SRX

Greetings,

I'm configuring a policy-based VPN between a SRX and a Cisco ASA. But the networks that the SRX is protecting are located in different zone and have more networks to protect compare to the remote Site. So i was wondering if this will not create any issue as the networks to protect are located in different zones within the same LAN and the SRX derived the proxy-ids form the policy

Thanks in advance

What issues do you think it will create or what issues are you concerned about? If you have the VPN between the SRX and he ASA terminating in different zone from your protected resources, then the security policies that allow communication from the VPN zone to protected zone are your main concern.

Unless there is something else I am missing here. 

Thank for your reply.But my main concern is the proxy-id, should it be fixed manually or I can let it by default. And also if you have any advice regarding configuring policy-based VPN between a SRX and Cisco ASA

Hi,

You need to create a separate policy or a policy pair to match every Cisco ACL entry.  Depending on how specific the ACL is on the Cisco, then the more policies you have to create on the SRX to match each one.

The Proxy IDs are then derived from the security policies and if all is set up correct, it should work.

That is a good point. And I also created a VPN phase 2 for each traffic flow and I manually set the proxy-id. This is just to avoid proxy-id mismatches and to make sure that the ASA at the other site will have a VPN that matches every ACL entry

One quick question: what about also if we have this situation :

 a.a.a.a----------------SRX650-----------------INTERNET-----------------ASA5520---------------b.b.b.b

                   Trust                         untrust                                 untrust                            trust

That is the thing, if there is not an exact match in the Cisco ACL to the policy referencing the vpn, then it will not work.  There has to be a matching ACL for each SRX Policy referencing the VPN.

In my experience making the ACL as simple as possible results in less headaches. 

So how comes it was previously working with two Cisco firewalls using the same config?Because this was before we migrate one of the Site with a Juniper SRX