Juniper Config Guide AGGRESSIVE PSK

Configuration Guide
NCP Remote Access VPN Client for Juniper SRX
IKEv1 AGGRESSIVE Pre-shared key

You can use the NCP Secure Enterprise Management Server as a RADIUS server to authenticate users.
IKEv1 AGGRESSIVE Mode and Pre-shared key
This configuration example uses the NCP Secure Enterprise Management Server as a RADIUS server to
authenticate users
CLI Quick Configuration

set security policies default-policy permit-all
set interfaces st0 unit 0 family inet address 172.16.10.200/24
set security zones security-zone internet interfaces st0.0 host-inbound-traffic system-services all
set security zones security-zone internet interfaces st0.0 host-inbound-traffic protocols all
set security ike proposal IKE_PROP authentication-method pre-shared-keys
set security ike proposal IKE_PROP dh-group group19
set security ike proposal IKE_PROP authentication-algorithm sha-256
set security ike proposal IKE_PROP encryption-algorithm aes-256-cbc
set security ike proposal IKE_PROP lifetime-seconds 10000
set security ike policy IKE_POL mode aggressive
set security ike policy IKE_POL proposals IKE_PROP
set security ike policy IKE_POL pre-shared-key ascii-text "12345678"
set security ike gateway RAVPN_GW ike-policy IKE_POL
set security ike gateway RAVPN_GW dynamic hostname ncp.juniper.net
set security ike gateway RAVPN_GW dynamic user-at-hostname [email protected]
set security ike gateway RAVPN_GW dynamic connections-limit 100
set security ike gateway RAVPN_GW dynamic ike-user-type shared-ike-id
set security ike gateway RAVPN_GW external-interface ge-0/0/0
set security ike gateway RAVPN_GW aaa access-profile radius
set security ike gateway RAVPN_GW version v1-only
set security ipsec proposal IPSEC_PROP protocol esp
set security ipsec proposal IPSEC_PROP encryption-algorithm aes-256-gcm
Americas: NCP engineering, Inc. 678 Georgia Ave. · Sunnyvale, CA 94085 · Phone: +1 (650) 316-6273 · www.ncp-e.com Page 1 / 64
Others: NCP engineering GmbH · Dombuehler Str. 2 · 90449 Nuremberg · Germany · Fon +49 911 9968-0 · Fax +49 911 9968-299
Configuration Guide
set security ipsec proposal IPSEC_PROP lifetime-seconds 3600

set security ipsec policy IPSEC_POL perfect-forward-secrecy keys group19
set security ipsec policy IPSEC_POL proposals IPSEC_PROP
set security ipsec vpn RAVPN_VPN bind-interface st0.0
set security ipsec vpn RAVPN_VPN ike gateway RAVPN_GW
set security ipsec vpn RAVPN_VPN ike ipsec-policy IPSEC_POL
set security ipsec vpn RAVPN_VPN traffic-selector TS1 local-ip 0.0.0.0/0
set security ipsec vpn RAVPN_VPN traffic-selector TS1 remote-ip 0.0.0.0/0
set access profile radius authentication-order radius
set access profile radius radius-server 10.20.46.235 port 1812
set access profile radius address-assignment pool NCP_POOL
set access profile radius radius-server 10.20.46.235 secret "12345678"
set access address-assignment pool NCP_POOL family inet network 172.16.10.0/24
set access address-assignment pool NCP_POOL family inet xauth-attributes primary-dns 172.16.10.10/32
set access address-assignment pool NCP_POOL family inet xauth-attributes primary-wins 172.16.10.20/32
set security ike gateway RAVPN_GW tcp-encap-profile NCP
set security tcp-encap profile NCP
commit
Step-by-step Procedure
1) Define tunnel interface and policies

set security policies default-policy permit-all
set interfaces st0 unit 0 family inet address 172.16.10.200/24
set security zones security-zone internet interfaces st0.0 host-inbound-traffic system-services all
set security zones security-zone internet interfaces st0.0 host-inbound-traffic protocols all
2) Create IKE proposals (policies)

set security ike proposal IKE_PROP authentication-method pre-shared-keys
set security ike proposal IKE_PROP dh-group group19
set security ike proposal IKE_PROP authentication-algorithm sha-256
set security ike proposal IKE_PROP encryption-algorithm aes-256-cbc
set security ike proposal IKE_PROP lifetime-seconds 10000
Configuration Guide
set security ike policy IKE_POL mode aggressive

