Sure is possible. Here's a guide
http://www.cisco.com/en/US
Main Topics
Browse All Topics
Loading Advertisement...
Question
configuring ipsec vpn between netscreen and cisco
Hi,
I have attached the diagram. I am trying to creat ipsec vpn between the netscreen and cisco router. Can you please tell me if I can do this? Is my diagram conceptually correct?
Is ip addressing correct in my topology?
- VPN.bmp
- 1.9 MB
IPsec vpn
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
Irmoore,
the link you have given talks about configuration of ipsec between pix and netscreen
In my case i just have netscreen and juniper or cisco routers.
So can i use them instead of pix?
What configuration changes i will have to make if i use a router instead of pix firewall?
Please i would really appreciate if you could exactly tell me what changes should be made
Do you think it would be more easier to have a ipsec between netscreen and juniper router than to have between netscreen and cisco router?
Could someone kindly give me a configuration example of how to configure policy based ipsec vpn between juniper router and netscreen firewall?
OR
between cisco router and netscreen
OR
both
Is policy based vpn simpler than route based vpn?
i want use easy and simple method.
Plus, how can i check the version of my ScreenOS?
For version of screenos, run a "get sys" the version of screenos will be there.
With regards to the examples:
http://kb.juniper.net/KB85
This requires no login as far as I can see bud.
Can you confirm which one you don't have access to?
It is the same configuration on the Netscreen. Use the IOS router configuration in this example of a router to PIX. The router config is the same if going to a Netscreen
http://www.cisco.com/en/US
Irmoore,
thanks for the link
so you mean i should have the netscreen configuration from the previous link and use the configuration of router from the second link you gave me? thats what you mean?
One more thing, this nat thing confuses me...the link u gave has nat and route-map and nat pool...
all this confuses me...i just want a simple ipsec. Can i omit those nat parts in the configuration?
Can you tell me the configuration example you gave me of Netscreen in the previous link...is it policy based or route based?
I would assume the Netscreen config is policy based because that is what the Cisco side is.
Yes, use the Netscreen config from the first link, and the Cisco router config from the second like.
I can only assume that you are already Natting on the Cisco router. If yes, then you have to do the route-map thing. If not, then you do not. Can you post that config?
Acually my confusion is almost gone as i have found out the way to configure IPsec between Netscreen and Cisco router., at least theoretically, i still have to configure it to see if it works 100%
Now my next target is to implement ipsec between Netscreen and Juniper router.
Actually my ultimate objective is to implement hub and spoke ipsec VPN...with netscreen acting as a hub, Cisco router and Juniper router as spokes. Thats why i m first trying simple things first then go for the hub and spoke.
I am attaching a diagram which show what i m trying to achieve...can you guys tell me if its coceptually correct. Plus, would it be better or easier if i implement GRE tunnel along with ipsec? CAn GRE tunnels be configured in Netscreen? and most importantly, Can someone please give me a configuration example of Hub and Spoke VPN using Netscreen as hub and juniper or cisco router as spokes.?
Can Hub and spoke IPSEc VPN be implemented without the use of GRE tunnels?
One more thing, ethernet2 of netscreen is by default in DMZ zone...so i can set it to untrust zone as per my diagram?
Thanks,
- hub-and-spoke-vpn.jpg
- 39 KB
Hub and spoke
Ok this is a pretty simple question:
I have a netscreen firewall and a cisco router.
I have set the ethernet interface of the netscreen and put the ip address as 2.2.2.2/30
and on cisco ethernet interface i have put 2.2.2.1/30
When I try to ping from netscreen to cisco, it pings but when i ping from cisco to netscreen it doesnt.
by the way, that interface is untrust interface of netscreen.
So that means inbound traffic is blocked but outboud traffic is allowed in the netscreen.(maybe thats the default in netscreen)
Can you tell me how can i allow inbound traffic to flow in netscreen?
I will answer inline bud (I am a junoper bod, BTW :P)
Ok this is a pretty simple question:
I have a netscreen firewall and a cisco router.
I have set the ethernet interface of the netscreen and put the ip address as 2.2.2.2/30
and on cisco ethernet interface i have put 2.2.2.1/30
>> All fine so far :D
When I try to ping from netscreen to cisco, it pings but when i ping from cisco to netscreen it doesnt.
by the way, that interface is untrust interface of netscreen.
>> By default, the untrust interfaces on a netscreen BLOCK PINGs to the interface. This is separate form the policies, so does not indicate its blocking all traffic,
>> To allow pings tpo your external interface type in the following:
set int e<whatever your ext interface is> manage ping
I would not recommend having this enabled permanently. To un set, type "un" berfore the set.
