Michael Dale

Place I used to work we used the DG834 for nearly all small clients. Quite reliable (unlike some earlier models) and supports some nice features for a cheap consumer grade all-in-one box.

Thanks for posting this, I used this as a baseline to connect a Netgear FVS318 to a NetScreen NS5XP. I noticed that with this setup, I can connect to my remote lan machines, but I cannot ping or access any web based management tools I have there...did you have this problem?

Hi Steve,

I haven't had this problem with my netgear. Although when I setup a Netcomm NB5580W I was unable to access its web admin page (or ping the device) through the VPN, yet everything behind it worked fine. This seems to be a bug within the netcomm firmware (which I think has been fixed, but I haven't tried the newer firmware).

When you say you cannot access any web based tools, do you mean on the remote vpn device or the computers behind the remote device?

For any computer on the lan which you wish to access you must have the gateway on them pointing to the vpn device.

Just out of curiosity, have you guys tried using 3DES on the NB5580W by any chance ? I just tested it and even when i select 3DES, it seems to always try and negotiate DES which in my case i am NOT allowing..

I'm wondering if the Netgear 3DES is broken ?

I haven't tried 3DES, although I can have a look into it. Which device are you more interested in, the netgear or the netcomm?

How can I force all traffic from the netgear site to go through the VPN tunnel.

You could try setting the subnet to 0.0.0.0/0

Am trying something very similar between mine and my parents. Both are using DG834G routers and using dyndns.org for FQDNs. I can activate the VPN tunnel no problem but I'm damned if I can connect to a remote node on the remote LAN or PING one. I don't even seem to be able to use the PING diagnostics tool in the router GUI to ping the remote router. 100% packet loss. Any ideas anyone?

What subnets are you using on each end?

hi..

considering doing the same thing but like you say need to be able to point VPN by host name (have seen the dns link you put - very handy) but do you know of a router apart from the juniper, and say for about £40 or $80 that would allow this in the configuration?

thanks in advance
vinny

Yeah the netgear in this post should be fine. The non wireless version should be in your price range, about $AU80 I think.

Hi Michael,

Thanks for your reply, didn't you mention above that the netgear only used "main mode" and if I only have a dynamic IP address then I need a router that can point at a hostname - which I think you said the netscreen enabled you to do. I have one router which is the netgear DG834 wireless and need to get another. DO I need another router that can allow me to point to a hostname?

thanks again
Vinny (UK)

Yes although it seems that you can point it to a host name.

See this screen shot.

I haven't tried it myself, but it should work.

Thanks for this walkthrough, it was really helpful, I was able to setup my site to site VPN between a Juniper SSG5 and a Netgear FVS318v3.

One setting not metioned in this walkthrough that ended up breaking my Phase 2 negotation was the "Proxy ID", which is specified in VPNs --> Autokey IKE --> Edit Your VPN Tunnel --> Advanced --> and Enable Proxy-ID. For Local IP/Netmask and Remote IP/Netmask I had to set this to be reverse (obviously) of the LOCAL LAN & REMOTE LAN settings on the Netgear Firewall.

I was also able to bump up the encyrption to AES128/SHA-1 without any problems.

Thanks Much!

Interesting. I didn't need to manually set the proxy-id. The netscreen normally works this out based on your polices.

Hi,

Anyone know the reason why I can't ping the firewall of one lan from the other?
I'm using NS-5 and Netgear dg834G.

Thanks.

Can you guide me in setting up the DDNS

The settings are under:
Network -> DNS -> DDNS (you need to enable Config DDNS Client, Enable DDNS Client)

The help page can be be found here (for ScreenOS 6):
http://help.juniper.net/help/english/6.0.0/nt_ddns_entry_edit_cnt.htm

If you don't want to use dyndns you need to set it up via the command line, more info here:
http://www.juniperforum.com/index.php/topic,4132.0.html

hi,
can i have the full steps in order to configure VPN connection between two site using juniper 5gt?
i am using dynamic IP address

Juniper offer a "Remote Firewall Configuration" service. More details can be found here.

I followed the instructions and both ends talking however, why I still couldn't get the subnet behind the juniper, which is mentioned on both configuration to access resources at netgear side. Anyone can enlighten me on this one? thank you

I'm going to need some more information. If you'd like to send me the configuration of the juniper netscreen and the netgear I can have a look.

Contact Form

Hi,

The configuration is exactly like what's on bluetrait, except my version of DG834 doesn't have enable NetBIOS tick box (this model is the one without wireless), no other VPN connection, plain vanilla configuration except on the DMZ zone which is irrelevant to this issue.

OR... should I put the rule on the top position?

the vpn rules should be before the any-any rules.

hi again,

when you mean before any any rule, is it deny any any or permit any any. By the way, I browse thru the manual but couldn't find the rule on netscreen implied rule, for example if the policy from trust to untrust is empty what's the implied rule, implicit deny or implicit accept.
btw, I got a funny problem outside this vpn, am trying to use webproxy and block trust to untrust connection, however, one pc needs direct outside connection then i enabled particularly for that pc. what happened is, the rest of the pc in the trust then can access directly. juniper cust support is helpful, but with this issue, they haven;t got back to me yet. got any idea, michael?

iman

Just make sure your vpn rule is at the top of the list (i.e it is the first rule to be run).

