Screen OS

last person joined: 8 months ago 

This is a legacy community with limited Juniper monitoring.

  • 1.  Dialup-VPN successfully connects, but the Windows VPN client cannot reach devices on the Trust side

    Posted 07-04-2008 07:54
      |   view attached

    I have read through all the discussion threads and KB articles relating to troubleshooting this issue and I still am not finding the solution.  I can successfully create the IPSec tunnel and can ping the Trust side interface as a previous post indicates that this is usually no problem as the Firewall/VPN device knows how to handle this traffic.  When I am logged into the Firewall/VPN device via ssh and perform a ping test to other devices on the Trust side, I get a positive response.  What am I missing? I have added my configuration to this post.  Please have a look at this.

     

    Greatly frustrated but appreciative.

     

    Hulk

    Attachment(s)

    txt
    _cfg.txt   4 KB 1 version


  • 2.  RE: Dialup-VPN successfully connects, but the Windows VPN client cannot reach devices on the Trust side
    Best Answer

    Posted 07-04-2008 13:06

    Hi Hulk,

     

    Try the following :

     

    - Edit your VPN policy

    - Go in advanced configuration

    - Activate the source NAT with Egress Interface

    Message Edited by sylvain on 07-04-2008 01:07 PM


  • 3.  RE: Dialup-VPN successfully connects, but the Windows VPN client cannot reach devices on the Trust side

    Posted 07-07-2008 05:57

    FAAANtastic.....not 100% sure why this is needed, but it worked and I don't care at this time to figure it out.  Someone should re-edit the steps for creating a Dial-up VPN to include this crucial step...

     

    thanks a bunch

     

    Hulk



  • 4.  RE: Dialup-VPN successfully connects, but the Windows VPN client cannot reach devices on the Trust side

    Posted 07-07-2008 07:47

    Hi Hulk,

     

    To be honnest, it s a workaround. I think there is a problem with the return flow in your case ( Perhaps a routing issue ).

    By translating the source, all the networks think that the src ip is the Firewall ( and not the IPsec client ).  



  • 5.  RE: Dialup-VPN successfully connects, but the Windows VPN client cannot reach devices on the Trust side

    Posted 07-07-2008 09:55

    Fair enough, workaround or not, I am just glad to see this is working. It seems odd that there is a routing issue with such a simple setup?  Is this related to the version of ScreenOS running on the Firewall/VPN device? What is even more unsettling is that I reset the original settings back into the policy, reset the device to flush any caching and I can still see the devices on the Trust side....confusing...U bet!!!

     

     Well, I am just going to chock this up to good old FM technology,or just needed a kickstart, and leave it for now.

     

    thanks again for your input

     

    Hulk