One of the amazing functionality of Juniper firewalls are the CLI easiness of creating and maintaining configurations, one such impressive example is VPN Configuration;

Say, we have 2 working Juniper firewalls and if we want to configure site to site vpn tunnels, then it would be as simple as 3 commands. Lets see how difficult it is;

First create a tunnel Interface :

set interface tunnel.1 zone <Zone>

set interface tunnel.1 ip unnumbered interface <Interface>

Create VPN parameters:

set ike <Gateway-Name> address <Remote Peer IP> <Mode> outgoing-interface <Interface-Name> preshare “Key” proposal <Propasal>

set vpn <VPN-Name> gateway <IKE-Gateway> sec-level compatible

set vpn <VPN-Name> bind interface <Tunnel-Interface>

Create a route to send the traffic over VPN:

set route <Remote-Network>/<Mask> interface tunnel.1

Example:

SiteA-Network———-Firewall-1————————-Firewall-2————SiteB-Network

Firewall-1  [ethernet0/1 - outside interface in zone 'untrust' , 1.1.1.1/30]

Firewall-2 [ethernet0/1 - outside interface in zone 'untrust', 2.2.2.2/30]

Firewall-1 [Internal Network is 20.20.20.0/24]

Firewall-2 [ Internal Network is 10.10.10.0/24]

So the configuration would look like this;

###################################################################

set interface tunnel.1 zone untrust

set interface tunnel.1 ip unnumbered interface ethernet0/1

set ike “ToSiteB” address 2.2.2.2 main outgoing-interface ethernet0/1 preshare PASSWORD proposal pre-g2-3des-sha

set vpn “TOSITEB-VPN” gateway “ToSiteB” sec-level compatible

set vpn “TOSITEB-VPN” bind interface tunnel.1

set route 10.10.10.0/24 interface tunnel.1

###################################################################