This article explains how to create different connection profiles for Juniper Secure Connect on one single SRX device, using different domains for both.
Requirements:
Objectives:
Configuration example:
*** Basic configuration for connectivity to the PC and internet ***
set system root-authentication encrypted-password <password>
set system services web-management https pki-local-certificate <certificate-name>
set system services web-management session idle-timeout 60
set system name-server 1.1.1.1
set services ssl termination profile <profile-name> server-certificate <certificate-name>
set security tcp-encap profile <profile-name> ssl-profile <profile-name>
set security nat source rule-set 1 from zone trust
set security nat source rule-set 1 to zone untrust
set security nat source rule-set 1 rule 1 match source-address 0.0.0.0/0
set security nat source rule-set 1 rule 1 match destination-address 0.0.0.0/0
set security nat source rule-set 1 rule 1 then source-nat interface
set security policies default-policy permit-all <<< Default permit added just for simplicity on the lab
set security zones security-zone untrust host-inbound-traffic system-services all
set security zones security-zone untrust host-inbound-traffic protocols all
set security zones security-zone untrust interfaces ge-0/0/0.0
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces ge-0/0/4.0
set security zones security-zone vpn host-inbound-traffic system-services all
set security zones security-zone vpn host-inbound-traffic protocols all
set security zones security-zone vpn interfaces st0.1
set security zones security-zone vpn interfaces st0.3
set routing-options static route 0.0.0.0/0 next-hop 2.2.2.2
*** ike proposal and policy can be reused for both profiles ***
set security ike proposal <proposal-name> authentication-method pre-shared-keys
set security ike proposal <proposal-name> dh-group group19
set security ike proposal <proposal-name> authentication-algorithm sha-256
set security ike proposal <proposal-name> encryption-algorithm aes-256-cbc
set security ike proposal <proposal-name> lifetime-seconds 28800
set security ike policy <policy-name> mode aggressive
set security ike policy <policy-name> proposals <proposal-name>
set security ike policy <policy-name> pre-shared-key ascii-text "$9$.fQ3ApBSrv69rvWLVb.P5"
*** ike gateways are separate for each profile, same external interface was used ***
set security ike gateway <gateway-name> ike-policy <policy-name>
set security ike gateway <gateway-name> dynamic user-at-hostname "user@hostname"
set security ike gateway <gateway-name> dynamic ike-user-type shared-ike-id
set security ike gateway <gateway-name> dead-peer-detection optimized
set security ike gateway <gateway-name> dead-peer-detection interval 10
set security ike gateway <gateway-name> dead-peer-detection threshold 5
set security ike gateway <gateway-name> external-interface ge-0/0/4
set security ike gateway <gateway-name> aaa access-profile access-profile <profile-name>
set security ike gateway <gateway-name> version v1-only
set security ike gateway <gateway-name> tcp-encap-profile <profile-name>
set security ike gateway <gateway-name2> ike-policy <policy-name>
set security ike gateway <gateway-name2> dynamic user-at-hostname "user@hostname"
set security ike gateway <gateway-name2> dynamic ike-user-type shared-ike-id
set security ike gateway <gateway-name2> dead-peer-detection optimized
set security ike gateway <gateway-name2> dead-peer-detection interval 10
set security ike gateway <gateway-name2> dead-peer-detection threshold 5
set security ike gateway <gateway-name2> external-interface ge-0/0/4
set security ike gateway <gateway-name2> aaa access-profile <profile-name>
set security ike gateway <gateway-name2> version v1-only
set security ike gateway <gateway-name2> tcp-encap-profile <profile-name>
*** ipsec proposal and policy is reused for both JSC profiles ***
set security ipsec proposal <proposal-name> protocol esp
set security ipsec proposal <proposal-name> encryption-algorithm aes-256-gcm
set security ipsec proposal <proposal-name> lifetime-seconds 3600
