You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/magic-wan/configuration/manually/third-party/juniper.mdx
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ This section of the document will cover the configuration of:
34
34
- The IP addresses used for the Interface address must be a unique RFC1918 address (`/31` or `/30`).
35
35
- The **Customer endpoint** is the same IP specified for the first tunnel.
36
36
- The **Cloudflare Endpoint** for the second tunnel will be the second Cloudflare anycast IP provisioned for your account.
37
-
3. Select **Add tunnels**. We also recommend selecting **Test Tunnels** to ensure that the settings do not conflict with any other tunnels defined in your account and that the correct Anycast IP addresses are specified.
37
+
3. Select **Add tunnels**. We also recommend selecting **Test Tunnels** to ensure that the settings do not conflict with any other tunnels defined in your account and that the correct anycast IP addresses are specified.
38
38
4. Because we chose to add a pre-shared key at a later stage, you will see a warning indicator next to the tunnel names after creating them. This is expected behavior and indicates there is no pre-shared key associated with the tunnel.
39
39
5. Select **Edit** next to one of the tunnels to generate a pre-shared key.
40
40
6. Select **Generate a new pre-shared key** > **Update and generate a pre-shared key**. Make note of the pre-shared key and store it somewhere safe.
@@ -79,7 +79,7 @@ The following elements will be configured on the Juniper SRX firewall(s):
79
79
- Assign tunnel interfaces to a security zone
80
80
- Allow required protocols to both the tunnel and untrust security zones
81
81
- IKE configuration
82
-
-IPSec configuration
82
+
-IPsec configuration
83
83
- Static routes
84
84
- Security policies
85
85
@@ -110,7 +110,7 @@ unit 1 {
110
110
}
111
111
```
112
112
113
-
### Security Zone (cloudflare) - tunnel interfaces
113
+
### Security Zone (Cloudflare) - tunnel interfaces
114
114
115
115
Define a security zone and add both tunnel interfaces to it. At a minimum, the interfaces should allow ping, but this zone only contains point-to-point connections between the firewall and the customer network namespace. Setting it to `all` for system-services and protocols should be fine.
116
116
@@ -188,7 +188,7 @@ set security ike proposal cf_ike_magic_wan_prop lifetime-seconds 28800
188
188
189
189
#### IKE policies
190
190
191
-
Define two IKE policies — one for each of the two Magic IPSec tunnels:
191
+
Define two IKE policies — one for each of the two Magic IPsec tunnels:
192
192
193
193
**Tunnel 1 (SRX220_IPSEC_01)**
194
194
@@ -230,11 +230,11 @@ set security ike gateway cf_magic_wan_gw_02 external-interface ge-0/0/2.0
230
230
set security ike gateway cf_magic_wan_gw_02 version v2-only
231
231
```
232
232
233
-
### Phase 2 - IPSec
233
+
### Phase 2 - IPsec
234
234
235
235
#### IPsec proposal
236
236
237
-
Add an IPSec proposal that specifies the [Phase 2 Configuration Parameters](/magic-wan/reference/tunnels/#supported-configuration-parameters):
237
+
Add an IPsec proposal that specifies the [Phase 2 Configuration Parameters](/magic-wan/reference/tunnels/#supported-configuration-parameters):
238
238
239
239
```txt
240
240
set security ipsec proposal cf_ipsec_magic_wan_prop authentication-algorithm hmac-sha-256-128
Define two IPsec policies — one for each of the two Magic IPSec tunnels. It is crucial to ensure that:
247
+
Define two IPsec policies — one for each of the two Magic IPsec tunnels. It is crucial to ensure that:
248
248
249
249
-[Anti-replay](/magic-wan/reference/anti-replay-protection/) protection is disabled.
250
250
- Use [`no-anti-replay`](https://www.juniper.net/documentation/us/en/software/junos/interfaces-adaptive-services/topics/ref/statement/no-anti-replay-edit-services.html) as the setting
@@ -317,7 +317,7 @@ Define security policies to permit traffic flows destined for Magic WAN protecte
317
317
318
318
There are two very simple rules to allow traffic bidirectionally — it is generally recommended to start with a similar policy, then to add more stringent rules once general connectivity is established successfully.
319
319
320
-
**From *cloudflare* to *trust*:**
320
+
**From Cloudflare to *trust*:**
321
321
322
322
```txt
323
323
set security policies from-zone cloudflare to-zone trust policy cloudflare_to_trust match source-address any
0 commit comments