Juniper SRX IPsec VPN is a security framework used to secure remote connections.
It uses cryptography algorithms to secure traffic to ensure it cannot be eavesdropped or manipulated with by unauthorized users.
In this section we discuss the theoretical concept of IPsec VPN. We will see the configuration examples in the next sections.
Juniper SRX VPN Cryptography understanding is the prerequisite to understand the IPsec VPN concept and configuration that we will discuss in the next sections.
In this section, we will have an overview of basic cryptography concepts such as encryption, authentication, and integrity.
Juniper SRX Static NAT is a one-to-one mapping between two IP addresses. It has the highest priority in NAT policies.
It is bi-directional, meaning it translates the IP address in both directions. In other words, in acts as both destination NAT and source NAT.
Juniper SRX Source NAT Off allows to disable source NAT for some specific Traffic.
It can be very helpful for VPN traffic, especially that most VPN protocols are not compatible with NAT services.
Disabling NAT can also be configured for destination NAT, however it is mostly useful for source NAT.
Juniper SRX Destination NAT allows services with private IP addresses to be published over the Internet.
In other words, servers with private IP address can be reachable from the internet with the help of destination NAT.
It is also known as pre-routing NAT because the destination NAT occurs before routing.
Juniper SRX Source NAT Pool based and Proxy ARP is the discussion topic of this section.
With Source NAT all users with private IP addresses can access to the internet.
With configuring a pool of public IP addresses, source private IP address of outgoing traffic is translated to IP addresses configured in the pool.
Juniper SRX Source NAT allows users with a private IP address within the network to communicate over the Internet.
This is possible when private source IP addresses are translated to a public address when traffic is routed from an internal network to the Internet.
The source private IP address can be translated to the outgoing interface IP address which will be discussed in this section. It can also be translated into an IP address from a pool of IP addresses, which is discussed in the next section.
Juniper Ussr based Identity Firewall provide the capability to control traffic based on user name in addition to source IP address that we use normally.
As we have discussed in the previous section, user information and corresponding IP address is retrieved using LDAP and the Active Directory event log database..
Juniper SRX Active Directory Integration is a prerequisite for implementing user-based access control.
In this section, you will learn how Juniper SRX retrieves users and groups information from Active Directory and how to determine each user’s current IP address.
Then we’re ready to implement a user-based firewall or access control in the next section.
Juniper SRX Policy Rematch feature allows SRX device to re-evaluate active sessions whose associated policy has changed. Therefore, active sessions with changed policy will remain open if they are still allowed to be forwarded, otherwise they will be closed.
Details