We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

Juniper ssg140 using 2 untrust interfaces for different networks

Medium Priority
1,620 Views
Last Modified: 2012-05-07
i have 2 juniper ssg140's in a failover cluster config. 1 untrust interface, several VIPs and MIPs configured. 2 trust interfaces but both route through same untrust. Here's a sample layout:
Untrust Intreface 12.12.12.12
Trust1 interface 192.168.1.x
Trust2 interface 192.168.100.x
Remote offices have site to site route based vpn to main office. Remote office nets are 192.168.2.x, .3.x, .4.x, .5.x, etc.
We now have a client that unfortuantely has the same net as one of our remote offices, like 192.168.4.x. We have to create a site-site vpn with this client. My idea is to use a second Untrust interface at 12.12.12.13 with lan behind it of 172.16.100.x for example. The client will only need access to 3 or 4 services on 1 server which we can place in the 172.x.x.x lan.
any ideas if this will even work or if the ssg140 supports this config?
thx

Comment
Watch Question

Commented:
Did you think to add an alias 172.x.x.x to the server or move it from your LAN completely?

Are your remote offices (especially the conflicting one) accessing this server? If yes then adding a 172.x.x.x alias won't solve your problems. The server will want to send a packet to the IP 192.168.4.5 and it won't know whether to your client or remote office.

I believe you could leave everything as it is and just add NAT to the client's VPN (maybe also to the conflicting office VPN) - change their addresses to 192.168.199.x (a non conflicting network).

Author

Commented:
the server at 172.x.x.x will only need to be accessed by the new clients and by a server at 192.168.1.x (local trust int). The existing remote conflicting office will not need to access this server. I wanted to avoid changing my existing remote office lan's ip.
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
Qlemo"Batchelor", Developer and EE Topic Advisor
CERTIFIED EXPERT
Top Expert 2015
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
i did end up using NAT using the juniper overlapping subnet instructions.
thanks

Author

Commented:
i'll award qlemo some points as well for stating the policy info, i overlooked it at first
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.