Trunk between Juniper NetScreen FW and Cisco Switch

Hi,

Client ( 10.25.20.0/24)
   |
Core RouterX
   |
Access RouterA --->AGG Sw1---->JFW----DMZ
                                   |
                                   |
                              ToR Sw1
                          |                 |
                      |                         |
                  Srv1                       Srv2
   (172.20.36.0/24)

172.20.36.36 is NATd with 3.3.3.3 in the FW, client is using the NAT IP to reach Srv1.

Looks like traffic is not hitting the FW at all. I can see trace from client reach up to RouterX and 3.3.3.x network is hostedon RoutrA.

Any help would be great.!!!!

genseek
genseekAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Ramakrishna PrabhuNetwork EngineerCommented:
Can you post your configs?
genseekAuthor Commented:
what configs are you seeking?
Ramakrishna PrabhuNetwork EngineerCommented:
Hold on...

If client and the server in the same network, that is behind the firewall and not on two sides of the firewall then i am pretty sure you can not access the server using the nated ip. (with in the same network)

If i am not wrong, your router will drop the packet as it wouldnt be knowing where to find 3.3.3.3 unless you specifically tell the router to forward the packet to fw.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

genseekAuthor Commented:
chesperito,

client and server are NOT in same network, plz see the topology diagram above.

Client is outside the FW and server is in DMZ network.
genseekAuthor Commented:
172.20.36.36  belongs to vlan 106,

There are 2 port channels between FW and AGG switch, Po10 and Po16

From the AGG side, i see Po10 has vlan 100 allowed and Po16 does not have vlan 106 allowed.


i want to check if vlan106 is allowed in the trunk between FW and AGG switch.

How can i see from the juniper FW side? what is the cmd?
Ramakrishna PrabhuNetwork EngineerCommented:
I am still trying to understand your network topology.

1 . When you say client is outside your network, is it located beyond your outside interface(like internet) or with in the network (inside)?

2. Can you access the server using its original ip (172.20.36.36)?
genseekAuthor Commented:
The client is outside the fW outside interface but is a remore internal network.


We are able to ping the server from Access Router A. Also, the server vlan is in VRF.
Ramakrishna PrabhuNetwork EngineerCommented:
Do you have a site to site ipsec tunnel between two locations?
If yes the tunnel is between two routers or Core Router X and JFW?

Through which you are able to ping the server(from access router a)
from client machine can you ping the server using the original ip (172.20.36.36)
genseekAuthor Commented:
There is NO Ipsec tunnel involved here.
Ramakrishna PrabhuNetwork EngineerCommented:
Through which ip you are able to ping the server(from access router a)
from client machine can you ping the server using the original ip (172.20.36.36)
genseekAuthor Commented:
172.20.36.36  belongs to vlan 106 which has VRF.

I'm able to ping from this VRF which belongs to the same vlan the destination server is in.

I'm not able to ping the server using original IP.
genseekAuthor Commented:
Am closing this question as i got the resolution.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
genseekAuthor Commented:
Am closing this question as i got the resolution.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.