Author Topic: Howto: Easy route-based VPN configuration  (Read 73318 times)

Dododope

  • Newbie
  • *
  • Posts: 47
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #20 on: December 01, 2008, 10:09:43 am »
A little remark is that when you're using the VPN one way only (From site A to site B) VPN Monitor should be turned off. For some reason when it's on my route towards my tunnel.1 interface doesn't become active.

Also I would suggest using different proposals for your phase1 and phase2 to be even more secure..

JNCIA-FWV, JNCIS-FWV

shashank

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #21 on: May 20, 2009, 12:40:21 am »
does any one have idea about Auto Connect VPN Configuration

anhnh1977

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #22 on: July 01, 2009, 08:36:32 am »
Good night signal15,

May you help me for the Netscreen Remote VPN client to SSG using route-based VPN.
I have try Juniper "Volume 5: Virtual Private Networks" but I am failured

Thank you,

slickric

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #23 on: February 08, 2010, 08:29:31 pm »
Does route-based vpn require both end hv to be Juninper product?

deanb

  • Full Member
  • ***
  • Posts: 128
  • Karma: +0/-0
    • View Profile

mamun_edge

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #25 on: May 11, 2010, 06:13:36 am »
would you please post the configuration of Certificate based Netscreen-remote dialup vpn using smart card. I need step by step configuration. please post it...........

paolo764

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #26 on: November 30, 2010, 01:41:17 am »
Hi
is it possible to route vpn traffic from customer "A" to customer "C" towards a netscren "B".

I (B) have a vpn with "C".
I have to establish a new vpn with "A".
"A" needs to reach "C"  but it can't estatblish a VPN directly.
is it possible to accomplish it without changing the actual vpn? ( B --> C ) ?
thank you

screenie.

  • Global Moderator
  • Atomic Playboy
  • *****
  • Posts: 1315
  • Karma: +1/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #27 on: December 02, 2010, 08:07:54 am »
A needs set a route to reach C to B and C needs to set a rout to reach A to B. on B you you need a policy to allow the traffic. A and C need both to be route based VPN for this config to work.
Regards, Screenie
------------------------
JNSS, JNCIA, JNCIS, JNCIP, JNCI

paolo764

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #28 on: December 03, 2010, 06:01:21 am »
A needs set a route to reach C to B and C needs to set a rout to reach A to B. on B you you need a policy to allow the traffic. A and C need both to be route based VPN for this config to work.

ok thank you.
so, 

1) route based vpn from  A to B ( proxy id = source network A & destination network B )

2) route based Vpn  from C to B ( proxy id = source network B & destination network C )

3 ) on B i have to setup a policy that permit traffic from A to C

4) A have to setup a route to C using B as GW ( tunnel interface )
5) C have to setup a route to A using B as GW ( tunnel interface )

missing something? if not it seems to be easy.

thank you so much.




screenie.

  • Global Moderator
  • Atomic Playboy
  • *****
  • Posts: 1315
  • Karma: +1/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #29 on: December 03, 2010, 06:31:23 am »
No, that should be it. Only thing to remark is to leave the proxy id's alone. On routebased juniper to routebased juniper you don't fill thim in. When both sides are all zeros they match and phase II can party. Don't know what happens when you do use proxy id's and the source is not within the range of the proxy id. Interesting to find out!!
Regards, Screenie
------------------------
JNSS, JNCIA, JNCIS, JNCIP, JNCI

paolo764

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #30 on: December 06, 2010, 05:37:50 am »
only B is a juniper, anyway i will try to use proxy id and past the resoult here.

screenie.

  • Global Moderator
  • Atomic Playboy
  • *****
  • Posts: 1315
  • Karma: +1/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #31 on: December 06, 2010, 03:58:25 pm »
If only B is a juniper you're in trouble. You need to match the proxy-ID to the source addresses in that case I think.
Regards, Screenie
------------------------
JNSS, JNCIA, JNCIS, JNCIP, JNCI

paolo764

  • Newbie
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #32 on: December 20, 2010, 04:12:32 am »
ok, problem has been fixed and it was easyer than i imagined.
anyway, i've used a fixed proxy id for both vpn ( not blank proxy id ):

exampre for B to A vpn ( local ip 10.10.1.0/16 , remote 1.1.1.0/24 )
exampre for B to C vpn ( local ip 10.10.2.0/16 , remote 2.2.2.0/24 )

than i've used Source and Destination NAT on the Security policy i've created.
My luck was that connection towards A coming from a dedicated interface and connection towards C use a different interface. ( my interfaces are in routing mode ) so no need to add static route and all worked fine for me.

I'm just wondering what happens if both connection comes from the same interface ( example: untrust ) ?!?...maybe I have to disble "block intra zone traffic " option

anyway, hope this can help.
thank you and bye

jady1

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
    • Seattle Car Service
Re: Howto: Easy route-based VPN configuration
« Reply #33 on: March 22, 2011, 09:29:26 pm »
definitely ... thanks for that

smoove

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #34 on: June 22, 2011, 06:10:35 pm »
Would it be possible to NAT the traffic before it traverses the VPN tunnel?  I need the network translated to a non overlapping network on the other end.

jmcgrady

  • Newbie
  • *
  • Posts: 38
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #35 on: September 08, 2011, 02:10:24 am »
I have a small variant to the original post that i'd like your advice on.  Our central gateway (call it "B") connects to internet via ethernet0/0. eth0/0 is in the untrust zone. However, the ip address for the endpoint of the tunnel on B resides on interface ethernet0/2. eth0/2 is in the DMZ zone.

