ScreenOS Firewalls (NOT SRX)
Reply
Contributor
badar28
Posts: 76
Registered: ‎06-12-2008
0

Re: How to change the default time of 1 second

Ho Josine,

 

i will try all these tip tomorrow at client end and let u know the results.

 

Regards,

Badar

Contributor
badar28
Posts: 76
Registered: ‎06-12-2008
0

Re: How to change the default time of 1 second

Dear Josine,

 

I tried this MSS option, but as soon as we start OSPF on the SSG-140, it starts timed out and packets starts dropping. Result is the same with MSS setting as it was before. Please provide some other solution. If you require i can send u the configuration ????

 

Regards,

Badar

Recognized Expert
PentinProcessor
Posts: 258
Registered: ‎11-06-2007
0

Re: How to change the default time of 1 second

Badar,

 

1.  Typically we don't hardset the MTU on an interface unless there's a specific need.
Can you unset the MTU settings on the tunnel interfaces on both firewalls:

unset interface tunnel.x mtu 1500

Then also set the 'set flow tcp-mss 1350', and re-describe the symptoms.


2.  What ScreenOS version are you running on both SSGs?

3.  Observation (not related to your issue):
Typically on the VPN Monitor settings for route-based VPNs running OSPF, the rekey option is also specified, i.e.

set vpn <vpn> monitor  optimized  rekey

Refer to the following for more info: http://forums.juniper.net/jnet/board/message?board.id=Firewalls&message.id=1298&query.id=661827#M129....


4.  Observation (not related to your issue):
Policy id 2 on NAWABS-SSG is a vulnerable policy.
At least specify specific from and to host IPs.

Once you get it all working (you don't want to do too many changes at once), you may put your tunnel interface in a 'VPN zone', and then create the policies from and two the Trust and 'VPN Zone'.  Refer to the following for an example:   KB7746 - Full Mesh VPN with OSPF.

 

Regards,

Josine

Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.