{"id":3139,"date":"2012-11-25T02:50:04","date_gmt":"2012-11-25T02:50:04","guid":{"rendered":"http:\/\/blog.pmail.idv.tw\/?p=3139"},"modified":"2012-11-25T02:50:04","modified_gmt":"2012-11-25T02:50:04","slug":"fortigate-60b-juniper-netscreen25-%e5%bb%ba%e7%ab%8bsite-to-site-vpn-%e7%b4%80%e9%8c%84","status":"publish","type":"post","link":"https:\/\/blog.pmail.idv.tw\/?p=3139","title":{"rendered":"Fortigate 60B & Juniper Netscreen25 \u5efa\u7acbsite to site VPN \u7d00\u9304"},"content":{"rendered":"

 <\/p>\n

Fortigate 60B & Juniper Netscreen25 \u5efa\u7acbsite to site VPN \u7d00\u9304 <\/p>\n

\u53c3\u8003\u5b98\u65b9\u6587\u4ef6 <\/p>\n

FortiGate_to_Netscreen-204_IPSec_VPN_Interoperability_Technical_Note.pdf <\/p>\n

 <\/p>\n

<\/p>\n

\u7c21\u55ae\u7684\u67b6\u69cb\u5716 <\/p>\n

\"vpn23\"<\/a> <\/p>\n

\u74b0\u5883\u8aaa\u660e <\/p>\n

Fortigate 60B  <\/p>\n

OS \u7248\u672c :  v4.0,build0513,120130 (MR3 Patch 5)<\/strong> <\/p>\n

WAN1 IP :  a.a.a.a <\/p>\n

LANA  : 192.168.3.0\/24 <\/p>\n

Netscreen 25 <\/p>\n

OS\u7248\u672c : 5.3.0r2.0 (Firewall+VPN)<\/strong> <\/p>\n

Untrust IP : b.b.b.b <\/p>\n

Trust IP  : 192.168.4.0\/24 <\/p>\n

\u9054\u6210\u76ee\u7684 <\/p>\n

WAN1 \u8207 Uustrust \u505aVPN ,\u8b93LANA \u8207LANB \u53ef\u4ee5\u4e92\u901a <\/p>\n

———————————————————————————- <\/p>\n

Fortigate 60B \u8a2d\u5b9a <\/p>\n

1.\u5efa\u7acb\u65b0\u589e\u5169\u7aef\u5167\u90e8\u7db2\u6bb5\u7684\u7269\u4ef6 <\/p>\n

\u9632\u706b\u7246\u7269\u4ef6 —> \u4f4d\u5740 (\u5982\u4e0b\u5716) <\/p>\n

FG60B_NET <\/p>\n

\"vpn7\"<\/a> <\/p>\n

NS25_NET <\/p>\n

\"vpn8\"<\/a> <\/p>\n

2.\u5efa\u7acb IPSec Phase1<\/h5>\n

VPN —>IPsec —> Auto Key(IKE)   \u5efa\u7acb [Phase1]<\/p>\n

Name : \u81ea\u8a02\u540d\u7a31 (P1) <\/p>\n

     Remote Gateway (\u9060\u7a0b\u7db2\u8def\u9598) :  \u9078 Static IP Address <\/p>\n

     IP Address :  \u8a2d\u5b9a NetScreen 255  Untrust\u7684IP  b.b.b.b <\/p>\n

     Local Interface: \u8a2d\u5b9a\u8981\u8207Netscreen5xp \u505aVPN\u7684\u4ecb\u9762(\u6211\u662f\u7528WAN1) <\/p>\n

     Mode : Main <\/p>\n

     Authentication Method :  \u8a2d\u5b9a\u4f7f\u7528Preshared key <\/p>\n

     pre-share-key : \u8a2d\u5b9a\u4e00\u7d44key (FG60B\u8207NS25\u90fd\u9700\u8a2d\u5b9a\u4e00\u6a23) <\/p>\n

     P1 Proposal\uff1a\u52a0\u5bc6\u6f14\u7b97\u6cd5\u9078\u64c7 3DES<\/strong>\u3001\u8a8d\u8b49\u9078\u64c7 SH1<\/strong> <\/p>\n

     Phase1\u8a2d\u5b9a\u90e8\u4efd(\u5982\u4e0b\u5716) <\/p>\n

\"vpn9\"<\/a> <\/p>\n

3.\u5efa\u7acb IPSec Phase2<\/p>\n

Name\uff1a \u81ea\u8a02\u540d\u7a31 (P2)<\/p>\n

Phase1\uff1a \u9078\u64c7\u525b\u624d\u5efa\u7acb\u7684P1<\/p>\n

P2 proposal\uff1a\u52a0\u5bc6\u6f14\u7b97\u6cd5\u9078\u64c7 3DES<\/strong>\u3001\u8a8d\u8b49\u9078\u64c7 SH1<\/strong><\/p>\n

