2014 年 11 月 – Linux Cache

即时通讯服务Openfire安装与配置

11 月 272014

[root@localhost bin]# cat /opt/openfire/logs/nohup.out
nohup: failed to run command `/opt/openfire/jre/bin/java’: No such file or directory
[root@localhost bin]#

[root@localhost bin]# vi /etc/sysconfig/openfire
# If you wish to override the auto-detected JAVA_HOME variable, uncomment
# and change the following line.
#JAVA_HOME=/usr/java/default
JAVA_HOME=/usr/lib/jvm/jre-1.7.0-openjdk.x86_64

[root@localhost bin]# /etc/init.d/openfire start
Starting openfire:
[root@localhost bin]# cat /opt/openfire/logs/nohup.out
Openfire 3.9.3 [2014-11-26 19:01:29]
管理平台开始监听 http://localhost.localdomain:9090
[root@localhost bin]#
[root@localhost bin]# netstat -lnt |grep 9090
tcp 0 0 :::9090 :::* LISTEN
[root@localhost bin]#

Cisco路由器或三层交换机配置DHCP

未分类 No Responses »

11 月 252014

Cisco Inter-VLAN Communication 配置

未分类 No Responses »

11 月 252014

赛门铁克微软代码签名证书申请

未分类 No Responses »

11 月 242014

代码签名证书 (Code signing certificate) 是数字证书，有助于防止用户下载受感染的文件或应用程序。如果由开发商签名的文件或应用程序在发布后被修改或受感染，系统会弹出浏览器警告，告知用户该文件或应用程序的来源无法验证。

Code Signing Certificates for Microsoft Authenticode
对 32 位或 64 位用户模式（.exe、.cab、.dll、.ocx、.msi、.xpi 和 .xap 文件）和内核模式软件进行数字签名。

采用代码签名证书的好处：

1，依靠受信任的证书颁发机构 (CA) 减少安全警告
2，保护您的代码完整性和您的信誉
3，避免国内流氓安全软件企业对软件的误杀误报
工作原理：

开发商使用代码签名证书中的唯一私钥向代码或内容中添加数字签名。
用户下载或遇到已签名代码时，用户的系统软件或应用程序会使用公钥解密该签名。
系统查找含有它所信任或识别的 ID 的“根”证书，以验证该签名。
然后，将对该应用程序进行签名时所用的哈希值与下载的应用程序的哈希值进行比较。
如果系统信任该根证书且哈希值匹配，则继续下载或执行。
如果系统不信任该根证书或哈希值不匹配，那么系统会显示警告并中断下载过程，或下载过程失败。

code-signing-certificate-01 code-signing-certificate-02 code-signing-certificate-03 code-signing-certificate-04 code-signing-certificate-05 code-signing-certificate-06 code-signing-certificate-07 code-signing-certificate-08 code-signing-certificate-09 code-signing-certificate-10 code-signing-certificate-11 code-signing-certificate-12

HAProxy多线程模式下stats配置

未分类 No Responses »

11 月 182014

默认为1修改为8
    nbproc      8

[root@localhost ~]# service haproxy restart
Stopping haproxy:                                          [  OK  ]
Starting haproxy: [WARNING] 317/114841 (1478) : Proxy 'status': in multi-process mode, stats will be limited to 

process assigned to the current request.
[WARNING] 317/114841 (1478) : stats socket will not work as expected in multi-process mode (nbproc > 1), you 

should force process binding globally using 'stats bind-process' or per socket using the 'process' attribute.
                                                           [  OK  ]
[root@localhost ~]# 


[root@localhost ~]# service haproxy restart
Stopping haproxy:                                          [  OK  ]
Starting haproxy:                                          [  OK  ]
[root@localhost ~]#



修改

全局配置
global
    log         127.0.0.1 local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    nbproc      8
    maxconn     4000
    user        haproxy
    group       haproxy
    daemon
    stats bind-process 1
    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats


listen status
    bind-process 1
    bind *:8080
    stats enable
    stats hide-version
    stats uri /admin?stats
    stats auth admin:123456
    stats realm (Haproxy\ statistic)
    stats refresh 2s

等效
listen status 0.0.0.0:8080
    bind-process 1
    stats enable
    stats hide-version
    stats uri /admin?stats
    stats auth admin:123456
    stats realm (Haproxy\ statistic)
    stats refresh 2s

Juniper SRX PPPoE Configuration

未分类 No Responses »

11 月 072014

Summary:

This article provides Point-to-Point over Ethernet (PPPoE) configuration examples.

