Juniper SRX300 and Firebox BOVPN Virtual Interface Integration Guide

Deployment Overview

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.

This integration guide describes how to configure a BOVPN virtual interface between a WatchGuard Firebox and a Juniper® SRX300.

Topology

This diagram shows the topology for a BOVPN virtual interface connection between a Firebox and a Juniper SRX300.

Configure the Firebox

On the Firebox, configure a Branch Office VPN (BOVPN) virtual interface connection:

1. Log in to Fireware Web UI.
2. Select VPN > BOVPN Virtual Interfaces.
   The BOVPN Virtual Interfaces configuration page opens.
3. Click Add.
4. In the Interface Name text box, type a name to identify this BOVPN virtual interface.
5. From the Remote Endpoint Type drop-down list, select Cloud VPN or Third-Party Gateway.
6. From the Gateway Address Family drop-down list, select IPv4 Addresses.
7. In the Credential Method section, select Use Pre-Shared Key.
8. In the adjacent text box, type the pre-shared key.

8. In the Gateway Endpoint section, click Add.
   The Gateway Endpoint Settings dialog box opens.
9. From the Physical drop-down list, select External.
10. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
    The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
11. Select By IP Address.
12. In the adjacent text box, type the primary IP address of the External Firebox interface.

13. Select the Remote Gateway tab.
14. Select Static IP Address.
15. In the adjacent text box, type the public IP address of the ge-0/0/0.0 interface on the Juniper SRX300.
16. Select By IP Address.
17. In the adjacent text box, type the public IP address of the ge-0/0/0.0 interface on the Juniper SRX300.

18. Click OK.
19. In the Gateway Endpoint section, select Start Phase 1 tunnel when it is inactive.
20. Select Add this tunnel to the BOVPN-Allow policies.

21. Select the VPN Routes tab.

22. Click Add.
    The VPN Route Settings dialog box opens.
23. From the Choose Type drop-down list, select Network IPv4.
24. In the Route To text box, type the network IP address of the route that uses this virtual interface.

25. Click OK.
26. Select the Assign virtual interface IP addresses check box.
27. In the Local IP address and Peer IP address or netmask text boxes, type the virtual interface IP addresses.

28. Select the Phase 1 Settings tab.
29. From the Version drop-down list, select IKEv2.
30. Keep the default values for all other Phase 1 Settings.

31. Keep the default values for all Phase 2 Settings.

32. Click Save.

For more information about BOVPN virtual interface configuration on the Firebox, see BOVPN Virtual Interfaces.

Configure the Juniper SRX300

Follow these steps to configure the settings for your Juniper device.

Configure Basic Settings

1. Log in to the Juniper Web Device Manager at https://<IP address of the Juniper device>.
   The default IP address is https://192.168.1.1.
2. Configure the Juniper interfaces.
   For information on how to configure interfaces, see the Juniper documentation.

3. Configure the zones and bind the zones and interfaces. For information about how to configure zones, see the Juniper documentation.
   

4. Configure the global addresses. For information about how to configure global addresses, see the Juniper documentation.
   

5. Configure static routes. For information about how to configure static routes, see the Juniper documentation.

Configure IPSec VPN Phase 1 Settings

On your Juniper device:

1. Select Configure > Security Services > IPsec VPN > IKE (Phase I).
2. Select the Proposal tab.
3. Click +.
4. In Name text box, type a name for the proposal.
5. From the Authentication algorithm drop-down list, select sha-256.
6. From the Authentication Method drop-down list, select pre-shared-keys.
7. From the DH Group drop-down list, select group14.
8. From the Encryption algorithm drop-down list, select aes-256-cbc.
9. In the Lifetime seconds text box, type the number of seconds.

10. Click OK.
    The proposal appears in the list.

11. Select the IKE Policy tab.
12. Click +.
13. In the Name text box, type a name for the policy.
14. From the Mode drop-down list, select main.
15. Select User Defined.
16. From the Proposal List, select the proposal you created.

17. Select the IKE Policy Options tab.
18. Select Pre Shared Key.
19. Select Ascii text.
20. Type the pre-shared key.

21. Click OK.
    The policy appears in the list.

22. Select the Gateway tab.
23. Click +.
    The Add Gateway dialog box opens.
24. In the Name text box, type the Gateway name.
25. From the Policy drop-down list, select the policy you created.
26. From the External Interface drop-down list, select ge-0/0/0.0.
27. Select Site to Site VPN.
28. In the Remote Peer IP text box, type the IP address of the external Firebox interface. Click +.
29. From the Local Identity Type drop-down list, select IP Address.
30. In the IP Address text box, type the Juniper public IP address.
31. From the Remote Identity Type drop-down list, select IP Address.
32. In the IP Address text box, type the public IP address of Firebox.
33. From the IKE Version drop-down list, select v2-only.
34. Keep the default values for all other values.

35. Select the IKE Gateway Options tab.
36. Select the Dead Peer Detection check box.
37. Keep the default values for all other values.

38. Click OK.
    The gateway appears in the list.

1. To commit the changes, in the upper-right corner, click the button.
2. Click Commit.

Configure IPsec VPN Phase 2 Settings

On your Juniper device:

1. Select Configure > Security Services > IPsec VPN > IPsec (Phase II).
2. Select the Proposal tab.
3. Click +.
   The Add proposal dialog box opens.
4. In the Name text box, type the proposal name.
5. From the Authentication algorithm drop-down list, select hmac-sha-256-128.
6. From the Encryption algorithm drop-down list, select aes-256-cbc.
7. From the Protocol drop-down list, select esp.

8. Click OK.
   The proposal appears in the list.

9. Select the IPSec Policy tab.
10. Click +.
    The Add policy dialog box opens.
11. In the Name text box, type the policy name.
12. From the Perfect Forward Secrecy drop-down list, select group14.
13. Select User Defined.
14. For Proposal List, select the proposal you created.

15. Click OK.

16. Select the VPN tab.
17. Click +.
    The Add VPN dialog box opens.
18. In the VPN Name text box, type the VPN name.
19. From the Remote Gateway drop-down list, select GW-JUN-WG.
20. From the IPSec Policy drop-down list, select ipsec-phase2-policy.
21. From the Bind to tunnel interface drop-down list, select st0.0.
22. From the Establish tunnels drop-down list, select immediately.

23. Click OK.
    The VPN shows in the list.

24. To commit the changes, in the upper-right corner, click the button.
25. Click Commit.

Configure Security Policy Rules

On your Juniper device:

1. Select Configure > Security Services > Security Policy > Rules.
2. Click +.
   The Create Rule wizard opens.
3. In the Rule name text box, type the rule name (for example, policy-trust-vpn).
4. Click Next.
5. From the Zone drop-down list, select trust.
6. In the Address(es) text box, select Juniper_address.

7. Click Next.
8. From the Zone drop-down list, select VPN.
9. In the Address(es) text box, select WG_address.
10. In the Dynamic Application text box, select None.
11. In the Service(s) text box, select any.
12. In the URL Category text box, select None.

13. Click Next.
14. From the Rule Action drop-down list, select Permit.

15. Click Next.
16. Click Finish.
17. Click OK.
    The rule appears in the list.

18. To create another security policy, repeat steps 2 through 17.

19. To commit the changes, in the upper-right corner, click the button.
20. Click Commit.

Test the Integration

To test the integration, from Fireware Web UI:

1. Select System Status > VPN Statistics.
2. Select the Branch Office VPN tab.
3. Verify that the VPN is established.

4. Verify that Host 1 (behind the Firebox) and Host 2 (behind the Juniper SRX300) can successfully ping each other.