Hi,
I'm relatively new to Juniper devices and need a bit of support configuring a routing policy. Our SSG-5 is acting as a VPN-Endpoint and in the past we connected devices to bgroup-0 inorder to access servers that sit on the otherside of the connection. In the last few months, the number of devices that need access to the VPN grew and just using the ports from bgroup-0 isn't an option anymore. Our router creates the subnet 192.168.53.0/24 and the eth0/0 port of the SSG-5 hat the static IP 192.168.53.200. I would like to be able to send requests to that port from any computer on our onpremise network so that the computers can access the VPN. A customer of ours also uses an SSG-5 to allow us access to their network, and they configured their unit in a similar way. Meaning our router notices that requests for 10.30.XXX.XXX are made and redirects the traffic to the IP of the eth0/0 port of their SSG-5 and the VPN works.
I read through this post on the forum and to set the bgroup-0 to route mode. I then tried several different routes and nothing worked. What routes do I need to set for this to work? Are there anyother changes I need to make? Ill post our config below.
Best wishes,
Christopher
Here is a brief summary:
Routers IP: 192.168.53.2
Main Network: 192.168.53.0/24
SSG-5 eth0/0 IP: 192.168.53.200
bgroup0 gateway/network: 192.168.1.1/24
Network with DPI/IPS: 192.168.86.1
Config:
unset key protection enable set clock timezone 0 set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set alg appleichat enable unset alg appleichat re-assembly enable set alg sctp enable set auth-server "Local" id 0 set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "XXX" set admin password "nKVXXXtqkAibn" set admin auth web timeout 10 set admin auth dial-in timeout 3 set admin auth server "Local" set admin format dos set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" set zone "DMZ" vrouter "trust-vr" set zone "VLAN" vrouter "trust-vr" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Trust" asymmetric-vpn set zone "Untrust" block unset zone "Untrust" tcp-rst unset zone "V1-Trust" tcp-rst unset zone "V1-Untrust" tcp-rst set zone "DMZ" tcp-rst unset zone "V1-DMZ" tcp-rst unset zone "VLAN" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop set zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src set zone "V1-Untrust" screen land set interface "ethernet0/0" zone "Untrust" set interface "ethernet0/1" zone "DMZ" set interface "ethernet0/6" zone "Trust" set interface "bgroup0" zone "Trust" set interface "bgroup1" zone "Trust" set interface "tunnel.1" zone "Trust" set interface "tunnel.2" zone "Trust" set interface bgroup0 port ethernet0/2 set interface bgroup0 port ethernet0/3 set interface bgroup0 port ethernet0/4 set interface bgroup0 port ethernet0/5 unset interface vlan1 ip set interface ethernet0/0 ip 192.168.53.200/24 set interface ethernet0/0 route set interface bgroup0 ip 192.168.1.1/24 set interface bgroup0 route set interface tunnel.1 ip XXX set interface tunnel.2 ip XXX set interface tunnel.1 mtu 1436 set interface tunnel.2 mtu 1436 unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface ethernet0/0 ip manageable set interface bgroup0 ip manageable unset interface bgroup1 ip manageable set interface ethernet0/0 manage ping set interface ethernet0/0 manage ssh set interface ethernet0/0 manage telnet set interface ethernet0/0 manage ssl set interface ethernet0/0 manage web unset interface ethernet0/6 manage ping unset interface ethernet0/6 manage ssh unset interface ethernet0/6 manage telnet unset interface ethernet0/6 manage snmp unset interface ethernet0/6 manage ssl unset interface ethernet0/6 manage web unset interface bgroup1 manage ping unset interface bgroup1 manage ssh unset interface bgroup1 manage telnet unset interface bgroup1 manage snmp unset interface bgroup1 manage ssl unset interface bgroup1 manage web set interface ethernet0/0 dhcp client enable set interface ethernet0/6 dhcp client enable set interface bgroup1 dhcp client enable unset interface ethernet0/0 dhcp client settings update-dhcpserver unset interface