[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Addiing a route to a Netscreen -5

Posted on 2010-01-08
20
Medium Priority
?
364 Views
Last Modified: 2012-05-08
I have 2 subnets in a small office.
192.168.2.0---------with gateway 192.168.2.254------------DSL
192.168.3.0---------with gateway 192.168.3.254------------Comcast
Both are Netscree n-5.
I need a route for users on .2 subnet to .3 subnet so users on .2 can backup to a computer on .3

So I would add a route in the .2 Netscreen pointing to .3 subnet, no? The Netscreen is not taking the entry for some reason, it just shoots back to the route table page after I try toadd the route.
3.JPG
0
Comment
Question by:zen_68
  • 11
  • 9
20 Comments
 

Author Comment

by:zen_68
ID: 26210522
See attachment
4.JPG
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26210619
the routing between each subnet is created automaticaly. as long as they are both in the same zone, you should have no problem communicating between the two. I noticed that you are using a very old version of screenOS. It has been several years since i used that version. You may want to upgrade to verzion 5.0 at the least so you can get maximum functionality out of your device
0
 

Author Comment

by:zen_68
ID: 26210759
What do you mean by the same zone? I have 2 Netscreen -5 routers. One for each network.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:zen_68
ID: 26210808
Sorry, my question might be confusing. 2 seperate networks, 2 seperate routers.

.2 network and .3 network
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26210832
the netscreen has security zones: trust, untrust, and others you can create. As long as two interfaces on the same netscreen are in the same zone, you can send traffic between them. The route statements will be automatically added.

if your route statements are not automatically added, the only reason i can think of is the version of your screenOS device firmwre
0
 

Author Comment

by:zen_68
ID: 26210871
Two Netscreen routers, not one.
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26210913
Are the two devices connected through the LAN? or is the only connection via the WAN (DSL & comcast)?
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26210936
if the only connection is through the WAN. you will need to create a VPN tunnel between the two netscreens. you can then create a route statement on each device pointing the destination LAN ip to the tunnel interface to route traffic to the correct location
0
 

Author Comment

by:zen_68
ID: 26210964
No, they both plug into the same switch inside the building.
0
 

Author Comment

by:zen_68
ID: 26210976
Seems like I would just need to add a route to the .2 pointing to the .3 no?
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26211037
ok if both devices are plugged into the same switch from their trust ports, what id do is create a subinterface on each device with an ip address on the destination network.

so for device 1 with 192.168.2.0---------with gateway 192.168.2.254, i would create a subinterface with the ipaddress of 192.168.3.50, subnet 255.255.255.0, gateway, 192.168.3.254

i would do the reverse on the other device.

this will put each juniper on the corresponding junipers network allowing traffic to pass through
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26211109
@zen, thanks for that, the route statement would be needed in addition to a sub interface.

so subinterface should be 192.168.3.50/32 (very important to make it 32bit)
and route statement should be 192.168.3.0/24, destination>subinterface
0
 

Author Comment

by:zen_68
ID: 26211201
hmmmm, interesting. Why won't adding a route work, just curious.
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26211231
trust interface on junipers are usually in NAT mode, and the untrust interface in route mode. id have to test it to be absolutely sure, but i believe the trust would have to be changed to route mode for this to work. that would then break other portions of the setup like Mapped ips, vips, and.or vpn routing if there is any
0
 

Author Comment

by:zen_68
ID: 26211240
I dont see an option to create a sub interface. Virtual ip?
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 26211289
i fired up an ns5gt with version 4.0 firmware and indeed that option is not there. i will attempt to find a way to replicate your setup in my office lab and see if there is another way to solve your problem. if you do have the option ... upgrading for version 5 screenOS will make a huge difference. it is literrally night and day in comparison
0
 

Author Comment

by:zen_68
ID: 26211317
And I very much appreciate your help! Where can i get ahold of the updated os? Will it break the configuration? We do VPN between home office and this remote.
0
 

Author Comment

by:zen_68
ID: 26211370
Would it be easier to just subnet the 192.168.1.2 network ?
0
 
LVL 18

Accepted Solution

by:
Sanga Collins earned 2000 total points
ID: 26211483
honestly the easiest method would be to create a VPN between the two devices just like you do for the home office users. This will simplify the routing for you, and allow you to work within the limitations of screenOS4. Upgrading the firmware is a problem since your device is EOL. Juniper networks are very stingy about their firmware upgrades. they normally dont help you unless you purchase one of their support contracts.

i have in the past had some success finding firmware in torrents, but approach that option with extreme caution since this is your office network and id hate to give you advice that compromises it.
0
 

Author Closing Comment

by:zen_68
ID: 31674569
Thank you very much!
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While it is possible to put two routes in place with the secondary having a higher metric, this may not always work. In the event of a failure that does not bring down the physical interface on the router the primary route is not removed. There is a…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question