Digi Connect Series Guide de l'utilisateur

Digi Connect® Family Application Guide

How to Create a VPN between Digi and Juniper Netscreen

________________________________________________________________________

3/16/2009 Digi International 1 of 9

Scenario

Digi Connect family VPN router (for example ConnectPort WAN or Digi Connect WAN

IA) is used for remote site connectivity. Juniper Netscreen is used at the local site for

connectivity. The connection between the two networks needs to be secure for data

transmission.

Theory of Operation

A location needs to be able to build a secure tunnel between the main site and a remote

branch. One location has a Digi Connect router to provide primary internet connectivity.

The other location uses a Juniper Netscreen for primary internet connectivity. The Digi

Connect router will create a VPN tunnel to the Juniper Netscreen, creating a secure

connection.

Sample Diagram

Internet Cloud

WAN IP: 166.130.108.93

LAN IP: 192.168.1.1 WAN IP: 70.57.159.140

LAN IP: 172.16.1.98

PCs, PLCs, Servers, Etc.

Carrier Plan and VPN Appliance Requirements

Digi Connect Router Requirements: Firmware version must be 2.8 or later. To

download the latest firmware, go to http://www.digi.com/support.

GSM GPRS/EDGE APN Type needed: VPN and GRE end-points usually require static

(persistent) IP addresses and must support mobile terminated data connections. If mobile

termination is not an option with your current APN, you will need to acquire a new one

that does support mobile termination.

CDMA networks may also require special plans to provide static IP addresses and

support mobile terminated data connections.

Check with your wireless provider on the available plan types.

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 2 of 9

Digi Connect Router Configuration

1. Read and follow the quick-start guide for the Digi Connect router and optionally for

Digi Connectware® Manager if used.

2. Assign a static IP address to the Ethernet port (the default address is 192.168.1.1).

Note the default gateway may show or change to an address such as 10.6.6.6. This is

normal as it is the cellular provider‟s network default gateway.

3. Configure the Digi Connect router settings:

a. VPN Global Settings

i. Navigate to Configuration > Network > VPN Settings in the web

interface of the unit.

ii. Click on VPN Global Settings.

iii. Click the check box for Enable Antireplay.

iv. Click Apply to save the changes.

b. VPN Policy Settings

i. Click on VPN Policy Settings.

ii. Click on the Add button to setup the individual tunnel.

iii. Fill in the appropriate information, shown in the following

screenshots:

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 3 of 9

iv. Click Apply after filling in the above information to complete the

tunnel setup on the Digi Connect router.

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 4 of 9

Juniper Netscreen Configuration

1. Log into the Juniper Netscreen through its web interface.

2. Navigate to Objects > Addresses > List in the web interface. Select Untrust in the

upper left hand corner, and click New in the upper right hand corner.

3. Fill in your Remote Site information, as shown in the screenshot below:

4. Once this has been completed, click Ok to save the setting. You will then need to

switch the Untrust option to Trust and perform the same settings for the Local Site

information, as shown in the following screenshot:

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 5 of 9

5. Navigate to VPNs > AutoKey Advanced > Gateway:

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 6 of 9

6. Click New in the upper right hand corner and fill in the following information (shown

in the following screenshot):

a. Security Level –Custom

b. Remote Gateway Type –Can be static or dynamic. This example will use

static.

c. IP Address/Hostname –The mobile IP or hostname of the Digi gateway.

d. Peer ID –The ID that the Digi gateway is using.

e. Preshared Key

f. Local ID –The ID that the Juniper unit is using.

7. Click Advanced and fill in the following information (shown in the following

screenshot):

a. Phase 1 Proposal –pre-g2-3des-sha

b. Mode (Initiator) - Main

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 7 of 9

8. Click Return.

9. Click Ok.

10. Navigate to VPNs > AutoKey IKE and click New in the upper right hand corner to

get to the following screen:

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 8 of 9

11. Choose the Security Level of Custom.

12. Under Remote Gateway, choose the option of Predefined, and select the gateway that

was just setup. Click Advanced and fill in the following:

a. Phase 2 Proposal –g2-esp-3des-sha

b. Enable Replay Protection

c. Enable Proxy-ID

i. Local IP/Netmask –Local Subnet

ii. Remote IP/Netmask –Remote Subnet

13. Click Return.

14. Click Ok.

15. Navigate to Policies.

16. At the top of the page, under the From drop down box, select Trust. Under the To

drop down box, select Untrust. Add the following:

a. Source Address –Choose Address Book Entry and choose the local

subnet that was previously setup from the drop down list.

b. Destination Address –Choose Address Book Entry and choose the

remote subnet that was previously setup from the drop down list.

c. Action –Tunnel

d. Tunnel –Choose your VPN from the list

e. Check the box for “Modify matching bidirectional VPN policy” to

automatically setup the permissions for the opposite direction.