set security ike policy IKE_POL proposals IKE_PROP
set security ike policy IKE_POL pre-shared-key ascii-text “12345678"
3) Create IKE gateway

set security ike gateway RAVPN_GW ike-policy IKE_POL
set security ike gateway RAVPN_GW dynamic hostname ncp.juniper.net
set security ike gateway RAVPN_GW dynamic connections-limit 100
set security ike gateway RAVPN_GW dynamic ike-user-type shared-ike-id
set security ike gateway RAVPN_GW dynamic user-at-hostname [email protected]
set security ike gateway RAVPN_GW external-interface ge-0/0/0
set security ike gateway RAVPN_GW aaa access-profile radius
set security ike gateway RAVPN_GW version v1-only
4) Create IPsec proposals (policies)

set security ipsec proposal IPSEC_PROP protocol esp
set security ipsec proposal IPSEC_PROP encryption-algorithm aes-256-gcm
set security ipsec proposal IPSEC_PROP lifetime-seconds 3600
set security ipsec policy IPSEC_POL perfect-forward-secrecy keys group19
set security ipsec policy IPSEC_POL proposals IPSEC_PROP
5) Define VPN interface and routing information

set security ipsec vpn RAVPN_VPN bind-interface st0.0
set security ipsec vpn RAVPN_VPN ike gateway RAVPN_GW
set security ipsec vpn RAVPN_VPN ike ipsec-policy IPSEC_POL
set security ipsec vpn RAVPN_VPN traffic-selector TS1 local-ip 0.0.0.0/0
set security ipsec vpn RAVPN_VPN traffic-selector TS1 remote-ip 0.0.0.0/0
6) Create access profile for RADIUS server

set access profile radius authentication-order radius
set access profile radius radius-server 10.20.46.234 port 1812
set access profile radius address-assignment pool NCP_POOL
set access profile radius radius-server 10.20.46.234 secret "12345678"
Configuration Guide
7) Create IP address pool for Remote Access Users

set access address-assignment pool NCP_POOL family inet network 172.16.10.0/24
set access address-assignment pool NCP_POOL family inet xauth-attributes primary-dns 172.16.10.10/32
set access address-assignment pool NCP_POOL family inet xauth-attributes primary-wins 172.16.10.20/32
8) Enable NCP Path Finder Technology (TCP encapsulation)

set security ike gateway RAVPN_GW tcp-encap-profile NCP
set security tcp-encap profile NCP
8) Commit changes
commit
Configuration Guide
Configure NCP Exclusive Remote Access Client for Windows

Create new Connection Profile (Configuration – Profiles)
Click on “Add” to create a new Connection Profile
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Edit the Profile
Configuration Guide
Change the protocol and enter the pre-shared key
Configuration Guide
Establish the VPN connection
Configuration Guide
Configuration Guide
Configure NCP Exclusive Remote Access Client for macOS

Create new Connection Profile (NCP Exclusive Remote Access Client – Profiles…)
Configuration Guide
Click on “+” to create a new Connection Profile
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Edit the Profile
Configuration Guide
Change the protocol and enter the pre-shared key
Configuration Guide
Establish the VPN connection
Configuration Guide
Configuration Guide
Configure NCP Exclusive Remote Access Client for Android

Create new Connection Profile (Menue – Configure – Profile configuration – Add Profile)
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Configuration Guide
Enter name for connection profile
Configuration Guide
Enter name or IP address of Juniper SRX
Configuration Guide
Enable Extended Authenctication (XAUTH) and enter username and password
Configuration Guide
Configuration Guide
Configuration Guide
Enter the pre-shared key
Configuration Guide
Enter IKE-ID
Configuration Guide
Choose the Exchange mode (Aggressive Mode (IKEv1))
Configuration Guide
Save the profile by clicking on “Save” or the back button on the device
The configuration can also be imported via the app
Configuration Guide
Copy the configuration ncpphone.cfg or ncpphone.cnf into the folder Device storage/NCP/Import
Open the menu and choose “Import/Export”
Configuration Guide
Enable ncpphone.cfg and press the back/return button on your device
The configuration will be imported
Configuration Guide
Click on the slide button to establish a connection
Configuration Guide
If the establish the connection the first time, Android will ask you to allow the VPN client to establish a
connection. Click on “OK”
Configuration Guide
VPN connection is established
Configuration Guide
Configure NCP Exclusive Remote Access Client for iOS