set security ipsec policy <policy-name> perfect-forward-secrecy keys group19
set security ipsec policy <policy-name> proposals <proposal-name>
*** ipsec vpn is configured separately for each profile, bound to its corresponding ike gateway ***
set security ipsec vpn <vpn-name> bind-interface st0.1
set security ipsec vpn <vpn-name> df-bit clear
set security ipsec vpn <vpn-name> copy-outer-dscp
set security ipsec vpn <vpn-name> ike gateway <gateway-name>
set security ipsec vpn <vpn-name> ike ipsec-policy <policy-name>
set security ipsec vpn <vpn-name> traffic-selector ts-1 local-ip 0.0.0.0/0
set security ipsec vpn <vpn-name> traffic-selector ts-1 remote-ip 0.0.0.0/0
set security ipsec vpn <vpn-name2> bind-interface st0.3
set security ipsec vpn <vpn-name2> ike gateway <gateway-name2>
set security ipsec vpn <vpn-name2> ike ipsec-policy <policy-name>
set security ipsec vpn <vpn-name2> traffic-selector ipsec-tablet-milpitas local-ip 0.0.0.0/0
set security ipsec vpn <vpn-name2> traffic-selector ipsec-tablet-milpitas remote-ip 0.0.0.0/0
*** separate remote-access profiles and client configs for each ***
set security remote-access profile domain1 ipsec-vpn <vpn-name>
set security remote-access profile domain1 access-profile Profile1
set security remote-access profile domain1 client-config client-config-1
set security remote-access profile domain2 ipsec-vpn <vpn-name2>
set security remote-access profile domain2 access-profile Profile2
set security remote-access profile domain2 client-config client-config-2The profile name must match the domain name users enter when connecting to Juniper Secure Connect client.
Example: domain1 = a.juniper.net; domain2 = b.juniper.net
*** Set one of the profiles created as default, if not, a realm error will be receive during connection ***set security remote-access default-profile domain1
*** one client config uses mode manual and the other one uses connection mode always ***
set security remote-access client-config client-config-1 connection-mode manual
set security remote-access client-config client-config-1 dead-peer-detection interval 60
set security remote-access client-config client-config-1 dead-peer-detection threshold 5
set security remote-access client-config client-config-2 connection-mode always
set security remote-access client-config client-config-2 dead-peer-detection interval 60
set security remote-access client-config client-config-2 dead-peer-detection threshold 5
*** separate access profiles for each connection, they use the same pool **
set access profile Profile1 client client1 firewall-user password "$9$4gJUiP5FApBk.pBIEeK4aZ" << Local authentication used for lab purposes only
set access profile Profile1 address-assignment pool <pool-name>
set access profile Profile2 client client2 firewall-user password "$9$/Rk2AuBcyKxNbIENbs2GU/Ct"
set access profile Profile2 address-assignment pool <pool-name>
set access address-assignment pool <pool-name> family inet network 172.16.0.0/24
set access address-assignment pool <pool-name> family inet range <range-name> low 172.16.0.10
set access address-assignment pool <pool-name> family inet range <range-name> high 172.16.0.150
set access address-assignment pool <pool-name> family inet xauth-attributes primary-dns 1.1.1.1/32
*** I used different IP addresses on the same interface and added a static DNS mapping on the PC ***
set interfaces ge-0/0/0 unit 0 family inet address 2.2.2.3/25
set interfaces ge-0/0/4 unit 0 family inet address 192.168.100.1/24 <<< to be mapped to domain1
set interfaces ge-0/0/4 unit 0 family inet address 192.168.100.2/24 <<< to be mapped to domain2
set interfaces st0 unit 1 family inet
set interfaces st0 unit 3 family inet
Static DNS entries were added on the PC to resolve the domain names above to IPs configured on the SRX, so they could be directed to the SRX when connecting to JSC using these domain names.
*** generating a self-signed wildcard certificate on SRX ***
run request security pki local-certificate generate-self-signed certificate-id <certificate-name> domain-name *.domain add-ca-constraint subject "DC=*.domain,CN=<certificate-name>,O=<certificate-name>,L=SJO,ST=SJO,C=CR"