ethernet0/6 dhcp client settings update-dhcpserver unset interface bgroup1 dhcp client settings update-dhcpserver set interface bgroup0 dhcp server service set interface bgroup0 dhcp server auto set interface bgroup0 dhcp server option gateway 192.168.1.1 set interface bgroup0 dhcp server option netmask 255.255.255.0 set interface bgroup0 dhcp server option dns1 192.168.53.2 set interface bgroup0 dhcp server ip 192.168.1.33 to 192.168.1.126 unset interface bgroup0 dhcp server config next-server-ip set interface "serial0/0" modem settings "USR" init "AT&F" set interface "serial0/0" modem settings "USR" active set interface "serial0/0" modem speed 115200 set interface "serial0/0" modem retry 3 set interface "serial0/0" modem interval 10 set interface "serial0/0" modem idle-time 10 set flow tcp-mss unset flow no-tcp-seq-check set flow tcp-syn-check unset flow tcp-syn-bit-check set flow reverse-route clear-text prefer set flow reverse-route tunnel always set flow vpn-tcp-mss 1387 set dbuf size 4096 set pki authority default scep mode "auto" set pki x509 default cert-path partial set dns host dns1 192.168.53.2 set dns host dns2 0.0.0.0 set dns host dns3 0.0.0.0 set crypto-policy exit set ike p1-proposal "ike-prop-vpn-05257343a105a43-1" preshare group2 esp aes128 sha-1 second 28800 set ike p1-proposal "ike-prop-vpn-0525743a105a43-2" preshare group2 esp aes128 sha-1 second 28800 set ike p2-proposal "ipsec-prop-vpn-0525743a105a43-1" group2 esp aes128 sha-1 second 3600 set ike p2-proposal "ipsec-prop-vpn-0525743a105a43-2" group2 esp aes128 sha-1 second 3600 set ike gateway "gw-vpn-0525734c43a105a43-1" address 34.250.138.255 Main outgoing-interface "ethernet0/0" preshare "CXAzrY7cNVXXXooukM48x8FcX0x1NTrdBdQ" proposal "ike-prop-vpn-05257343a105a43-1" set ike gateway "gw-vpn-0525734c43a105a43-1" dpd-liveness interval 10 set ike gateway "gw-vpn-0525734c43a105a43-1" dpd-liveness retry 3 set ike gateway "gw-vpn-0525734c43a105a43-2" address 52.31.30.37 Main outgoing-interface "ethernet0/0" preshare "2n1V8rgeNQNXXXXABYm8LW3oAgz4KaqWiTUcI" proposal "ike-prop-vpn-0525743a105a43-2" set ike gateway "gw-vpn-0525734c43a105a43-2" dpd-liveness interval 10 set ike gateway "gw-vpn-0525734c43a105a43-2" dpd-liveness retry 3 set ike respond-bad-spi 1 set ike ikev2 ike-sa-soft-lifetime 60 unset ike ikeid-enumeration unset ike dos-protection unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set vpn "IPSEC-vpn-0525734c43a105a43-1" gateway "gw-vpn-0525734c43a105a43-1" replay tunnel idletime 0 proposal "ipsec-prop-vpn-0525743a105a43-1" set vpn "IPSEC-vpn-0525734c43a105a43-1" id 0x1 bind interface tunnel.1 set vpn "IPSEC-vpn-0525734c43a105a43-2" gateway "gw-vpn-0525734c43a105a43-2" replay tunnel idletime 0 proposal "ipsec-prop-vpn-0525743a105a43-2" set vpn "IPSEC-vpn-0525734c43a105a43-2" id 0x2 bind interface tunnel.2 unset interface tunnel.1 acvpn-dynamic-routing unset interface tunnel.2 acvpn-dynamic-routing set url protocol websense exit set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit set policy id 1 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set config lock timeout 5 unset license-key auto-update set telnet client enable set snmp port listen 161 set snmp port trap 162 set snmpv3 local-engine id "0162032007005954" set vrouter "untrust-vr" set source-routing enable set route source 192.168.53.0/24 interface tunnel.1 set route source 192.168.53.0/24 interface tunnel.2 set route source 192.168.86.0/24 vrouter "trust-vr" preference 20 metric 1 set route source 192.168.53.0/24 vrouter "trust-vr" preference 20 metric 1 exit set vrouter "trust-vr" set protocol bgp 65000 set enable set hold-time 30 set neighbor XXX remote-as 64512 set neighbor XXX enable set neighbor XXX hold-time 30 set neighbor XXX remote-as 64512 set neighbor XXX enable set neighbor XXX hold-time 30 unset ipv4 synchronization set ipv4 neighbor XXX activate set ipv4 neighbor XXX activate set ipv4 neighbor XXX advertise-def-route exit unset add-default-route exit set interface tunnel.1 protocol bgp set interface tunnel.2 protocol bgp set vrouter "untrust-vr" exit set vrouter "trust-vr" exit