The netscreen has an implicit deny any any policy.

For your other problem is your source correct? Maybe you should email me your configuration.

Again, like the guy said above.
How do you VPN two Netscreen Routers.
I assume the netscreen configuation you have is to listen for the VPN request.
But in my case I need one netscreen (Dynamic IP/Hostname) to request the connection and the other netscreen (Static IP) to listen.

Hi,
Would I follow the same process if I wanted to set-up a Juniper VPN server for a windows based VPN connection ? Scenario like this. I'm on sky broadband with a DDNS.org set-up (dynamic IP). When I am at work in an alternate location I would like to use windows New network wizard to set-up a VPN using IP-SEC to my Juniper on it's DDNS set-up. Is this feasible since both ends will be on dynamis IP's ? Would this effectively put me on the local LAN so I could use DAAP on my Thecus NAS box ?
Any help appreciated.
Simon

Hi there,
Does anyone know how to route all traffic down the VPN tunnel at the Netgear end? The Netgear not let you enter 0.0.0.0 / 0.0.0.0 as the remote site. Sadly i suspect this is either not possible, perhaps only by hacking the Netgear box via the hidden telnet interface - i can think of no other way around it :( Can anyone help?

Like one of the guys above i had to set the proxy ID on the Netscreen manually before phase2 would complete, i think this is only required if you use a routed VPN (route traffic to a tunnel interface). Only with a policy based VPN does the Netscreen work things out itself.

Hi,

The VPN are established successfully, I see computers on the VPN (throught ping), i make "remote desktop" successfully but I can't share files and printers. Why? Someone knows what are happen with this connection?!

Thank you very much.

Hi,

Please can someone help?

I want to set up a site-to-site using 2 x Juniper SSG 20's. Do I just apply the same config as in these screen shots for the Junipers at both ends?

Hey Michael... I'm extending a HUGE **THANK YOU** for your insightful and largely helpful post. This was all I needed to get my SSG5 site-to-site up and running.

--As for the posts in regards to Windows print and file shares: be sure to modify your local machine firewalls. You'll need to add the new address scopes to your "local/home/trusted" zones/profiles.

Just a quick note:

Just because you are using DDNS services to create Host (A) record to point at a dynamic IP, does not mean FQDN authentication will work.

This is because a PTR record is different then an A record. FQDN Authentication uses Reverse DNS to check that the initiating peer's address matched the Fuly Qualified Domain Name specified in the target peers configuration.

For instance, lets say you are using Dynanic DNS from DynDns.org. Your IP is 4.5.12.22 and is registered correctly with DynDNS. Run nslookup from your Windows XP/2000/NT4/Vista workstation.

Type 4.5.12.22. (or your Public IP). You will notice that the result does NOT match your DynDNS name (server.dyndns.org).

This is because PTR records are controlled by the ISP. Lets say you have a static IP and you have mail server. Even though your Domain/DNS panel will let you point mail.mydomain.com to that public IP, the reverse DNS entry will reflect the ISP's entry - which is usually something like (ip)-(ip).city.network.domain.net.

When you have a Static IP, you can request that your ISP make a Reverse DNS entry for you so that the PTR record matches the A record. This is especially important for an email server since many email providers - like AOL - reverse DNS the sending SMTP server's IP to make sure that it matches the domain name of the email address' domain name to prevent SPAM.

What does this mean to you? Overall, you are better using Aggressive Mode (when available) with email address authentication if you have a dynamically-assigned IP address.

Trust me. I set these things up every day. It's a much better solution.

Jeremy Ward
Network Architect

Trust me

Hi Jeremy,

Thanks for your comment. I have not had this problem before and use this setup to a few of my family connections. I will need to look into it.

The main reason for using Main Mode auth is that the Netgear does not support aggressive mode.

Sorry, some how the words "Trust Me" were repeated after my name... I wasn't trying to sound that convincing ;-) - I should be more careful.

Anyhow, I did understand that the reason that you were using Main Mode authentication was because the Netgear did not support Aggressive mode.

The way I look at it is that if it's working for you, then all the better.

I posted my comment for the greater benefit of everyone else, not necessarily in response to your issue.

Given all of the talk about DynDNS, I figured that someone might attempt to use FQDN authentication in Main Mode an not understand why that might not work with a DynDNS host record.

Hope it's helpful!

it g8..topic..thanx

i want to create a VPN between sonic firwall to juniper.can you please explain me in detail.

thanx in advance

Thanks for the tutorial, Michael, it was very helpful.

it nice tutorial.

i am having a netscreen NS5GT ADSL router in my office. I need to creat a VPn between my home router(D-link +ADSL) & office.

can help me on this

Hi Michael Dale, i was going through your website, its really an amazing one. i was searching out for a resolution for one my office. I am from UAE. I have an application in my computer. I want to set up a VPN connectivity for this application to be accessed from branch office. i am using dsl line in both location with dynamic ip. i purchased a Juniper SSG 20 H device for the VPN connectivity. As i am new with this Juniper, i need a help to set up this device for my VPN connectivity. Can you help me on this. can show some relevent post regarding this. Thnaks in Advance.