Time for my tale of configuring a pair of Juniper SSG routers to use FIPS mode and create a point to point VPN. (see my other post for the background for this)
First, I found a good resource and you should get it also:
Concepts & Examples ScreenOS Reference Guide
Volume 5: Virtual Private Networks
Release 6.1.0, Rev. 01
Chapter 4: Site-to-Site Virtual Private Networks
“Route-Based Site-to-Site VPN, AutoKey IKE” on page 96
NOTE ScreenOS 5.4.0r4 is the only version FIPS certified. ScreenOS 6.1 supports FIPS mode, but has not been tested by NIST.
You must use a console cable to configure the routers. FIBS mode disables Telnet and HTTP management.
To keep this post short and readable, I’ll have to ask you to refer the the “Route-Based Site-to-Site VPN, AutoKey IKE” on page 96 of the resource I listed above.
The first order of business is to upgrade or downgrade the ScreenOS if desired. Use a tftp server to load the ScreenOS.
Next, the FIPS mode must do a checksum on the ScreenOS on boot up, so you must install the Authentication Certificate from http://www.juniper.net/techpubs/software/screenos/mibs.html to the router using a tftp server.
save image-key tftp tftp_srv_ip_addr imagekey.cer from bgroup0
Then enable FIPS mode
set FIPS-mode enable
The device will reboot and erase the configuration.
Configure the basic administration and interface information. Change the admin account’s name and password. The FIPS password must have Upper, Lower, Number and Punctuation.
The most important part is configuring VPN with a Preshared Key.
First, we have to define our own phase 1 group because FIPS-mode deleted them (it requires a more stringent phase 1) Use Group5 , ESP, Tripple DES, and SHA-1
set ike p1-proposal pre-g5-esp-3des-sha-1 group5 esp 3des sha-1
Assign the Phase One to the remote gateway. Put in your remote gateway’s IP address. h1p8A24nG5 is my preshared key. This is a long command.
set ike gateway To_Remote address remote_ip_addr main outgoing-interface ethernet0/0 preshare h1p8A24nG5 proposal pre-g5-esp-3des-sha-1
Next, the phase 2 group
set ike p2-proposal g5-esp-3des-sha-1 group5 esp 3des sha-1
Set the VPN tunnel with our phase two and bind
set vpn New_Tunnel gateway To_Remote proposal g5-esp-3des-sha-1 set vpn New_Tunnel bind interface tunnel.1
Define the IP address at the end of the tunnel (1.0 is local, 2.0 is remote)
set vpn New_Tunnel proxy-id local-ip 192.168.1.0/24 remote-ip 192.168.2.0/24 any
Setup a route to the other network
set vrouter trust-vr route 192.168.2.0/24 interface tunnel.1
Define names for your LANs
set address “Trust” Local_LAN 192.168.1.0/24
set address “Untrust” Remote_Office 192.168.2.0/24
And then setup policies to allow the traffic. (these are 2 lines)
set policy top name “To Remote” from “Trust” to “Untrust” Local_LAN Remote_Office any permit
set policy top name “From Remote” from “Untrust” to “Trust” Remote_Office Local_LAN any permit
This should help you get a VPN tunnel setup on your FIPS mode Juniper. If you have any questions, leave a comment, and I’ll get back with you.