IPSec VPN - Bridge setup

Posted on 2010-08-26
Medium Priority
Last Modified: 2013-11-16

I have to setup an IPSec VPN between to sites with juniper firewalls and we would like to communicate the two sited through the same network, I think this is called "Bridge setup".

We have the network and the other site want to use the same network... Is it possible?, How should we configure this environment?.

Thanks in advanced.
Question by:ecemibm
  • 2

Accepted Solution

ythevenot earned 1600 total points
ID: 33529693
LVL 72

Assisted Solution

Qlemo earned 400 total points
ID: 33529705
No - not that easy, at least. Juniper does not support ethernet bridging via an IPSec tunnel. You need to apply routing, and that means that you can't use the same addresses on both sides. The Juniper devices need to know where to go to for each address referenced, and the local stations need to differ between both networks.
My recommendation is to use the lower half at one site and the upper at the other, making a /25 network each. The core network address remains, but it is always straightforward at which side an address is located.

Another workaround is to use 1:1 NAT on both sides. That is, translate site A addresses to on site B, and site B addresses on site A to However, that confuses services working with IP addresses, like DNS - you would need to manually set that up on each site (for the other site). I do not recommend this.
LVL 72

Expert Comment

ID: 33529731
The PDF above shows the second method I mentioned.

Featured Post

WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question