root@RootsGreendaleWI-SRX100h> show configuration
version 10.4R4.5;
system {
host-name RootsGreendaleWI-SRX100h;
time-zone America/Chicago;
root-authentication {
encrypted-password "$1$p9QACgMj$7cG56U0t5x4fGTmuccBco0"; ## SECRET-DATA
}
name-server {
208.67.222.222;
208.67.220.220;
}
login {
message "********************************************************************************\nUsage of this system is subject, at all times, to the guidelines and policies of Roots Salon.\nUnauthorized Access is Strictly Prohibited!\n********************************************************************************\n ";
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
http;
}
dhcp {
router {
10.1.124.254;
}
pool 10.1.124.0/24 {
address-range low 10.1.124.1 high 10.1.124.250;
domain-name rootssalon.com;
name-server {
8.8.8.8;
}
router {
10.1.124.254;
}
}
propagate-settings fe-0/0/0.0;
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
interfaces {
fe-0/0/0 {
description "Uplink to AT&T";
unit 0 {
description "Uplink to AT&T";
family inet {
sampling {
input;
output;
}
dhcp;
}
}
}
fe-0/0/1 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members RS-Data;
}
}
}
}
fe-0/0/2 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members RS-Data;
}
}
}
}
fe-0/0/3 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members RS-Data;
}
}
}
}
fe-0/0/4 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members RS-Data;
}
}
}
}
fe-0/0/5 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members RS-Data;
}
}
}
}
fe-0/0/6 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members RS-Data;
}
}
}
}
fe-0/0/7 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members RS-Data;
}
}
}
}
st0 {
unit 0 {
description "Tunnel to CENTRAL";
family inet;
}
}
vlan {
unit 0 {
family inet;
}
unit 124 {
description RS-Data;
family inet {
sampling {
input;
output;
}
address 10.1.124.254/24;
}
}
}
}
routing-options {
static {
route 10.0.0.0/8 next-hop st0.0;
}
}
protocols {
rstp;
}
class-of-service {
classifiers {
dscp juniper_dscp_classifier {
forwarding-class voice {
loss-priority low code-points ef;
}
forwarding-class voice-control {
loss-priority low code-points af31;
}
forwarding-class best-effort {
loss-priority low code-points be;
}
}
}
forwarding-classes {
queue 0 best-effort;
queue 3 voice-control;
queue 6 voice;
}
interfaces {
fe-0/0/0 {
scheduler-map ethernet-cos-map;
unit 0 {
classifiers {
dscp juniper_dscp_classifier;
}
}
}
}
rewrite-rules {
dscp test-rule {
forwarding-class voice {
loss-priority low code-point ef;
}
}
}
scheduler-maps {
ethernet-cos-map {
forwarding-class best-effort scheduler be-sched;
forwarding-class voice scheduler voice-sched;
forwarding-class voice-control scheduler voice-control-sched;
}
}
schedulers {
voice-sched {
transmit-rate percent 20;
buffer-size percent 5;
priority strict-high;
}
voice-control-sched {
transmit-rate percent 10;
buffer-size percent 5;
priority low;
}
be-sched {
transmit-rate percent 35;
buffer-size percent 35;
priority low;
}
}
}
security {
ike {
proposal P1-AES128-SHA {
authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm sha1;
encryption-algorithm aes-128-cbc;
}
policy IKE-POL-GREENDALE-ATT {
mode aggressive;
proposals P1-AES128-SHA;
pre-shared-key ascii-text "$9$0Ml31crbwgDi.oJnCu0EhSreK87GUH5QnuOX-VwaJik.fz6tpBIRSFntORheK-db"; ## SECRET-DATA
}
gateway GW-GREENDALE-ATT {
ike-policy IKE-POL-GREENDALE-ATT;
address 24.106.47.110;
local-identity hostname greendalewi.rootssalon.com;
external-interface fe-0/0/0.0;
}
}
ipsec {
proposal P2-AES128-SHA {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm aes-128-cbc;
}
policy IPSEC-POL-AES128-SHA {
perfect-forward-secrecy {
keys group2;
}
proposals P2-AES128-SHA;
}
vpn VPN-GREENDALE-ATT {
bind-interface st0.0;
ike {
gateway GW-GREENDALE-ATT;
ipsec-policy IPSEC-POL-AES128-SHA;
}
establish-tunnels immediately;
}
}
nat {
source {
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule source-nat-rule {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
}
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.0;
st0.0;
vlan.124 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone untrust {
screen untrust-screen;
interfaces {
fe-0/0/0.0 {
host-inbound-traffic {
system-services {
dhcp;
tftp;
ping;
ike;
}
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone trust to-zone trust {
policy Intrazone-Allow {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
alg {
h323 disable;
sip disable;
}
flow {
tcp-mss {
ipsec-vpn {
mss 1350;
}
}
}
}
services {
flow-monitoring {
version9 {
template NTA-flow {
ipv4-template;
}
}
}
}
vlans {
RS-Data {
vlan-id 124;
l3-interface vlan.124;
}
}
↧
Re: SRX VPN network issue
↧