The configuration of the iOS client is done on the NCP Secure Enterprise Management Server.
After you create a configuration on the NCP Secure Enterprise Management Server, you are able to export
the configuration file ncpphone.ncpconfigsem. The file ending needs to be .ncpconfigsem
There are 2 ways to import the profile

1) Import by sending it over email or downloading it from a webserver
This sample will show the import if the file is sent via email
Send the .ncpconfigsem file via email to your iOS device
Open the email with the attachment
Configuration Guide
Click on the .ncpconfigsem file and choose “Copy to NCP Client”
Configuration Guide
Configuration Guide
Click “Import” to start the import process
Configuration Guide
Allow to add a new VPN configuration by clicking on “Allow”
Configuration Guide
Enter you iPhone/iPad passcode to import the configuration
Configuration Guide
The import of the configuration was successful
Configuration Guide
2) Import over iTunes

Connect the iOS devise with your computer
Open iTunes on your computer
Click on the device button
Go to File Sharing and click on NCP Client
Add the configuration via “Add File…” and click “Sync” to synchronize the information with the iOS device
Configuration Guide
Configuration Guide
Open the App on the iOS device
Configuration Guide
Go to “Diagnostics” and “Configuration Import”
Configuration Guide
Click on the .ncpconfigsem file to start the import process
Configuration Guide
Click on “Import”
Configuration Guide
Click “Allow” to add another VPN configuration
Configuration Guide
Enter your iPhone/iPad passcode to import the configuration
Configuration Guide
The import of the configuration was successful
Configuration Guide
Click the slide button to establish the VPN connection
Configuration Guide

Juniper Config Guide AGGRESSIVE PSK

Uploaded by

Copyright:

Available Formats

Juniper Config Guide AGGRESSIVE PSK

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Juniper Config Guide AGGRESSIVE PSK

Uploaded by

Copyright:

Available Formats

Configuration Guide

NCP Remote Access VPN Client for Juniper SRX

IKEv1 AGGRESSIVE Pre-shared key

IKEv1 AGGRESSIVE Mode and Pre-shared key

CLI Quick Configuration

set security ipsec proposal IPSEC_PROP lifetime-seconds 3600

1) Define tunnel interface and policies

2) Create IKE proposals (policies)

set security ike policy IKE_POL mode aggressive

3) Create IKE gateway

4) Create IPsec proposals (policies)

5) Define VPN interface and routing information

6) Create access profile for RADIUS server

7) Create IP address pool for Remote Access Users

8) Enable NCP Path Finder Technology (TCP encapsulation)

Configure NCP Exclusive Remote Access Client for Windows

Click on “Add” to create a new Connection Profile

Edit the Profile

Change the protocol and enter the pre-shared key

Establish the VPN connection

Configure NCP Exclusive Remote Access Client for macOS

Click on “+” to create a new Connection Profile

Edit the Profile

Change the protocol and enter the pre-shared key

Establish the VPN connection

Configure NCP Exclusive Remote Access Client for Android

Enter name for connection profile

Enter name or IP address of Juniper SRX

Enable Extended Authenctication (XAUTH) and enter username and password

Enter the pre-shared key

Choose the Exchange mode (Aggressive Mode (IKEv1))

The configuration can also be imported via the app

Open the menu and choose “Import/Export”

Enable ncpphone.cfg and press the back/return button on your device

The configuration will be imported

Click on the slide button to establish a connection

VPN connection is established

Configure NCP Exclusive Remote Access Client for iOS

There are 2 ways to import the profile

Send the .ncpconfigsem file via email to your iOS device

Open the email with the attachment

Click on the .ncpconfigsem file and choose “Copy to NCP Client”

Click “Import” to start the import process

Allow to add a new VPN configuration by clicking on “Allow”

Enter you iPhone/iPad passcode to import the configuration

The import of the configuration was successful

2) Import over iTunes

Open iTunes on your computer

Click on the device button

Go to File Sharing and click on NCP Client

Open the App on the iOS device

Go to “Diagnostics” and “Configuration Import”

Click on the .ncpconfigsem file to start the import process

Click “Allow” to add another VPN configuration

Enter your iPhone/iPad passcode to import the configuration

The import of the configuration was successful

Click the slide button to establish the VPN connection

You might also like