ge-0/0/5.0

set services ssl termination profile SSL_Termination_Profile server-certificate TOP-JSC-3

set security ike proposal JSC-IKE_Proposal authentication-method pre-shared-keys

set security ike proposal JSC-IKE_Proposal dh-group group19

set security ike proposal JSC-IKE_Proposal authentication-algorithm sha-256

set security ike proposal JSC-IKE_Proposal encryption-algorithm aes-256-cbc

set security ike proposal JSC-IKE_Proposal lifetime-seconds 28800

set security ike policy JSC-IKE_Policy mode aggressive

set security ike policy JSC-IKE_Policy proposals JSC-IKE_Proposal

set security ike policy JSC-IKE_Policy pre-shared-key ascii-text "$9$gPaGjmfzCtOHqtO1RlegoJGHqP5Qn9A"

set security ike gateway JSC_IKE_GW ike-policy JSC-IKE_Policy

set security ike gateway JSC_IKE_GW dynamic user-at-hostname [email protected]

set security ike gateway JSC_IKE_GW dynamic connections-limit 2

set security ike gateway JSC_IKE_GW dynamic ike-user-type shared-ike-id

set security ike gateway JSC_IKE_GW dead-peer-detection optimized

set security ike gateway JSC_IKE_GW dead-peer-detection interval 10

set security ike gateway JSC_IKE_GW dead-peer-detection threshold 5

set security ike gateway JSC_IKE_GW external-interface ge-0/0/5.0

set security ike gateway JSC_IKE_GW local-address 10.10.10.1

set security ike gateway JSC_IKE_GW aaa access-profile JSC-Access-Profile

set security ike gateway JSC_IKE_GW version v1-only

set security ike gateway JSC_Second_IKE_GW ike-policy JSC-IKE_Policy

set security ike gateway JSC_Second_IKE_GW dynamic user-at-hostname [email protected]

set security ike gateway JSC_Second_IKE_GW dynamic ike-user-type shared-ike-id

set security ike gateway JSC_Second_IKE_GW dead-peer-detection optimized

set security ike gateway JSC_Second_IKE_GW dead-peer-detection interval 10

set security ike gateway JSC_Second_IKE_GW dead-peer-detection threshold 5

set security ike gateway JSC_Second_IKE_GW external-interface ge-0/0/5.0

set security ike gateway JSC_Second_IKE_GW local-address 10.10.10.1

set security ike gateway JSC_Second_IKE_GW aaa access-profile JSC-Second-Access-Profile

set security ike gateway JSC_Second_IKE_GW version v1-only

set security ike gateway JSC_Second_IKE_GW tcp-encap-profile TCP-Encap-Profile

set security ipsec policy JSC-IPSec-Policy perfect-forward-secrecy keys group19

set security ipsec policy JSC-IPSec-Policy proposal-set standard

set security ipsec vpn JSC_VPN bind-interface st0.0

set security ipsec vpn JSC_VPN df-bit clear

set security ipsec vpn JSC_VPN copy-outer-dscp

set security ipsec vpn JSC_VPN ike gateway JSC_IKE_GW

set security ipsec vpn JSC_VPN ike ipsec-policy JSC-IPSec-Policy

set security ipsec vpn JSC_VPN traffic-selector Second_Term2 local-ip 192.168.30.1/24

set security ipsec vpn JSC_VPN traffic-selector Second_Term2 remote-ip 0.0.0.0/0

set security ipsec vpn JSC_Second_VPN bind-interface st0.1

set security ipsec vpn JSC_Second_VPN df-bit clear

set security ipsec vpn JSC_Second_VPN copy-outer-dscp

set security ipsec vpn JSC_Second_VPN ike gateway JSC_Second_IKE_GW

set security ipsec vpn JSC_Second_VPN ike ipsec-policy JSC-IPSec-Policy

set security ipsec vpn JSC_Second_VPN traffic-selector VPN2-LAN local-ip 192.168.40.1/24

set security ipsec vpn JSC_Second_VPN traffic-selector VPN2-LAN remote-ip 0.0.0.0/0

set security remote-access profile Original ipsec-vpn JSC_VPN

set security remote-access profile Original access-profile JSC-Access-Profile

set security remote-access profile Original client-config clientConfig

set security remote-access profile New ipsec-vpn JSC_Second_VPN

set security remote-access profile New access-profile JSC-Second-Access-Profile

set security remote-access profile New client-config clientConfig

set security remote-access default-profile New

set security remote-access client-config clientConfig connection-mode manual

set security remote-access client-config clientConfig dead-peer-detection interval 60

set security remote-access client-config clientConfig dead-peer-detection threshold 5

set security nat source rule-set JSC-VPN from zone trust

set security nat source rule-set JSC-VPN to zone DMZ-1

set security nat source rule-set JSC-VPN to zone DMZ-2

set security nat source rule-set JSC-VPN rule R1-JSC match source-address 0.0.0.0/0