For other topics, go to the SRX Getting Started main page.

Problem or Goal:

Configure PPPoE.

Cause:

Solution:

This section contains the following:

Basic PPPoE Configuration Example

The following example illustrates a basic PPPoE configuration.

interfaces {
    fe-0/0/5 {
        unit 0 {
            encapsulation ppp-over-ether;
        }
    }
    pp0 {
        unit 0 {
            ppp-options {
                pap {
                    access-profile ppp-profile;
                    local-password "dkwoxslxqpz";##SECRET-DATA
                    local-name "username";
                    passive;
                }
            }
            pppoe-options {
                underlying-interface fe-0/0/5.0;
                auto-reconnect 10;
                client;
                idle-timeout 0;
            }
            family inet {
                negotiate-address;
                mtu 1492;
            }
        }
    }
}

Complete PPPoE and ADSL Configuration Example

The following example is a complete working configuration example using the following settings:

ADSL is the primary WAN interface in the untrust zone.
A 3G is the backup interface, monitoring the primary ADSL (at) interface.
A dialup interface (external modem) is used as a failover.
The at-1/0/0 and pp0.0 interfaces are in the untrust zone.
For pp0.0, point-to-point is configured.
PAP is configured using the passive option.
The PPPoE underlying-interface and client options are configured.
All Ethernet ports are in a single VLAN group with a DHCP server providing service.
A default route to the DSL interface is configured.
Source NAT is enabled.

system {
    host-name SRX210;
    name-server {
        208.67.222.222;
        208.67.220.220;
    }
    services {
        ssh;
	telnet;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
        dhcp {
	    domain-name jnpr.net;
            router {
                192.168.0.1;
            }
            pool 192.168.0.0/24 {
                address-range low 192.168.0.100 high 192.168.0.199;

            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    interface-range interfaces-trust {
	member ge-0/0/0;
        member ge-0/0/1;
        member fe-0/0/2;
        member fe-0/0/3;
        member fe-0/0/4;
        member fe-0/0/5;
        member fe-0/0/6;
        member fe-0/0/7;
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    cl-0/0/8 {
        traceoptions {
            flag all;
        }
        modem-options {
            init-command-string "AT&C1";
        }
        dialer-options {
            pool 1 priority 23;
        }
    }
    dl0 {
        unit 0 {
            family inet {
                negotiate-address;
            }
            dialer-options {
                pool 1;
                dial-string 1234;
            }
        }
    }
    at-1/0/0 {
        encapsulation ethernet-over-atm;
        atm-options {
            vpi 0;
        }
        dsl-options {
            operating-mode auto;
        }
        unit 0 {
            encapsulation ppp-over-ether-over-atm-llc;
            vci 0.35;
            backup-options {
                interface dl0.0;
            }
        }
    }
    pp0 {
        traceoptions {
            flag all;
        }
        unit 0 {
            point-to-point;
            ppp-options {
                pap {
                    default-password "$9$/Gav9u1RhrK871RNds2UDCtu1hr"; ## SECRET-DATA
                    local-name "phadu@sbcglobal.net";
                    local-password "$9$hWLceWLxdwgJWLZUHqzFSreWxd"; ## SECRET-DATA
                    passive;
                }
            }
            pppoe-options {
                underlying-interface at-1/0/0.0;
                client;
            }
            no-keepalives;
            family inet {
                negotiate-address;
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                address 192.168.0.1/24;
            }
        }
    }
}
routing-options {
    static {
	route 0.0.0.0/0 next-hop pp0.0 metric 0;
        route 0.0.0.0/0 next-hop dl0.0;
    }
}
security {
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    all;
                }
            }
            interfaces {
		at-1/0/0.0;
                pp0.0;
		dl0.0;
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}
poe {
    interface all;
}
vlans {
    vlan-trust {
        vlan-id 3;
        l3-interface vlan.0;
    }
}

Another configuration example is KB15347 – What will be the configuration for PPPoE over ATM on an ADSL interface?.

