## Last changed: 2011-02-07 11:53:41 GMT+8 version 10.4R1.9; system { host-name Kaga; domain-name linearo.dyndns.org; time-zone GMT+8; root-authentication { encrypted-password abc123; ## SECRET-DATA } name-server { 202.188.0.133; 202.188.1.5; } login { user gin { uid 100; class super-user; authentication { encrypted-password abc123; ## SECRET-DATA } } } services { ssh { root-login allow; } telnet; xnm-clear-text; web-management { http { interface [ ge-0/0/1.0 vlan.0 ge-0/0/5.0 ge-0/0/0.0 ]; } https { port 443; system-generated-certificate; interface [ vlan.0 ge-0/0/0.0 ]; } } dhcp { router { 192.168.1.1; } propagate-settings ge-0/0/0.0; } } syslog { archive size 100k files 3; user * { any emergency; } host 192.1.1.2 { any any; } file messages { any critical; authorization info; } file interactive-commands { interactive-commands error; } } max-configurations-on-flash 5; max-configuration-rollbacks 5; license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } } interfaces { ge-0/0/0 { unit 0 { description "External Interface"; family inet { address 192.1.1.8/24; } } } ge-0/0/1 { unit 0 { description "Internal Interface"; family ethernet-switching { port-mode access; vlan { members vlan-trust; } } } } ge-0/0/2 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/3 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/4 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/5 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/6 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/7 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/8 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/9 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/10 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/11 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/12 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/13 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/14 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/15 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } lo0 { unit 0 { family inet { address 127.0.0.1/32; } } } vlan { unit 0 { family inet { address 192.168.88.101/24; } } } } routing-options { static { route 0.0.0.0/0 next-hop [ 192.1.1.1 ]; } } protocols { stp; } security { ike { proposal ike-dyn-vpn-phase1 { authentication-method pre-shared-keys; dh-group group2; authentication-algorithm sha1; encryption-algorithm aes-256-cbc; lifetime-seconds 28800; } policy ike-dyn-vpn-policy { mode aggressive; proposals ike-dyn-vpn-phase1; pre-shared-key ascii-text abc123; ## SECRET-DATA } policy ike_pol_wizard_dyn_vpn { mode aggressive; proposal-set standard; pre-shared-key ascii-text abc123; ## SECRET-DATA } gateway dyn-vpn-local-gw { ike-policy ike-dyn-vpn-policy; dynamic { hostname linearo.dyndns.org; connections-limit 10; ike-user-type group-ike-id; } nat-keepalive 5; external-interface ge-0/0/0.0; xauth access-profile dyn-vpn-access-profile; } gateway gw_wizard_dyn_vpn { ike-policy ike_pol_wizard_dyn_vpn; dynamic { hostname linearo.dyndns.org; connections-limit 50; ike-user-type group-ike-id; } nat-keepalive 5; external-interface ge-0/0/0.0; xauth access-profile remote_access_profile; } } ipsec { proposal ipsec-dynvpn-phase2 { protocol esp; authentication-algorithm hmac-sha1-96; encryption-algorithm aes-256-cbc; lifetime-seconds 3600; } policy ipsec-dyn-vpn-policy { proposals ipsec-dynvpn-phase2; } policy ipsec_pol_wizard_dyn_vpn { perfect-forward-secrecy { keys group2; } proposal-set standard; } vpn dyn-vpn { ike { gateway dyn-vpn-local-gw; ipsec-policy ipsec-dyn-vpn-policy; } } vpn wizard_dyn_vpn { ike { gateway gw_wizard_dyn_vpn; ipsec-policy ipsec_pol_wizard_dyn_vpn; } } } nat { source { address-persistent; rule-set interface-nat { from zone trust; to zone untrust; rule rule1 { match { source-address [ 192.168.1.0/24 192.168.88.0/24 ]; destination-address 0.0.0.0/0; } then { source-nat { interface; } } } } } destination { pool remoteDesktop { address 192.168.88.34/32 port 3389; } rule-set RemoteDesktop { from interface ge-0/0/0.0; rule RD-rule { match { source-address 0.0.0.0/0; destination-address 192.168.88.34/32; destination-port 3389; } then { destination-nat pool remoteDesktop; } } } } proxy-arp { interface ge-0/0/0.0 { address { 219.95.248.245/32; 192.1.1.1/32; } } interface ge-0/0/1.0 { address { 192.168.1.1/24; 192.168.88.1/24 to 192.168.88.254/24; } } } } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; timeout 20; } land; } } } zones { security-zone trust { address-book { address Internal 192.168.88.0/24; } host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { vlan.0; ge-0/0/1.0; } } security-zone untrust { screen untrust-screen; interfaces { ge-0/0/0.0 { host-inbound-traffic { system-services { tftp; http; https; ike; } } } } } } policies { from-zone trust to-zone untrust { policy permit-all { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone untrust to-zone trust { policy dyn-vpn-policy { match { source-address any; destination-address any; application any; } then { permit { tunnel { ipsec-vpn dyn-vpn; } } } } } from-zone trust to-zone trust { policy policy_in_wizard_dyn_vpn { match { source-address any; destination-address any; application any; } then { permit { tunnel { ipsec-vpn wizard_dyn_vpn; } } } } } } flow { traceoptions { file flow-debug; flag basic-datapath; packet-filter filter1 { source-prefix 192.168.2.1/32; destination-prefix 192.168.88.166/32; } packet-filter filter2 { source-prefix 192.168.88.166/32; destination-prefix 192.168.2.1/32; } } } dynamic-vpn { force-upgrade; access-profile dyn-vpn-access-profile; clients { all { remote-protected-resources { 192.168.1.0/24; 192.168.88.0/24; } remote-exceptions { 0.0.0.0/0; } ipsec-vpn dyn-vpn; user { vpn-user; } } wizard-dyn-group { remote-protected-resources { 192.168.88.0/24; } ipsec-vpn wizard_dyn_vpn; user { user1; user2; vpn1; } } dyn-vpn-access-profile { remote-protected-resources { 192.168.88.0/24; } remote-exceptions { 0.0.0.0/0; } ipsec-vpn dyn-vpn; user { vpn-user; } } } } } access { profile dyn-vpn-access-profile { client vpn-user { firewall-user { password abc123; ## SECRET-DATA } } address-assignment { pool dyn-vpn-address-pool; } } profile remote_access_profile { client user1 { firewall-user { password abc123; ## SECRET-DATA } } client user2 { firewall-user { password abc123; ## SECRET-DATA } } client vpn1 { firewall-user { password abc123; ## SECRET-DATA } } address-assignment { pool dyn-vpn-address-pool; } } address-assignment { pool dyn-vpn-address-pool { family inet { network 192.168.2.0/24; xauth-attributes { primary-dns 202.188.0.133/32; } } } } firewall-authentication { pass-through { default-profile dyn-vpn-access-profile; } web-authentication { default-profile remote_access_profile; banner { success Welcome; } } } } wlan { cluster vlan-0-default { name juniper-ap-cluster; default-cluster; interfaces { vlan.0; } } } ethernet-switching-options { voip; } vlans { vlan-trust { vlan-id 3; l3-interface vlan.0; } }