Junos OS

SRX345

Software Version    22.4R2.8

BIOS Version    3.12

Hey all. I have inherited the company setup and I am trying to work my way through this device. I have managed to come out on top with the tasks set, but this one isn't making sense.

One of our clients is wanting to setup a new VPN to move away from their current setup. The VPN is in place and connected. Static route has been setup to route all traffic for their new subnet down the ST interface. I have setup a static NAT that mirrors their current setup, ICMP traffic wasn't getting a response. This doesn't work for the entire subnet, but will work for individual IP Addresses.

What I have tried with the static NAT (all traffic from the new VPN):

Destination Address 192.168.220.0/22  -> Prefix 172.23.32.0/22 - doesn't work on the new VPN, but does on the current one.

Destination Address 192.168.223.0/24  -> Prefix 172.23.32.0/24 - doesn't work on the new VPN. Both devices (VM and my laptop) were on the 32.0/24 range.

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.240/32 - ICMP responded on the VM

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.214/32 - ICMP responded on the laptop

Unsure how there can be a rule that works for the current setup but the same rule doesn't work for the new setup. From what I have seen it's meant to be traffic per VPN. You can set the same rules on different VPN's

Any other ideas or information 

are you cutting over (removing related old vpn config) or just having two VPNs in parallel?

Depending on the config. NAT, Traffic Selectors, ProxyID and some other features do not work in parallel. Its either one or the other.

SRX345

Software Version    22.4R2.8

BIOS Version    3.12

Hey all. I have inherited the company setup and I am trying to work my way through this device. I have managed to come out on top with the tasks set, but this one isn't making sense.

One of our clients is wanting to setup a new VPN to move away from their current setup. The VPN is in place and connected. Static route has been setup to route all traffic for their new subnet down the ST interface. I have setup a static NAT that mirrors their current setup, ICMP traffic wasn't getting a response. This doesn't work for the entire subnet, but will work for individual IP Addresses.

What I have tried with the static NAT (all traffic from the new VPN):

Destination Address 192.168.220.0/22  -> Prefix 172.23.32.0/22 - doesn't work on the new VPN, but does on the current one.

Destination Address 192.168.223.0/24  -> Prefix 172.23.32.0/24 - doesn't work on the new VPN. Both devices (VM and my laptop) were on the 32.0/24 range.

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.240/32 - ICMP responded on the VM

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.214/32 - ICMP responded on the laptop

Unsure how there can be a rule that works for the current setup but the same rule doesn't work for the new setup. From what I have seen it's meant to be traffic per VPN. You can set the same rules on different VPN's

Any other ideas or information 

SRX345

Software Version    22.4R2.8

BIOS Version    3.12

Hey all. I have inherited the company setup and I am trying to work my way through this device. I have managed to come out on top with the tasks set, but this one isn't making sense.

One of our clients is wanting to setup a new VPN to move away from their current setup. The VPN is in place and connected. Static route has been setup to route all traffic for their new subnet down the ST interface. I have setup a static NAT that mirrors their current setup, ICMP traffic wasn't getting a response. This doesn't work for the entire subnet, but will work for individual IP Addresses.

What I have tried with the static NAT (all traffic from the new VPN):

Destination Address 192.168.220.0/22  -> Prefix 172.23.32.0/22 - doesn't work on the new VPN, but does on the current one.

Destination Address 192.168.223.0/24  -> Prefix 172.23.32.0/24 - doesn't work on the new VPN. Both devices (VM and my laptop) were on the 32.0/24 range.

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.240/32 - ICMP responded on the VM

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.214/32 - ICMP responded on the laptop

Unsure how there can be a rule that works for the current setup but the same rule doesn't work for the new setup. From what I have seen it's meant to be traffic per VPN. You can set the same rules on different VPN's

Any other ideas or information 

------------------------------
TYSON MOORE
------------------------------

Hi Tyson

I know you might have security concerns but you might need to post more info, maybe a config with the key data obfuscated.

one reason for a VPN just not working that used to catch me out was ..

it the st interface part of a zone  ? its easy to foget and hard to spot

for example

set security zones security-zone VPN_ZONE interfaces st0.0 

and for testing I would set up a policy that allow all traffic to and from your VPN 


 

------------------------------
JNCIE-ENT 907

Original Message:
Sent: 10-21-2024 14:02
From: TYSON MOORE
Subject: Issue routing VPN traffic

SRX345

Software Version    22.4R2.8

BIOS Version    3.12

Hey all. I have inherited the company setup and I am trying to work my way through this device. I have managed to come out on top with the tasks set, but this one isn't making sense.

One of our clients is wanting to setup a new VPN to move away from their current setup. The VPN is in place and connected. Static route has been setup to route all traffic for their new subnet down the ST interface. I have setup a static NAT that mirrors their current setup, ICMP traffic wasn't getting a response. This doesn't work for the entire subnet, but will work for individual IP Addresses.

What I have tried with the static NAT (all traffic from the new VPN):

Destination Address 192.168.220.0/22  -> Prefix 172.23.32.0/22 - doesn't work on the new VPN, but does on the current one.

Destination Address 192.168.223.0/24  -> Prefix 172.23.32.0/24 - doesn't work on the new VPN. Both devices (VM and my laptop) were on the 32.0/24 range.

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.240/32 - ICMP responded on the VM

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.214/32 - ICMP responded on the laptop

Unsure how there can be a rule that works for the current setup but the same rule doesn't work for the new setup. From what I have seen it's meant to be traffic per VPN. You can set the same rules on different VPN's

Any other ideas or information 

------------------------------
TYSON MOORE
------------------------------

Is this along the lines of what you're looking for?

