Juniper SSG VPN with FIPS

Time for my tale of configuring a pair of Juniper SSG routers to use FIPS mode and create a point to point VPN. (see my other post for the background for this)

First, I found a good resource and you should get it also:

Concepts & Examples ScreenOS Reference Guide
Volume 5: Virtual Private Networks
Release 6.1.0, Rev. 01
Chapter 4: Site-to-Site Virtual Private Networks
“Route-Based Site-to-Site VPN, AutoKey IKE” on page 96

NOTE ScreenOS 5.4.0r4 is the only version FIPS certified. ScreenOS 6.1 supports FIPS mode, but has not been tested by NIST.

You must use a console cable to configure the routers. FIBS mode disables Telnet and HTTP management.

To keep this post short and readable, I’ll have to ask you to refer the the “Route-Based Site-to-Site VPN, AutoKey IKE” on page 96 of the resource I listed above.

The first order of business is to upgrade or downgrade the ScreenOS if desired. Use a tftp server to load the ScreenOS.

Next, the FIPS mode must do a checksum on the ScreenOS on boot up, so you must install the Authentication Certificate from to the router using a tftp server.
save image-key tftp tftp_srv_ip_addr imagekey.cer from bgroup0

Then enable FIPS mode
set FIPS-mode enable

The device will reboot and erase the configuration.

Configure the basic administration and interface information. Change the admin account’s name and password. The FIPS password must have Upper, Lower, Number and Punctuation.

The most important part is configuring VPN with a Preshared Key.
First, we have to define our own phase 1 group because FIPS-mode deleted them (it requires a more stringent phase 1) Use Group5 , ESP, Tripple DES, and SHA-1
set ike p1-proposal pre-g5-esp-3des-sha-1 group5 esp 3des sha-1

Assign the Phase One to the remote gateway. Put in your remote gateway’s IP address. h1p8A24nG5 is my preshared key. This is a long command.
set ike gateway To_Remote address remote_ip_addr main outgoing-interface ethernet0/0 preshare h1p8A24nG5 proposal pre-g5-esp-3des-sha-1

Next, the phase 2 group
set ike p2-proposal g5-esp-3des-sha-1 group5 esp 3des sha-1

Set the VPN tunnel with our phase two and bind
set vpn New_Tunnel gateway To_Remote proposal g5-esp-3des-sha-1 set vpn New_Tunnel bind interface tunnel.1

Define the IP address at the end of the tunnel (1.0 is local, 2.0 is remote)
set vpn New_Tunnel proxy-id local-ip remote-ip any

Setup a route to the other network
set vrouter trust-vr route interface tunnel.1

Define names for your LANs
set address “Trust” Local_LAN
set address “Untrust” Remote_Office

And then setup policies to allow the traffic. (these are 2 lines)
set policy top name “To Remote” from “Trust” to “Untrust” Local_LAN Remote_Office any permit
set policy top name “From Remote” from “Untrust” to “Trust” Remote_Office Local_LAN any permit


This should help you get a VPN tunnel setup on your FIPS mode Juniper. If you have any questions, leave a comment, and I’ll get back with you.

Happy networking!

Leave a comment

Your email address will not be published. Required fields are marked *