• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 431
  • Last Modified:

Addiing a route to a Netscreen -5

I have 2 subnets in a small office.
192.168.2.0---------with gateway 192.168.2.254------------DSL
192.168.3.0---------with gateway 192.168.3.254------------Comcast
Both are Netscree n-5.
I need a route for users on .2 subnet to .3 subnet so users on .2 can backup to a computer on .3

So I would add a route in the .2 Netscreen pointing to .3 subnet, no? The Netscreen is not taking the entry for some reason, it just shoots back to the route table page after I try toadd the route.
3.JPG
0
zen_68
Asked:
zen_68
  • 11
  • 9
1 Solution
 
zen_68Author Commented:
See attachment
4.JPG
0
 
Sanga CollinsSystems AdminCommented:
the routing between each subnet is created automaticaly. as long as they are both in the same zone, you should have no problem communicating between the two. I noticed that you are using a very old version of screenOS. It has been several years since i used that version. You may want to upgrade to verzion 5.0 at the least so you can get maximum functionality out of your device
0
 
zen_68Author Commented:
What do you mean by the same zone? I have 2 Netscreen -5 routers. One for each network.
0
Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

 
zen_68Author Commented:
Sorry, my question might be confusing. 2 seperate networks, 2 seperate routers.

.2 network and .3 network
0
 
Sanga CollinsSystems AdminCommented:
the netscreen has security zones: trust, untrust, and others you can create. As long as two interfaces on the same netscreen are in the same zone, you can send traffic between them. The route statements will be automatically added.

if your route statements are not automatically added, the only reason i can think of is the version of your screenOS device firmwre
0
 
zen_68Author Commented:
Two Netscreen routers, not one.
0
 
Sanga CollinsSystems AdminCommented:
Are the two devices connected through the LAN? or is the only connection via the WAN (DSL & comcast)?
0
 
Sanga CollinsSystems AdminCommented:
if the only connection is through the WAN. you will need to create a VPN tunnel between the two netscreens. you can then create a route statement on each device pointing the destination LAN ip to the tunnel interface to route traffic to the correct location
0
 
zen_68Author Commented:
No, they both plug into the same switch inside the building.
0
 
zen_68Author Commented:
Seems like I would just need to add a route to the .2 pointing to the .3 no?
0
 
Sanga CollinsSystems AdminCommented:
ok if both devices are plugged into the same switch from their trust ports, what id do is create a subinterface on each device with an ip address on the destination network.

so for device 1 with 192.168.2.0---------with gateway 192.168.2.254, i would create a subinterface with the ipaddress of 192.168.3.50, subnet 255.255.255.0, gateway, 192.168.3.254

i would do the reverse on the other device.

this will put each juniper on the corresponding junipers network allowing traffic to pass through
0
 
Sanga CollinsSystems AdminCommented:
@zen, thanks for that, the route statement would be needed in addition to a sub interface.

so subinterface should be 192.168.3.50/32 (very important to make it 32bit)
and route statement should be 192.168.3.0/24, destination>subinterface
0
 
zen_68Author Commented:
hmmmm, interesting. Why won't adding a route work, just curious.
0
 
Sanga CollinsSystems AdminCommented:
trust interface on junipers are usually in NAT mode, and the untrust interface in route mode. id have to test it to be absolutely sure, but i believe the trust would have to be changed to route mode for this to work. that would then break other portions of the setup like Mapped ips, vips, and.or vpn routing if there is any
0
 
zen_68Author Commented:
I dont see an option to create a sub interface. Virtual ip?
0
 
Sanga CollinsSystems AdminCommented:
i fired up an ns5gt with version 4.0 firmware and indeed that option is not there. i will attempt to find a way to replicate your setup in my office lab and see if there is another way to solve your problem. if you do have the option ... upgrading for version 5 screenOS will make a huge difference. it is literrally night and day in comparison
0
 
zen_68Author Commented:
And I very much appreciate your help! Where can i get ahold of the updated os? Will it break the configuration? We do VPN between home office and this remote.
0
 
zen_68Author Commented:
Would it be easier to just subnet the 192.168.1.2 network ?
0
 
Sanga CollinsSystems AdminCommented:
honestly the easiest method would be to create a VPN between the two devices just like you do for the home office users. This will simplify the routing for you, and allow you to work within the limitations of screenOS4. Upgrading the firmware is a problem since your device is EOL. Juniper networks are very stingy about their firmware upgrades. they normally dont help you unless you purchase one of their support contracts.

i have in the past had some success finding firmware in torrents, but approach that option with extreme caution since this is your office network and id hate to give you advice that compromises it.
0
 
zen_68Author Commented:
Thank you very much!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 11
  • 9
Tackle projects and never again get stuck behind a technical roadblock.
Join Now