set security nat source rule-set JSC-VPN rule R1-JSC then source-nat interface

set security policies default-policy permit-all

set security tcp-encap profile TCP-Encap-Profile ssl-profile SSL_Termination_Profile

set security zones security-zone trust host-inbound-traffic system-services all

set security zones security-zone trust interfaces ge-0/0/5.0

set security zones security-zone trust interfaces st0.0

set security zones security-zone trust interfaces st0.1

set security zones security-zone DMZ-1 interfaces ge-0/0/1.0 host-inbound-traffic system-services all

set security zones security-zone DMZ-2 interfaces ge-0/0/2.0 host-inbound-traffic system-services all

set interfaces ge-0/0/1 unit 0 family inet address 192.168.30.100/24

set interfaces ge-0/0/2 unit 0 family inet address 192.168.40.100/24

set interfaces ge-0/0/5 unit 0 family inet address 10.10.10.1/24

set interfaces st0 unit 0 family inet

set interfaces st0 unit 1 family inet

set access profile JSC-Access-Profile authentication-order password

set access profile JSC-Access-Profile client Second firewall-user password "$9$NZVsgGDkTz6oJz69A1INdbsoJUjHm5Q"

set access profile JSC-Access-Profile address-assignment pool VPN-DHCP-Pool

set access profile JSC-Second-Access-Profile authentication-order password

set access profile JSC-Second-Access-Profile client Second2 firewall-user password "$9$BE2RcrWLNYgJevgJGDmPBIEcev8X7Vs2"

set access profile JSC-Second-Access-Profile address-assignment pool VPN-Second-DHCP-Pool

set access address-assignment pool VPN-DHCP-Pool family inet network 192.168.30.0/24

set access address-assignment pool VPN-DHCP-Pool family inet range VPN_DHCP_Range low 192.168.30.1

set access address-assignment pool VPN-DHCP-Pool family inet range VPN_DHCP_Range high 192.168.30.100

set access address-assignment pool VPN-DHCP-Pool family inet xauth-attributes primary-dns 8.8.8.8/32

set access address-assignment pool VPN-Second-DHCP-Pool family inet network 192.168.40.0/24

set access address-assignment pool VPN-Second-DHCP-Pool family inet range VPN_Second_DHCP_Range low 192.168.40.1

set access address-assignment pool VPN-Second-DHCP-Pool family inet range VPN_Second_DHCP_Range high 192.168.40.100

set access address-assignment pool VPN-Second-DHCP-Pool family inet xauth-attributes primary-dns 8.8.8.8/32

set access firewall-authentication web-authentication default-profile JSC-Access-Profile

set routing-options static route 0.0.0.0/0 next-hop 192.168.20.2

23.1R1 and later:

Using the remote-access profile's name you can assign to each VPN a domain/FQDN and a realm.

Example: ra.example.com/engineering, where ra.example.com is the domain/FQDN, and engineering is the realm.

If the SRX's IP address is not associated with a domain, you can use the IP address instead of the domain.

Example: 192.168.0.1/engineering

So for example, let's say that you have a setup of SRX with one JSC VPN, and you want to add another one, and, the IP address of my SRX is not related to a domain, in the JSC client you just try to connect to 10.10.10.1, not a FQDN.

What would need to be done, is to:

1. Change the existing VPN's remote-access profile name to something like 10.10.10.1/WhateverRealmNameYouWant, let's say you choose 10.10.10.1/Original as the realm name.

Example of how the config would look in set commands:

set security remote-access profile 10.10.10.1/Original ipsec-vpn JUNIPER_SECURE_CONNECT

set security remote-access profile 10.10.10.1/Original access-profile Juniper_Secure_Connect

set security remote-access profile 10.10.10.1/Original client-config JUNIPER_SECURE_CONNECT

set security remote-access profile 10.10.10.1/Original options multi-access

2. Create a new JSC VPN, with its own IKE gateway, ipsec VPN config, its own st interface, etc, and most importantly with the same external interface as the Original VPN. On this new VPN, you name the remote with a realm that will identify the VPN, let's say you choose 10.10.10.1/New

Example of how the config would look in set commands:

set security remote-access profile 10.10.10.1/New ipsec-vpn JUNIPER_SECURE_CONNECT_NEW

set security remote-access profile 10.10.10.1/New access-profile Juniper_Secure_Connect_New

set security remote-access profile 10.10.10.1/New client-config JUNIPER_SECURE_CONNECT_NEW

set security remote-access profile 10.10.10.1/New options multi-access

And that's it, you have configured the new VPN. If you want to connect to the Original VPN, you need to type "https://10.10.10.1/Original" on the Juniper Secure Connect client in your PC. If you want to connect to the New one, you need to type "https://10.10.10.1/New" on the Juniper Secure Connect client in your PC.