IP Sec aggressive mode between Huawei AR161FGW-L and Juniper SRX100

chenhui · Created Sep 27, 2019 01:19:50

@Jackan hello,
Here is an example for IPSec VPN between Juniper SRX220 and Huawei USG firewall, https://forum.huawei.com/enterprise/en/ipsec-vpn-establishment-between-juniper-firewall-huawei-firewall/thread/560043-867

for the Juniper configuration, you can refer to the example.

for the Huawei USG firewall configuration, I translates it to the AR configuration, please check below,

tips: Please modify the parameters beased on you own network.

  ike proposal 10
  encryption-algorithm aes-256
  dh group14
  prf sha2-256
  integrity-algorithm hmac-sha2-384
  sa duration 86400

  ipsec proposal 10
  encapsulation-mode tunnel
  esp encryption-algorithm aes-256
  esp authentication-algorithm sha2-256

  ike peer 10 v1
  pre-shared-key cipher YOUR_PASSWORD
  local-address 10.10.10.47
  remote-address 10.10.10.254
  local-id-type ip
  exchange-mode main

  acl 2001
  rule 5 permit source 192.168.1.0 0.0.0.255

  ipsec policy 10 10 isakmp
  ike-peer 10
  proposal 10
  security acl 2001

ster · Created Sep 26, 2019 14:57:50

Hi friend
You can refer to configuration Procedure for Connecting Huawei USG6300 Series Firewalls to Juniper Firewalls IPSec VPN (Web)

chenhui · Created Sep 27, 2019 01:19:50

@Jackan hello,
Here is an example for IPSec VPN between Juniper SRX220 and Huawei USG firewall, https://forum.huawei.com/enterprise/en/ipsec-vpn-establishment-between-juniper-firewall-huawei-firewall/thread/560043-867

for the Juniper configuration, you can refer to the example.

for the Huawei USG firewall configuration, I translates it to the AR configuration, please check below,

tips: Please modify the parameters beased on you own network.

  ike proposal 10
  encryption-algorithm aes-256
  dh group14
  prf sha2-256
  integrity-algorithm hmac-sha2-384
  sa duration 86400

  ipsec proposal 10
  encapsulation-mode tunnel
  esp encryption-algorithm aes-256
  esp authentication-algorithm sha2-256

  ike peer 10 v1
  pre-shared-key cipher YOUR_PASSWORD
  local-address 10.10.10.47
  remote-address 10.10.10.254
  local-id-type ip
  exchange-mode main

  acl 2001
  rule 5 permit source 192.168.1.0 0.0.0.255

  ipsec policy 10 10 isakmp
  ike-peer 10
  proposal 10
  security acl 2001

Popeye_Wang · Created Sep 27, 2019 01:20:57

I do not know the configuration of juniper, but the aggressive mode on Huawei devices is not mandatory. And the NAT traversal function must be configured.

Example for Establishing an IPSec Tunnel Through NAT Traversal

firdouslodhi · Created Sep 30, 2019 04:25:39

Hi,

Juniper end configuration:

https://www.fir3net.com/Firewalls/Juniper/srx-dyn.html

IP Sec aggressive mode between Huawei AR161FGW-L and Juniper SRX100

Recommended answer

Third Party’s Trade Secret

`@trans`bright_future`~trans`

My Followers

Enterprise

Consumer

Corporate

Carriers

IP Sec aggressive mode between Huawei AR161FGW-L and Juniper SRX100

Recommended answer

Third Party’s Trade Secret

`@trans`bright_future`~trans`

My Followers