Summary:

Problem or Goal:

Cause:

Solution:
The basic configuration, along with an example, is as follows:

1. SRX configuration:
   

   root@# show security  
   ike {
       traceoptions {
           file iketrace;
           flag all;
       }
       proposal ike-prop1 {
           authentication-method pre-shared-keys;
           dh-group group2;
           authentication-algorithm sha1;
           encryption-algorithm aes-192-cbc;
           lifetime-seconds 28800;
       }
       policy ike-pol2 {
           mode aggressive;
           proposals ike-prop1;
           pre-shared-key ascii-text "$9$m5z6p0IreW9AeWLxwsP5QF9AuO1hyl"; ## SECRET-DATA
       }
       gateway remote-vpn1 {
           ike-policy ike-pol2;
           dynamic {
               user-at-hostname "user1@juniper.net";
               connections-limit 2;
               ike-user-type shared-ike-id;
           }
           external-interface ge-0/0/1;
           xauth access-profile xauth-prof1;
       }
   }
   ipsec {
       traceoptions {
           flag all;
       }
       proposal ipsec-prop1 {
           protocol esp;
           authentication-algorithm hmac-sha1-96;
           encryption-algorithm aes-128-cbc;
       }
       policy ipsec1-lab {
           perfect-forward-secrecy {
               keys group2;
           }
           proposals ipsec-prop1;
       }
       vpn remote-vpn1 {
           ike {
               gateway remote-vpn1;
               ipsec-policy ipsec1-lab;
           }
       }
   }
   policies {
       from-zone trust to-zone untrust {
           policy p1 {
               match {
                   source-address any;
                   destination-address any;
                   application any;
               }
               then {
                   permit {
                       tunnel {
                           ipsec-vpn remote-vpn1;
                       }
                   }
               }
           }
       }
   }
   zones {
       security-zone untrust {
           interfaces {
               ge-0/0/1.0 {
                   host-inbound-traffic {
                       system-services {
                           all;
                       }
                       protocols {
                           all;
                       }
                   }
               }
           }
       }
       security-zone trust {
           interfaces {
               ge-0/0/0.0 {
                   host-inbound-traffic {
                       system-services {
                           all;
                       }
                       protocols {
                           all;
                       }
                   }
               }
           }
       }
   }
   
   root@# show access 
   profile xauth-prof1 {
       authentication-order password;
       client michael {
           firewall-user {
               password "$9$wtYoGPfz6/tGDi.P56/EcylWL7-VY4a"; ## SECRET-DATA
           }
       }
       client test {
           firewall-user {
               password "$9$Cp8gpOIylMNdsEcds24DjCtuOEcrevL7-"; ## SECRET-DATA
           }
       }
       address-assignment {
           pool xauth-pool;
       }
   }
   address-assignment {
       pool xauth-pool {
           family inet {
               network 10.1.1.0/24;
               xauth-attributes {
                   primary-dns 4.2.2.2/32;
               }
           }
       }
   }

1.  Change the IP address of the gateway in the attached .ini file attached or via Connections > Profile > Edit > IPsec General Settings.
2.  Load the attached .ini file to NCP.
3.  When prompted for the username password type test and Juniper123. The username and password are similar to the credentials being used for the SRX profile.
4. Change the pre-shared-key to juniper123 in NCP. To do so, go to Connections > Profile > Edit > Identities.
5. Establish the connection.

Note: When the connection is established, a secure virtual adapter is generated on the client, which shows the IP address and other xauth attributes that are provided by SRX.

If you require an IPSEC VPN Client for ScreenOS – Juniper Partner with NCP. Its called  NCP Secure Client – Juniper Edition

The following is a Juniper KB article about the product.

NCP Secure Client – Juniper Edition FAQ

The original version of the Juniper KB article below is found here:

KB17266

Summary:

Problem or Goal:

Solution:

Refer to the Q & A below, which is divided up into two sections:  NCP Related Questions and IPSec and NS-Remote Related Questions.

NCP Related Questions

• +49 9119968 0
• juniperhelpdesk@ncp-e.com

• Windows XP (32-and 64-bit)
• Windows Vista (32- and 64-bit)
• Windows 7 (32- and 64-bit)

IPsec and NS-Remote Related Questions

• Only a web-browser and Internet connection are needed for user access
• There is no client software to install, maintain, or configure
• All devices are subject to comprehensive security checks before access is granted
• You have granular access control of users to particular resources
• Secure remote access facilitates business continuity during unplanned events like pandemics or natural disasters
• Rich logging and auditing reports ease regulatory compliance efforts

• KB16075 – Configuring a dial-up VPN using Windows 7 client with L2TP over IPSec (without NetScreen-Remote)