Technical Documentation

Interface Encapsulation Feature Guide for Security Devices

Troubleshooting

Use the show interfaces interface_name extensive command to review state and history information for the at and pp interfaces. For example:
user@host> show interfaces at-1/0/0 extensive user@host>show interfaces pp0 extensive

ADSL interface modules have LEDs that show sync and traffic status. For more information, see http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/reference/specifications/mini-pim-adsl2-srx-series-leds.html.

Purpose:

Implementation

Related Links:

Configure J-Series/SRX for dual ISP without dynamic routing protocols

未分类 No Responses »

11 月 072014

Summary:

This article contains a sample configuration for J-Series and SRX Branch with dual ISP connection. This will allow for ISP failover without dynamic routing protocols such as OSPF or BGP.

Problem or Goal:

Topology Assumptions Trust zone network is 192.168.1.0/24 on ge-0/0/0
DMZ zone network is 10.10.10.0/24 on ge-0/0/1

ISP1 zone network is 1.1.1.0/29 on fe-0/0/6
ISP2 zone network is 2.2.2.0/29 on fe-0/0/7

Note: ISP1 is in the default routing instance. ISP2 is in the ISP2 routing instance.

Requirements

Trust and DMZ zones should egress out ISP1 with source-nat.
If ISP1 interface goes down, then Trust and DMZ zones should egress out ISP2 instead with source-nat.
If ISP1 interface returns, then Trust and DMZ zones should revert back to using ISP1 again.
ISP1 must allow destination NAT for web server in Trust zone and mail server in DMZ zone.
ISP2 also has destination NAT for same web and mail servers.
When both ISPs are up, destination NAT addresses should be available from both ISPs for both web and mail servers.

Cause:

Solution:

This is possible using a combination of multiple routing-instance with filter-based forwarding and qualified-next-hop on the default route. Below is a sample working configurations for above scenario.

interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address 192.168.1.254/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family inet {
                address 10.10.10.254/24;
            }
        }
    }
    fe-0/0/6 {
        unit 0 {
            family inet {
                filter {
                    input isp1-in;
                }
                address 1.1.1.2/29;
            }
        }
    }
    fe-0/0/7 {
        unit 0 {
            family inet {
                filter {
                    input isp2-in;
                }
                address 2.2.2.2/29;
            }
        }
    }
}
routing-options {
    interface-routes {
        rib-group inet inside;
    }
    static {
        route 0.0.0.0/0 {
            next-hop 1.1.1.1;
            qualified-next-hop 2.2.2.1 {
                preference 10;
            }
        }
    }
    rib-groups {
        inside {
            import-rib [ inet.0 TRUST-VRF.inet.0 INSIDE.inet.0 ISP2.inet.0 ];
        }
    }
}
security {
    nat {
        source {
            rule-set interface-nat-out {
                from routing-instance INSIDE;
                to routing-instance [ ISP2 default ];
                rule interface-nat-out {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
        destination {
            pool web-server-trust {
                address 192.168.1.5/32 port 80;
            }
            pool mail-server-dmz {
                address 10.10.10.5/32 port 25;
            }
            rule-set isp1-to-trust {
                from interface fe-0/0/6.0;
                rule isp1-http-in {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 1.1.1.5/32;
                        destination-port 80;
                    }
                    then {
                        destination-nat pool web-server-trust;
                    }
                }
                rule isp1-mail-in {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 1.1.1.5/32;
                        destination-port 25;
                    }
                    then {
                        destination-nat pool mail-server-dmz;
                    }
                }
            }
            rule-set isp2-to-dmz {
                from interface fe-0/0/7.0;
                rule isp2-http-in {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 2.2.2.5/32;
                        destination-port 80;
                    }
                    then {
                        destination-nat pool web-server-trust;
                    }
                }
                rule isp2-mail-in {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 2.2.2.5/32;
                        destination-port 25;
                    }
                    then {
                        destination-nat pool mail-server-dmz;
                    }
                }
            }
        }
        proxy-arp {
            interface fe-0/0/6.0 {
                address {
                    1.1.1.5/32;
                }
            }
            interface fe-0/0/7.0 {
                address {
                    2.2.2.5/32;
                }
            }
        }
    }
    zones {
        security-zone trust {
            address-book {
                address web-server 192.168.1.5/32;
            }
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                    }
                }
            }
        }
        security-zone dmz {
            address-book {
                address mail-server 10.10.10.5/32;
            }
            interfaces {
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                    }
                }
            }
        }
        security-zone isp1 {
            interfaces {
                fe-0/0/6.0 {
                    host-inbound-traffic {
                        system-services {
                            ssh;
                            https;
                            ping;
                        }
                    }
                }
            }
        }
        security-zone isp2 {
            interfaces {
                fe-0/0/7.0 {
                    host-inbound-traffic {
                        system-services {
                            ssh;
                            https;
                            ping;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone dmz {
            policy allow-trust-to-dmz {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone isp1 {
            policy allow-trust-out-isp1 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone isp2 {
            policy allow-trust-out-isp2 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone dmz to-zone trust {
            policy allow-dmz-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone dmz to-zone isp1 {
            policy allow-dmz-out-isp1 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone dmz to-zone isp2 {
            policy allow-dmz-out-isp2 {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone isp1 to-zone trust {
            policy isp1-http-incoming {
                match {
                    source-address any;
                    destination-address web-server;
                    application junos-http;
                }
                then {
                    permit;
                }
            }
        }
        from-zone isp1 to-zone dmz {
            policy isp1-mail-incoming {
                match {
                    source-address any;
                    destination-address mail-server;
                    application junos-mail;
                }
                then {
                    permit;
                }
            }
        }
        from-zone isp2 to-zone trust {
            policy isp2-http-incoming {
                match {
                    source-address any;
                    destination-address web-server;
                    application junos-http;
                }
                then {
                    permit;
                }
            }
        }
        from-zone isp2 to-zone dmz {
            policy isp2-mail-incoming {
                match {
                    source-address any;
                    destination-address mail-server;
                    application junos-mail;
                }
                then {
                    permit;
                }
            }
        }
    }
}
firewall {
    filter isp1-in {
        term 1 {
            from {
                destination-address {
                    1.1.1.0/29;
                }
            }
            then {
                routing-instance TRUST-VRF;
            }
        }
        term 2 {
            then {
                accept;
            }
        }
    }
    filter isp2-in {
        term 1 {
            from {
                destination-address {
                    2.2.2.0/29;
                }
            }
            then {
                routing-instance TRUST-VRF;
            }
        }
        term 2 {
            then {
                accept;
            }
        }
    }
}
routing-instances {
    TRUST-VRF {
        instance-type forwarding;
        routing-options {
            static {
                route 192.168.1.0/24 next-hop 192.168.1.1;
                route 10.10.10.0/24 next-hop 10.10.10.1;
            }
        }
    }
    INSIDE {
        instance-type virtual-router;
        interface ge-0/0/0.0;
        interface ge-0/0/1.0;
        routing-options {
            interface-routes {
                rib-group inet inside;
            }
            static {
                route 0.0.0.0/0 next-table inet.0;
            }
        }
    }
    ISP2 {
        instance-type virtual-router;
        interface fe-0/0/7.0;
        routing-options {
            interface-routes {
                rib-group inet inside;
            }
            static {
                route 0.0.0.0/0 {
                    next-hop 2.2.2.1;
                    qualified-next-hop 1.1.1.1 {
                        preference 10;
                    }
                }
            }
        }
    }
}