***********************************************************

Security zone: xxxx_New_VPN
  Zone ID: 22
  Send reset for non-SYN session TCP packets: Off
  Policy configurable: Yes
  Interfaces bound: 1
  Interfaces:
    st0.500
  Advanced-connection-tracking timeout: 1800
  Unidirectional-session-refreshing: No

***********************************************************

And as it's currently in the testing phase, I already have it set for all traffic.

Hi Tyson

I know you might have security concerns but you might need to post more info, maybe a config with the key data obfuscated.

one reason for a VPN just not working that used to catch me out was ..

it the st interface part of a zone  ? its easy to foget and hard to spot

for example

set security zones security-zone VPN_ZONE interfaces st0.0 

and for testing I would set up a policy that allow all traffic to and from your VPN 


 

------------------------------
JNCIE-ENT 907

Original Message:
Sent: 10-21-2024 14:02
From: TYSON MOORE
Subject: Issue routing VPN traffic

SRX345

Software Version    22.4R2.8

BIOS Version    3.12

Hey all. I have inherited the company setup and I am trying to work my way through this device. I have managed to come out on top with the tasks set, but this one isn't making sense.

One of our clients is wanting to setup a new VPN to move away from their current setup. The VPN is in place and connected. Static route has been setup to route all traffic for their new subnet down the ST interface. I have setup a static NAT that mirrors their current setup, ICMP traffic wasn't getting a response. This doesn't work for the entire subnet, but will work for individual IP Addresses.

What I have tried with the static NAT (all traffic from the new VPN):

Destination Address 192.168.220.0/22  -> Prefix 172.23.32.0/22 - doesn't work on the new VPN, but does on the current one.

Destination Address 192.168.223.0/24  -> Prefix 172.23.32.0/24 - doesn't work on the new VPN. Both devices (VM and my laptop) were on the 32.0/24 range.

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.240/32 - ICMP responded on the VM

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.214/32 - ICMP responded on the laptop

Unsure how there can be a rule that works for the current setup but the same rule doesn't work for the new setup. From what I have seen it's meant to be traffic per VPN. You can set the same rules on different VPN's

Any other ideas or information 

------------------------------
TYSON MOORE
------------------------------

Yes :-)

Do you have a security association? I'm sure Juniper has a pretty good flow chart for troubleshooting VPNs. 

flowchart_kb10100.pdf

Is this along the lines of what you're looking for?

***********************************************************

Security zone: xxxx_New_VPN
  Zone ID: 22
  Send reset for non-SYN session TCP packets: Off
  Policy configurable: Yes
  Interfaces bound: 1
  Interfaces:
    st0.500
  Advanced-connection-tracking timeout: 1800
  Unidirectional-session-refreshing: No

***********************************************************

And as it's currently in the testing phase, I already have it set for all traffic.

Hi Tyson

I know you might have security concerns but you might need to post more info, maybe a config with the key data obfuscated.

one reason for a VPN just not working that used to catch me out was ..

it the st interface part of a zone  ? its easy to foget and hard to spot

for example

set security zones security-zone VPN_ZONE interfaces st0.0 

and for testing I would set up a policy that allow all traffic to and from your VPN 


 

------------------------------
JNCIE-ENT 907

Original Message:
Sent: 10-21-2024 14:02
From: TYSON MOORE
Subject: Issue routing VPN traffic

SRX345

Software Version    22.4R2.8

BIOS Version    3.12

Hey all. I have inherited the company setup and I am trying to work my way through this device. I have managed to come out on top with the tasks set, but this one isn't making sense.

One of our clients is wanting to setup a new VPN to move away from their current setup. The VPN is in place and connected. Static route has been setup to route all traffic for their new subnet down the ST interface. I have setup a static NAT that mirrors their current setup, ICMP traffic wasn't getting a response. This doesn't work for the entire subnet, but will work for individual IP Addresses.

What I have tried with the static NAT (all traffic from the new VPN):

Destination Address 192.168.220.0/22  -> Prefix 172.23.32.0/22 - doesn't work on the new VPN, but does on the current one.

Destination Address 192.168.223.0/24  -> Prefix 172.23.32.0/24 - doesn't work on the new VPN. Both devices (VM and my laptop) were on the 32.0/24 range.

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.240/32 - ICMP responded on the VM

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.214/32 - ICMP responded on the laptop

Unsure how there can be a rule that works for the current setup but the same rule doesn't work for the new setup. From what I have seen it's meant to be traffic per VPN. You can set the same rules on different VPN's

Any other ideas or information 

------------------------------
TYSON MOORE
------------------------------

SRX345

Software Version    22.4R2.8

BIOS Version    3.12

Hey all. I have inherited the company setup and I am trying to work my way through this device. I have managed to come out on top with the tasks set, but this one isn't making sense.

One of our clients is wanting to setup a new VPN to move away from their current setup. The VPN is in place and connected. Static route has been setup to route all traffic for their new subnet down the ST interface. I have setup a static NAT that mirrors their current setup, ICMP traffic wasn't getting a response. This doesn't work for the entire subnet, but will work for individual IP Addresses.

What I have tried with the static NAT (all traffic from the new VPN):

Destination Address 192.168.220.0/22  -> Prefix 172.23.32.0/22 - doesn't work on the new VPN, but does on the current one.

Destination Address 192.168.223.0/24  -> Prefix 172.23.32.0/24 - doesn't work on the new VPN. Both devices (VM and my laptop) were on the 32.0/24 range.

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.240/32 - ICMP responded on the VM

Destination Address 192.168.223.100/32  -> Prefix 172.23.32.214/32 - ICMP responded on the laptop

Unsure how there can be a rule that works for the current setup but the same rule doesn't work for the new setup. From what I have seen it's meant to be traffic per VPN. You can set the same rules on different VPN's

Any other ideas or information