Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

Re: SRX100 VPN problem

$
0
0

This should work. Please verify that it works.

....
set interfaces fe-0/0/0 unit 0 family inet address x.y.z.14/29
set interfaces fe-0/0/1 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/1 unit 0 family ethernet-switching vlan members vlan1
set interfaces fe-0/0/2 unit 0 family ethernet-switching vlan members vlan1
set interfaces fe-0/0/6 unit 0 family inet address P.G.0.1/24
set interfaces fe-0/0/7 unit 0 family ethernet-switching vlan members vlan2
set interfaces vlan unit 1 family inet address P.G.178.5/24
set interfaces vlan unit 2 family inet address P.G.0.1/24
set routing-options static route 0.0.0.0/0 next-hop x.y.z.9
set protocols stp
set security ike policy dyn-ike-pol mode aggressive
set security ike policy dyn-ike-pol proposal-set standard
set security ike policy dyn-ike-pol pre-shared-key ascii-text "password"
set security ike gateway dyn-vpn-gateway ike-policy dyn-ike-pol
set security ike gateway dyn-vpn-gateway dynamic hostname dyn-VPN
set security ike gateway dyn-vpn-gateway dynamic connections-limit 5
set security ike gateway dyn-vpn-gateway dynamic ike-user-type group-ike-id
set security ike gateway dyn-vpn-gateway external-interface fe-0/0/0.0
set security ike gateway dyn-vpn-gateway xauth access-profile dyn--vpn-profile
set security ipsec policy dyn-ipsec-pol proposal-set standard
set security ipsec vpn private-2-dyn-vpn ike gateway dyn-vpn-gateway
set security ipsec vpn private-2-dyn-vpn ike ipsec-policy dyn-ipsec-pol
set security dynamic-vpn access-profile dyn--vpn-profile
set security dynamic-vpn clients all remote-protected-resources P.G.0.0/24
set security dynamic-vpn clients all remote-exceptions 0.0.0.0/0
set security dynamic-vpn clients all ipsec-vpn private-2-dyn-vpn
set security dynamic-vpn clients all user remote-vpn-client1
set security nat source rule-set nsw_srcnat from zone private-2
set security nat source rule-set nsw_srcnat from zone private-1
set security nat source rule-set nsw_srcnat to zone Internet
set security nat source rule-set nsw_srcnat rule nsw-src-interface match source-address 0.0.0.0/0
set security nat source rule-set nsw_srcnat rule nsw-src-interface match destination-address 0.0.0.0/0
set security nat source rule-set nsw_srcnat rule nsw-src-interface then source-nat interface
set security nat proxy-arp interface fe-0/0/6.0 address P.G.0.100/32 to P.G.0.105/32
set security policies from-zone private-1 to-zone Internet policy All_private-1_Internet match source-address any
set security policies from-zone private-1 to-zone Internet policy All_private-1_Internet match destination-address any
set security policies from-zone private-1 to-zone Internet policy All_private-1_Internet match application any
set security policies from-zone private-1 to-zone Internet policy All_private-1_Internet then permit
set security policies from-zone private-2 to-zone Internet policy All_private-2_Internet match source-address any
set security policies from-zone private-2 to-zone Internet policy All_private-2_Internet match destination-address any
set security policies from-zone private-2 to-zone Internet policy All_private-2_Internet match application any
set security policies from-zone private-2 to-zone Internet policy All_private-2_Internet then permit
set security policies from-zone private-1 to-zone private-2 policy All_private-1_private-2 match source-address any
set security policies from-zone private-1 to-zone private-2 policy All_private-1_private-2 match destination-address any
set security policies from-zone private-1 to-zone private-2 policy All_private-1_private-2 match application any
set security policies from-zone private-1 to-zone private-2 policy All_private-1_private-2 then permit
set security policies from-zone private-2 to-zone private-1 policy All_private-1_private-2 match source-address any
set security policies from-zone private-2 to-zone private-1 policy All_private-1_private-2 match destination-address any
set security policies from-zone private-2 to-zone private-1 policy All_private-1_private-2 match application any
set security policies from-zone private-2 to-zone private-1 policy All_private-1_private-2 then permit
set security policies from-zone Internet to-zone private-2 policy allow-remote-access-private-2 match source-address any
set security policies from-zone Internet to-zone private-2 policy allow-remote-access-private-2 match destination-address any
set security policies from-zone Internet to-zone private-2 policy allow-remote-access-private-2 match application any
set security policies from-zone Internet to-zone private-2 policy allow-remote-access-private-2 then permit tunnel ipsec-vpn private-2-dyn-vpn
set security policies from-zone private-2 to-zone private-2 policy allow-c-2-c match source-address any
set security policies from-zone private-2 to-zone private-2 policy allow-c-2-c match destination-address any
set security policies from-zone private-2 to-zone private-2 policy allow-c-2-c match application any
set security policies from-zone private-2 to-zone private-2 policy allow-c-2-c then permit
set security policies from-zone private-1 to-zone private-1 policy allow-g-2-g match source-address any
set security policies from-zone private-1 to-zone private-1 policy allow-g-2-g match destination-address any
set security policies from-zone private-1 to-zone private-1 policy allow-g-2-g match application any
set security policies from-zone private-1 to-zone private-1 policy allow-g-2-g then permit
set security zones security-zone private-1 interfaces vlan.1 host-inbound-traffic system-services ping
set security zones security-zone private-1 interfaces vlan.1 host-inbound-traffic system-services https
set security zones security-zone private-1 interfaces vlan.1 host-inbound-traffic system-services ssh
set security zones security-zone private-1 interfaces fe-0/0/1.0 host-inbound-traffic system-services all
set security zones security-zone private-2 interfaces vlan.2 host-inbound-traffic system-services ping
set security zones security-zone private-2 interfaces vlan.2 host-inbound-traffic system-services https
set security zones security-zone private-2 interfaces vlan.2 host-inbound-traffic system-services ssh
set security zones security-zone private-2 interfaces fe-0/0/6.0 host-inbound-traffic system-services all
set security zones security-zone Internet interfaces fe-0/0/0.0 host-inbound-traffic system-services https
set security zones security-zone Internet interfaces fe-0/0/0.0 host-inbound-traffic system-services ssh
set security zones security-zone Internet interfaces fe-0/0/0.0 host-inbound-traffic system-services ike
set security zones security-zone Internet interfaces fe-0/0/0.0 host-inbound-traffic system-services ping
set access profile dyn--vpn-profile client remote-vpn-client1 firewall-user password "password"
set access profile dyn--vpn-profile address-assignment pool dyn--pool
set access address-assignment pool dyn--pool family inet network P.G.0.0/24
set access address-assignment pool dyn--pool family inet range dynamic-range low P.G.0.100
set access address-assignment pool dyn--pool family inet range dynamic-range high P.G.0.105
set access address-assignment pool dyn--pool family inet xauth-attributes primary-dns A.C.D.65/32
set access firewall-authentication web-authentication default-profile dyn--vpn-profile
set vlans vlan1 vlan-id 3
set vlans vlan1 l3-interface vlan.1
set vlans vlan2 vlan-id 4
set vlans vlan2 l3-interface vlan.2
.........


Viewing all articles
Browse latest Browse all 17645

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>