Dynamic VPN对访问J-Web的影响

未分类 No Responses »

11 月 072014

SRX240开启Dynamic VPN后无法访问J-Web的处理

目的：保持J-Web和Dynamic VPN使用独立的物理接口

访问http://192.168.192.1/或https://192.168.192.1/都自动跳转到https://192.168.192.1/dynamic-vpn/index.php

username@SRX240H2# show system services
ssh;
telnet;
xnm-clear-text;
web-management {
    http {
        interface [ vlan.0 vlan.1 vlan.2 ];
    }
    https {
        system-generated-certificate;
    }
}
dhcp {
    router {
        192.168.192.1;
    }
    pool 192.168.192.0/22 {
        address-range low 192.168.192.10 high 192.168.192.19;
    }
    propagate-settings ge-0/0/0.0;
}

[edit]
username@SRX240H2#

修改

set system services web-management management-url <path>

set system services web-management management-url consle

username@SRX240H2# show system services
ssh;
telnet;
xnm-clear-text;
web-management {
    management-url console;
    http {
        interface [ vlan.0 vlan.1 vlan.2 ];
    }
    https {
        system-generated-certificate;
    }
}
dhcp {
    router {
        192.168.192.1;
    }
    pool 192.168.192.0/22 {
        address-range low 192.168.192.10 high 192.168.192.19;
    }
    propagate-settings ge-0/0/0.0;
}

[edit]
username@SRX240H2#

火狐浏览器无法正常显示页面
juniper-srx240h2-jweb-dynamic-vpn-01

http://kb.juniper.net/InfoCenter/index?page=content&id=KB19411

Juniper SRX240H2 Source NAT配置

未分类 No Responses »

11 月 052014

默认SNAT规则

username@SRX240H2# show security nat source
rule-set trust-to-untrust {
    from zone trust;
    to zone untrust;
    rule source-nat-rule {
        match {
            source-address 0.0.0.0/0;
        }
        then {
            source-nat {
                interface;
            }
        }
    }
}

新增SNAT规则（内网主机访问外网使用IP地址
新增地址池

pool SNAT_100_165 {
    address {
        113.106.100.165/32;
    }
}

新增规则

    rule single-ip-nat {
        match {
            source-address 192.168.153.110/22;
        }
        then {
            source-nat {
                pool {
                    SNAT_100_165;
                }
            }
        }
    }

调整SNAT规则顺序

username@SRX240H2# insert rule single-ip-nat before rule source-nat-rule

查看SNAT配置

username@SRX240H2# show security nat source
pool SNAT_100_165 {
    address {
        113.106.100.165/32;
    }
}
rule-set trust-to-untrust {
    from zone trust;
    to zone untrust;
    rule single-ip-nat {
        match {
            source-address 192.168.153.110/22;
        }
        then {
            source-nat {
                pool {
                    SNAT_100_165;
                }
            }
        }
    }
    rule source-nat-rule {
        match {
            source-address 0.0.0.0/0;
        }
        then {
            source-nat {
                interface;
            }
        }
    }
}

查看和验证

username@SRX240H2# run show security nat source summary
Total port number usage for port translation pool: 645120
Maximum port number for port translation pool: 67108864
Total pools: 10
Pool                 Address                  Routing              PAT  Total
Name                 Range                    Instance                  Address
SNAT_100_165         113.106.100.165-113.106.100.165 default           yes  1
SNAT_100_164         113.106.100.164-113.106.100.164 default           yes  1
SNAT_100_196         113.106.100.196-113.106.100.196 default           yes  1
SNAT_100_197         113.106.100.197-113.106.100.197 default           yes  1
SNAT_100_198         113.106.100.198-113.106.100.198 default           yes  1
SNAT_100_199         113.106.100.199-113.106.100.199 default           yes  1
SNAT_100_200         113.106.100.200-113.106.100.200 default           yes  1
SNAT_100_201         113.106.100.201-113.106.100.201 default           yes  1
SNAT_100_202         113.106.100.202-113.106.100.202 default           yes  1
SNAT_100_203         113.106.100.203-113.106.100.203 default           yes  1