So that means inbound traffic is blocked but outboud traffic is allowed in the netscreen.(maybe thats the default in netscreen)
>> As above, the blocked ping is not indicative of blocking all traffic.
Can you tell me how can i allow inbound traffic to flow in netscreen?
>> Create a policy to allow the specific traffic. It really is that simple bud.
>> If the traffic is still being dropped, you can run debugs to see what is going on and why the traffic is being blocked and what we can do about it.
Does this answer your question?
Deimark and Irmoore thanks for the replies guys.
Deimark, I tried your command and now its pinging, thanks a lot
Can someone give me a sample configuration for juniper router (Jseries) to juniper router ipsec vpn?
It would be nice if there is a diagram as well so that i can better understand the configuration.
My problem is that i found couple of configuration for ipsec between juniper routers but they are without any diagram due to which i have trouble understanding whats going on.
Please guys i really need your help...
If you find a sample configuration then please include diagram and if there isnt then i would really appreciate if you could draw the diagram according to the config so that i can understand it better.
Please note that i have a J series router
Deimark, you seem to be an expert on Juniper so i really need your help in this one bud.
Thanks,
http://kb.juniper.net/kb/d
Gives example info and instructions on J series VPNs bud. If the PDF page does not open, then "download the link as" and it will save fine
Thanks a lot Deimark for the link. It really helped me understand the concept however, the configuration example is between juniper and netscreen only. Can you give me any configuration example of ipsec between juniper to juniper router with a network diagram?
Also i would be very thankful if you can find out a hub and spoke vpn config example with diagram where netscreen and juniper or cisco routers are involved. I have found few configs but it only involved netscreen. I just have one netscreen firewall
Thanks,
The same principles apply here bud, no matter what the device is.
If you have a look at the PDF in http://kb.juniper.net/kb/d
This has the route based VPN info there for you, with the example using a J series and SSG5.
We can replace the SSG5 with another J series and follow the same process as configuring the original J series box, we just replace the networks and IPs used to be the ones assigned to the SSG
ie J series 1 will have external IP of 1.1.1.2/30 with protected LAN of 10.10.10.0/24
J series 2 will have external IP of 2.2.2.2/30 with protected LAN of 192.168.168.0/24
For hub and spoke, its all fairly similar. The branches will all have a single VPN configured to the hub, with appropriate routing etc Iie if it needs to talk to another branches LAN, it has a route to send them down the tunnel to the hub which will then route onwards to correct tunnel/endpoint)
The hub with a VPN to each branch with appropriate routing also. As long as there are valid routes and the traffic has a policy to allow it, it all should work fine.
Junipers NSM takes a lot of the pain out of the VPN config by using a nice GUI to create the topology and set the VPN parameters, which will then convert to CLI commands and send onto the devices
Does this help any?
DM
Thanks a lot Deimark!
i really appreciate your answer and explanation.
Now my final task is to use netscreen as a firewall with static NAT and configure multiple zones i.e trust, untrust and DMZ. Can you suggest me a simple network diagram to accomplish this?
For example, I can put 2 or 3 routers and use netscreen as a firewall between them and do static NAT.
Can you give me a link for sample configuration of the above mentioned objective, so that i can understand how i can implement such a thing using netscreen as a firewall.
Is static NAT in netscreen is called Mapped IP (MIP)?
Thanks,
There are quite a few different types of NAT that Screenos can do bud but in essence, what you are looking to do should be able to get done using one or 2 of the methods.
However, in the interests of keeping EE in the premise of 1 question 1 answer for better searching I think it would be better if you closed this question off and asked a new one.
I can then have a wee look at the new question re nat.
Does this help?
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: deimarkPosted on 2009-08-01 at 11:06:47ID: 24996124
From the Juniper side, have a look at http://kb.juniper.net/kb/d
This will give an idea on how to set up the VPN itself.
Bear in mind that there are 2 types of site to site VN ont eh Juniper, route based and policy based. Policy based uses the policy to encrypt and route based will create a tunnel interface and you route the VPN traffic to the tunnel interface
With regards to the cisco, I have to defer to another expert.
Caveats I have seen with VPNs from Juniper to 3rd party devices, is that the Juniper tends to be quite strict on what it will accept as VPN credentials, so if it does not come up 1st time after configuring it, then double check that all the phase 1 and 2 credentials n each side match exactly.
HTH