So; when i'm selecting the physical interface to bind my unnumbered tunnel interface to; do i use eth0/0 or eth0/2? Furthermore, when i'm configuring the ike gateway on B; do i use eth0/0 or eth0/2 for "outgoing-interface"?

signal15

  • Administrator
  • Hero Member
  • *****
  • Posts: 531
  • Karma: +1/-0
    • View Profile
    • JuniperForum.com
Re: Howto: Easy route-based VPN configuration
« Reply #36 on: September 08, 2011, 11:40:59 am »
I have a small variant to the original post that i'd like your advice on.  Our central gateway (call it "B") connects to internet via ethernet0/0. eth0/0 is in the untrust zone. However, the ip address for the endpoint of the tunnel on B resides on interface ethernet0/2. eth0/2 is in the DMZ zone.

So; when i'm selecting the physical interface to bind my unnumbered tunnel interface to; do i use eth0/0 or eth0/2? Furthermore, when i'm configuring the ike gateway on B; do i use eth0/0 or eth0/2 for "outgoing-interface"?

Outgoing interface will be eth0/0.  As far as binding the tunnel interface to a physical one....  it doesn't matter.  Because the tunnel interface zone will be specified for the tunnel interface.  So you can bind it to eth0/2, or you can bind it to eth0/0.  Or, you can bind it to any other interface. 

jmcgrady

  • Newbie
  • *
  • Posts: 38
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #37 on: September 09, 2011, 12:44:50 am »
Thanks Signal. Ive put some debugging on and am still getting an issue. On A, eth0/1 is 10.1.24.215 and the tunnel endpoint. On B, eth0/2.7 is 167.22.92.113 and is the other end of the tunnel. I have bound tunnel.1 on B to eth0/0 and set eth0/0 as outgoing-interface. When the first IKE packet reaches B, it complains:

## 2011-09-09 13:36:35 : IKE<10.1.24.215> ****** Recv packet if <ethernet0/2.7> of vsys <Root> ******
## 2011-09-09 13:36:35 : IKE<10.1.24.215> Catcher: get 160 bytes. src port 500
## 2011-09-09 13:36:35 : IKE<0.0.0.0        >   ISAKMP msg: len 160, nxp 1[SA], exch 2[MM], flag 00
## 2011-09-09 13:36:35 : IKE<10.1.24.215    > Recv : [SA] [VID] [VID] [VID]
## 2011-09-09 13:36:35 : IKE<0.0.0.0        >   Not found: 1st peer_ent that is used, with no peer IP, and right local IP.
## 2011-09-09 13:36:35 : IKE<10.1.24.215> Rejected an initial Phase 1 packet from an unrecognized peer gateway.
11998648.0: ethernet0/0(i) len=202:0016c8268d43->0010dbff2000/0800
              10.1.24.215 -> 167.22.92.113/17

Why would it be complaining that its an 'unrecognized peer gateway' when the gateway on B is defined as:
set ike gateway "test-gw" address 10.1.24.215 Main outgoing-interface "ethernet0/0" preshare "blahblah" proposal "pre-g2-aes128-sha"


bensonlei

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: Howto: Easy route-based VPN configuration
« Reply #38 on: December 07, 2011, 01:40:07 am »
Hi,
I am a Cisco guy, and now new to Juniper SSG5 and SSG140; want to know if the following situations work:

1. Two sites :
    One site with Juniper SSG5 connecting to two ISP links, so WAN link failover is configured.
    The other site with Juniper SSG140 connecting also two other ISP links, so WAN link failover is configured.
2. Want to set up two VPN links ( they can back up each other ), that is totally four VPN configurations (2 WAN Links x 2 WAN links = 4 VPN links )

Are the VPN links are working ( failover architecture only ) ?

signal15

  • Administrator
  • Hero Member
  • *****
  • Posts: 531
  • Karma: +1/-0
    • View Profile
    • JuniperForum.com
Re: Howto: Easy route-based VPN configuration
« Reply #39 on: December 07, 2011, 10:47:14 am »
Thanks Signal. Ive put some debugging on and am still getting an issue. On A, eth0/1 is 10.1.24.215 and the tunnel endpoint. On B, eth0/2.7 is 167.22.92.113 and is the other end of the tunnel. I have bound tunnel.1 on B to eth0/0 and set eth0/0 as outgoing-interface. When the first IKE packet reaches B, it complains:

## 2011-09-09 13:36:35 : IKE<10.1.24.215> ****** Recv packet if <ethernet0/2.7> of vsys <Root> ******
## 2011-09-09 13:36:35 : IKE<10.1.24.215> Catcher: get 160 bytes. src port 500
## 2011-09-09 13:36:35 : IKE<0.0.0.0        >   ISAKMP msg: len 160, nxp 1[SA], exch 2[MM], flag 00
## 2011-09-09 13:36:35 : IKE<10.1.24.215    > Recv : [SA] [VID] [VID] [VID]
## 2011-09-09 13:36:35 : IKE<0.0.0.0        >   Not found: 1st peer_ent that is used, with no peer IP, and right local IP.
## 2011-09-09 13:36:35 : IKE<10.1.24.215> Rejected an initial Phase 1 packet from an unrecognized peer gateway.
11998648.0: ethernet0/0(i) len=202:0016c8268d43->0010dbff2000/0800
              10.1.24.215 -> 167.22.92.113/17

Why would it be complaining that its an 'unrecognized peer gateway' when the gateway on B is defined as:
set ike gateway "test-gw" address 10.1.24.215 Main outgoing-interface "ethernet0/0" preshare "blahblah" proposal "pre-g2-aes128-sha"



Your IKE ID is not being set or is incorrect on the remote end.  You are doing Main mode.  Is your remote side a dynamic IP?  If so, you need to switch to aggressive mode.  You may also need to use an email style IKE ID if it's dynamic.