07-17-2008 03:20 AM
192.168.241.5 is the safenet virual adapter.
Thanks for your help. I will be out of the office for a few days so this will be my last correspondence until Sunday.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\gdaliberty>route print
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 11 43 b4 64 19 ...... Broadcom NetXtreme 57xx Gigabit Controller -
Packet Scheduler Miniport
0x20004 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.12.254 192.168.12.100 21
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.12.0 255.255.255.0 192.168.12.100 192.168.12.100 20
192.168.12.100 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.12.255 255.255.255.255 192.168.12.100 192.168.12.100 20
192.168.239.0 255.255.255.0 192.168.241.5 192.168.241.5 1
192.168.241.5 255.255.255.255 127.0.0.1 127.0.0.1 50
192.168.241.5 255.255.255.255 192.168.241.5 192.168.241.5 1
192.168.241.255 255.255.255.255 192.168.241.5 192.168.241.5 50
22.214.171.124 240.0.0.0 192.168.12.100 192.168.12.100 20
126.96.36.199 240.0.0.0 192.168.241.5 192.168.241.5 50
255.255.255.255 255.255.255.255 192.168.12.100 192.168.12.100 1
255.255.255.255 255.255.255.255 192.168.241.5 192.168.241.5 1
Default Gateway: 192.168.12.254
C:\Documents and Settings\gdaliberty>
07-21-2008 09:45 AM
Problem corrected....during testing I configures 2 security policies with the same trusted networks. I stopped one of them in the GUI and it disabled traffic to that trusted network. Once I deleted the stopped policy everything was good.
Thanks to Juniper support and very one here!!!! for helping. I didn't realize that what would happen.
07-24-2008 07:07 AM
07-24-2008 02:41 PM
Unfortunately from my experience you cant do this with a single policy on NSremote unless you want to tunnel all traffic 0.0.0.0/0. The only other way to do it is to create 2 security policies on NSremote one for each of the subnets and then have 2 policies on the firewall.
Although someone else might have a better suggestion. If you have got quite a few people connecting in over VPN then you might want to have a look at the Juniper SA which is a SSL VPN and is much more flexible.
07-24-2008 04:49 PM
07-24-2008 09:53 PM
See its fact that if we are new to any box and we dont know its behaviour then simple issue becomes complex and increase our frustration. It happenened to me also but now i feel very comfortable with all juniper boxes with the passage of time. Juniper products are much much stronger that cisco. The other factor is most people feel comfortable with cisco that cisco expertise are more than juniper so we can get help any where, but now juniper web-site, JTAC is much better in support and juniper expertise are now developing bcs now people going to know whats juniper strength is?
Any ways u can pass multiple subnets through dialup vpn tunnel using Route based dialup vpn. Refer to thread http://forums.juniper.net/jnet/board/message?board
07-24-2008 10:50 PM
Hi Kashif Rana,
Thanks for the info, I understand route based vpn on the firewall no problem. My questions is how do you configure the NSRemote client to send 2 networks down the tunnel say 10.1.1.0/24 and 192.168.1.0/24????
07-25-2008 11:32 PM
u can use 0.0.0.0/0 in Remote Party identity field. But u have to disable split tunneling which is by default disable so that traffic for internet no pass through tunnel. But for internet connection u can use proxy or use untrust to untrust zone intrazone policy with policy based NAT.
07-27-2008 03:10 PM - edited 07-27-2008 03:11 PM
Thanks -Kashif Rana
I got the dialup VPN working from that thread. I'm getting there. Thank you. How about local LAN access on the NSR side? I've read some threads about split tunneling but haven't had any success.
Thanks for all the help.