Total rules: 2
Rule name          Rule set       From              To                   Action
single-ip-nat      trust-to-untrust trust           untrust              SNAT_100_165
source-nat-rule    trust-to-untrust trust           untrust              interface

[edit]
username@SRX240H2#

Juniper SRX240H2 Dynamic VPN 配置

未分类 No Responses »

11 月 032014

Juniper SRX240H2 JunOS 11.4R7.5

Configuring the Remote User Authentication and Address Assignment

1,Create the address assignment pool.

[edit access address-assignment]
user@host# set pool dyn-vpn-address-pool family inet network 10.10.10.0/24
user@host# set pool dyn-vpn-address-pool family inet xauth-attributes primary-dns 4.2.2.2/32

2,Configure the XAuth profile.

[edit access]
user@host# set profile dyn-vpn-access-profile client client1 firewall-user password "$9$uY4o0EyMWxdwgX7"
user@host# set profile dyn-vpn-access-profile client client2 firewall-user password "$9$neNM9CuB1hyrv5Q39"
user@host# set profile dyn-vpn-access-profile address-assignment pool dyn-vpn-address-pool

3,Configure Web authentication using the XAuth profile.

[edit access firewall-authentication]
user@host# set web-authentication default-profile dyn-vpn-access-profile

Configuring the VPN Tunnel

1,Configure the IKE policy.

[edit security ike]
user@host# set policy ike-dyn-vpn-policy mode aggressive
user@host# set policy ike-dyn-vpn-policy proposal-set standard
user@host# set policy ike-dyn-vpn-policy pre-shared-key ascii-text "$9$KHxWXNs2aikPdbkP5Q9CKM8"

2,Configure the IKE gateway.

[edit security ike]
user@host# set gateway dyn-vpn-local-gw ike-policy ike-dyn-vpn-policy
user@host# set gateway dyn-vpn-local-gw dynamic hostname dynvpn
user@host# set gateway dyn-vpn-local-gw dynamic ike-user-type group-ike-id
user@host# set gateway dyn-vpn-local-gw dynamic connections-limit 10
user@host# set gateway dyn-vpn-local-gw external-interface ge-0/0/15.0
user@host# set gateway dyn-vpn-local-gw xauth access-profile dyn-vpn-access-profile

3,Configure IPsec.

[edit security ipsec]
user@host# set policy ipsec-dyn-vpn-policy proposal-set standard
user@host# set vpn dyn-vpn ike gateway dyn-vpn-local-gw
user@host# set vpn dyn-vpn ike ipsec-policy ipsec-dyn-vpn-policy

4,Configure the security policy.

[edit security policies from-zone untrust to-zone trust]
user@host# set policy dyn-vpn-policy match source-address any destination-address any application any
user@host# set policy dyn-vpn-policy then permit tunnel ipsec-vpn dyn-vpn

5,Configure host inbound traffic.(https ike)

[edit security zones security-zone untrust interfaces ge-0/0/15.0]
user@host# set host-inbound-traffic system-services ike
user@host# set host-inbound-traffic system-services https
user@host# set host-inbound-traffic system-services ping
user@host# set host-inbound-traffic system-services ssh

Associate the Dynamic VPN with Remote Clients

1,Specify the access profile to use with dynamic VPN.

[edit security dynamic-vpn]
user@host# set access-profile dyn-vpn-access-profile

2,Configure the clients who can use the dynamic VPN.

[edit security dynamic-vpn]
user@host# set clients all ipsec-vpn dyn-vpn
user@host# set clients all user client1
user@host# set clients all user client2
user@host# set clients all remote-protected-resources 10.0.0.0/8
user@host# set clients all remote-exceptions 0.0.0.0/0

juniper-srx240h2-dynamic-vpn-01