17. Click Ok.

Digi Connect Family Application Guide –Digi to Juniper Configuration

3/16/2009 Digi International 9 of 9

18. Move the newly created policy under the “From Trust To Untrust” section above the

policy that permits any traffic. If the VPN policy is below the „any‟ rule, it will not

pass traffic through the tunnel in that direction. You may need to move the same rule

under the “From Untrust To Trust” section, also.

ADDITIONAL NOTES

1. This configuration will work with Dynamic IP addresses, using hostnames

established with DynDNS.org, or using the DDNS update feature of Digi

Connectware® Manager. When using a Dynamic IP address, you will need to set the

VPN tunnel to use Aggressive Mode to make the connection work.

2. This configuration will work with other VPN parameters than what is listed in the

screenshots. i.e. –DES, 3DES, AES 192-bit, AES 256-bit, etc.

3. This configuration will work with other Digi Cellular products, such as the Connect

WAN, Connect WAN 3G, and ConnectPort WAN VPN series of products that

support VPN connections.

4. The Juniper screenshots may not reflect your specific model of Juniper VPN

appliance. You may need to adjust your settings to reflect newer Juniper firmware.

Where to Get More Information

Refer to the Digi Connect router user documentation and Digi technical support website

at www.digi.com/support for more information. Technical assistance is available at

http://www.digi.com/support/eservice/eservicelogin.jsp.

For sales and product information, please contact Digi International at 952-912-3444 or

refer to the Digi Connect wireless pages at www.digi.com.

Autres manuels pour Connect Series

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Digi Routeur réseau

Digi

Digi TA2020B Manuel utilisateur

Digi

Digi TransPort WR11 Manuel utilisateur

Digi

Digi WR44v1 Manuel utilisateur

Digi

Digi WR41v1 Manuel utilisateur

Digi

Digi Digi TransPort WR Manuel utilisateur

Digi

Digi Connect IT 4 Manuel utilisateur

Digi

Digi TransPort WR31 Manuel utilisateur

Digi

Digi Connect WAN Sync Edge 10 Manuel utilisateur

Digi

Digi TX54 Manuel utilisateur

Digi

Digi TransPort WR11 Manuel utilisateur

Digi

Digi TransPort WR44 R Manuel utilisateur

Digi

Digi TransPort LR54 Manuel utilisateur

Digi

Digi ConnectPort X2e ZB Manuel utilisateur

Digi

Digi TransPort WR21 Manuel utilisateur

Digi

Digi XLR PRO Manuel utilisateur

Digi

Digi TransPort Manuel utilisateur

Digi

Digi IX40 Manuel utilisateur

Digi

Digi TransPort WR11 Manuel utilisateur

Digi

Digi ConnectPort WAN GPS Manuel utilisateur

Digi

Digi CR4110 Manuel utilisateur

Digi

Digi TransPort LR54-AA401 Manuel utilisateur

Digi

Digi TransPort WR64 Guide d'application

Digi

Digi IX20-WAG4 Manuel utilisateur

Digi

Digi TransPort LR54 Manuel utilisateur

Manuels Routeur réseau populaires d'autres marques

Allnet

Allnet ALL0333AU Manuel utilisateur

HomeSeer

HomeSeer HT-SEL Manuel utilisateur

Sercomm

Sercomm Genesis OC3505D Manuel utilisateur

Billion

Billion BIPAC 5102 Series Manuel utilisateur

TP-Link

TP-Link TD-8817 Manuel utilisateur

Motorola

Motorola MR1900 Manuel utilisateur

Cisco

Cisco NCS 540 Manuel

XAVi

XAVi X8821e Manuel utilisateur

BEC

BEC 6200WZL Manuel utilisateur

MikroTik

MikroTik hAP ac3 Series Manuel utilisateur

Korenix

Korenix JetNet 5428G Series Manuel utilisateur

NETGEAR

NETGEAR FS526T - Switch Manuel utilisateur

Korenix

Korenix JetNet 5710G Series Manuel utilisateur

Automated Logic

Automated Logic ZN551 Manuel du propriétaire

Cisco

Cisco ASR 1000 Series Manuel de l'opérateur

EnGenius

EnGenius ESR-9710 Manuel utilisateur

Cisco

Cisco 805 Series Instructions d'utilisation et de sécurité

LevelOne

LevelOne FBR-1416 Manuel utilisateur