SRX

last person joined: 13 hours ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  differences of SRX VPN flavors "route base and policy base"

    Posted 07-21-2011 03:28

    hi experts,

    This question may addressed many times on different forum, however am asking again Smiley Indifferent

     

    Really looking for some brief notes on the difference and implantation of both types of VPN flavor, route-base and policy-base

     

    any help would be highly appreciated

     

    alex



  • 2.  RE: differences of SRX VPN flavors "route base and policy base"
    Best Answer

    Posted 07-21-2011 03:51
      |   view attached

    please find below snaps of some major differences between route-base and policy-base, hope it will help clearing the concepts.

    vpn-1.PNG

     

    vpn-2.PNG

     

    also, find attached pdf.

     

    more folks can chip-in more clarification into this thread.

     

    thanks

    raheel

     

     

    Attachment(s)

    pdf
    route-base-vpns-srx.pdf   1.24 MB 1 version


  • 3.  RE: differences of SRX VPN flavors "route base and policy base"

    Posted 07-21-2011 05:24

    Hi Alex,

     

    Raheel's document has a good side-by-side comparison of the two methods, but from in-the-field experience:

     

    I find route-based VPNs to be much more flexible and overall easier to manage than policy-based.

     

    Route-based VPNs use a logical tunnel interface st0.x which you can point routes at to direct traffic, or even run dynamic routing protocols across.  If you're comfortable with routing in Junos, this makes it VERY easy to direct and troubleshoot traffic flows.

     

    Because you have a dedicated logical interface for traffic, it also means you can place it in a dedicated VPN security-zone and add as many security policies as you need to the interface on-th-fly.

     

    Conversely, traffic traversing a policy-based VPN needs to be matched in a single policy, and this match occurs after a routing-decision has been made.  Simply put - if you have multiple non-contiguous subnets at your remote site (eg: you would need multiple policies to match all allowed traffic), then you need to build individual tunnels for each of them.

     

    If you come from a Cisco background, policy-based VPNs are similar to using crypto-map in that the policy/ACL matches "interesting traffic" and tunnels it, however Junos only allows a single subnet match per tunnel.

     

    Juniper generally recommend policy-based VPNs when you require interoperability with other vendors equipment, however I've managed to get tunnels to Cisco ASA PIX & IOS, Checkpoint and Watchguard working all while using route-based configurations with no issues (hint: manual proxy-ids will solve almost every issue).

     

     Hope this helps.



  • 4.  RE: differences of SRX VPN flavors "route base and policy base"

    Posted 07-30-2011 03:06

    thank you Raheel and dfex.