Phase2\u8a2d\u5b9a\u90e8\u4efd(\u5982\u4e0b\u5716) <\/p>\n

\"vpn10\"<\/a> <\/p>\n

4.\u5efa\u7acbpolicy <\/p>\n

\u5167\u5f80 To NS2\u7db2\u6bb5 <\/p>\n

Source Interface\/Zone : internal (FG60B LAN) <\/p>\n

Source Address :\u524d\u9762\u6b65\u9a5f\u8a2d\u5b9a\u7684\u7db2\u8def\u7269\u4ef6 ( FG60B_NET) <\/p>\n

Destination Interface\/Zone : wan1 <\/p>\n

Destination Address : NS25_NET <\/p>\n

Schedule :  always <\/p>\n

  service : any <\/p>\n

  Action : IPSEC <\/p>\n

  VPN Tunnel : \u9078\u524d\u9762Phase 1 \u7684\u540d\u7a31 p1 <\/p>\n

\u52fe\u9078  Allow inbound  Allow outbound <\/p>\n

\"vpn11\"<\/a> <\/p>\n

  <\/p>\n

NS25 \u8a2d\u5b9a <\/p>\n

\u5148\u8a2d\u5b9aIP\u7db2\u6bb5\u7269\u4ef6,\u5728WEB\u4ecb\u9762\u4e0a\u8a2d\u5b9a <\/p>\n

object \u2013> Address <\/p>\n

Untrust : FG60_NET (192.168.3.0\/24) <\/p>\n

\"vpn12\"<\/a> <\/p>\n

Trust : NS25_NET (192.168.4.0\/24) <\/p>\n

\"vpn13\"<\/a> <\/p>\n

\u5efa\u7acb Phase1 <\/p>\n

VPNs > AutoKey Advanced > Gateway <\/p>\n

Gateway Name : \u81ea\u5b9a (p1) <\/p>\n

Security Level : Custom <\/p>\n

Remote Gateway Type :  Static IP Address (\u5728\u6b64\u53f3\u908a\u5c07FG60B \u5c0d\u5916IP\u8a2d\u5b9a\u4e0a\u53bb) <\/p>\n

Preshared Key: \u8a2d\u5b9a\u8207FG60B\u76f8\u540c\u7684key <\/p>\n

\"vpn14\"<\/a> <\/p>\n

Advanced \u90e8\u5206: <\/p>\n

Phase 1 Proposal : \u9078 pre-g2-3des-sha , pre-g2-3des-md5  <\/p>\n

\u5176\u4ed6\u9810\u8a2d\u503c\u5373\u53ef <\/p>\n

\"vpn15\"<\/a> <\/p>\n

\u5efa\u7acb Phase2 <\/p>\n

    VPNs > AutoKey IKE <\/p>\n

\"vpn16\"<\/a> <\/p>\n

VPN Name  : (p2) <\/p>\n

  Security Level  : Custom <\/p>\n

  Remote Gateway  : \u9078 Predefined,\u53f3\u908a\u8a2d\u5b9ap1(\u4e0a\u9762\u6b65\u9a5f\u8a2d\u5b9a\u7684phase1) <\/p>\n

  Advanced \u90e8\u5206: <\/p>\n

Phase 2 Proposal : \u9078 g2-esp-des-md5 , g2-dsp-3des-md5 , g2-esp-3des-sha <\/p>\n

   \u52fe\u9078 Replay Protection  <\/p>\n

   Bind to \u9078 nono <\/p>\n

   \u52fe\u9078proxy ID <\/p>\n

\u8f38\u5165 <\/p>\n

Local IP \/ Netmask : 192.168.4.0\/24 <\/p>\n

Remote IP \/ Netmask : 192.168.3.0\/24 <\/p>\n

\u52fe\u9078 Optimized <\/p>\n

\"vpn17\"<\/a> <\/p>\n

\u5efa\u7acbpolicy <\/p>\n

Untrust To Trust :  <\/p>\n

Source Address: FG60B_NET <\/p>\n

Destination Address : NS25_NET <\/p>\n

Action : Tunnel  <\/p>\n

Tunnel  VPN : \u9078p2 <\/p>\n

\"vpn18\"<\/a> <\/p>\n

  <\/p>\n

Trust To Untrus <\/p>\n

Source Address: NS25_NET <\/p>\n

Destination Address : FG60B_NET <\/p>\n

Action : Tunnel  <\/p>\n

Tunnel  VPN : \u9078p2 <\/p>\n

\"vpn20\"<\/a> <\/p>\n

\u4ee5\u4e0a\u8a2d\u5b9a\u5b8c\u7562 <\/p>\n

\u7576VPN \u5efa\u7acb\u8d77\u4f86 \u53ef\u4ee5\u770b\u5230\u5982\u4e0b\u5716 <\/p>\n

\"vpn21\"<\/a> <\/p>\n

\"vpn22\"<\/a><\/p>\n

\n