IMPORTANT NOTE: This tool does not perform error checking against your existing configuration. If a misspelled or incorrect zone, interface or network address is specified, it may report errors when you copy the configuration onto your device.
Source or Destination NAT (NAT-Src, NAT-Dst) needs to occur as it traverses the VPN Overlapping Subnets/IP Addresses between the two LANs Hub-and-spoke VPN topology Design requires Primary and Backup VPN A Dynamic Routing Protocol (i.e. OSPF, RIP, BGP) is running across the VPN Need to access multiple subnets or networks at the remote site, across the VPN
Remote VPN device is a non-Juniper device Need to access only one subnet or one network at the remote site, across the VPN You require more granularity than a route can provide when determining which traffic is sent to a tunnel
The secure tunnel interface identifier on the local device. In other words, the tunnel interface to which the route-based virtual private network (VPN) will be bound. (e.g., st0.0)
Valid values for st0 unit: range 0-65535
Numbered tunnel interfaces are recommended for the following scenarios:It is recommended to be on the same logical subnet of the peer interface on the remote device.
Source or Destination NAT (NAT-Src, NAT-Dst) occurs as it traverses the VPN Overlapping Subnets/IP Addresses between the two LANs A Dynamic Routing Protocol (i.e. OSPF, RIP, BGP) is running across the VPN
Unnumbered tunnel interfaces are simplier and used in a small topology environment.
|md5:||MD5 Authentication Algorithm|
|sha-256:||SHA 256-bit Authentication Algorithm|
|sha1:||SHA1 Authentication Algorithm|
|3des-cbc:||3DES-CBC Encryption Algorithm|
|aes-128-cbc :||AES-CBC 128-bit Encryption Algorithm|
|aes-192-cbc:||AES-CBC 192-bit Encryption Algorithm|
|aes-256-cbc:||AES-CBC 256-bit Encryption Algorithm|
|des-cbc:||DES-CBC Encryption Algorithm|
|hmac-md5-96:||HMAC-MD5-96 authentication algorithm|
|hmac-sha1-96:||HMAC-SHA1-96 authentication algorithm|
|3des-cbc:||3DES-CBC encryption algorithm|
|aes-128-cbc :||AES-CBC 128-bit encryption algorithm|
|aes-192-cbc:||AES-CBC 192-bit encryption algorithm|
|aes-256-cbc:||AES-CBC 256-bit encryption algorithm|
|des-cbc:||DES-CBC encryption algorithm|
R-U-THERE messages are sent at configured intervals regardless of traffic activity between the peers
R-U-THERE messages are triggered if there is no incoming IKE or IPsec traffic within a configured interval after the device sends outgoing packets to the peer. This is the default mode.
R-U-THERE messages are triggered if there is no incoming or outgoing IKE or IPsec traffic within a configured interval. R-U-THERE messages are sent periodically to the peer until there is traffic activity. This mode helps in early detection of a downed peer and makes the tunnel available for data traffic.The interval option allows adjusting how long to wait for traffic from peer before sending R-U-THERE messages. Default is 10 seconds.