VPN Pass-Thru

[pcfreakx]

Guys I have a Netscreen 5xp and I like to think I know what I am doing with it (but you can be the judge of that). I have 3 boxes NAT'd behind the NS. One does mail, one web and one I use for VPN to my corporate LAN. I have VIPs for the web and mail but for the life of me I can't figure out how to pass VPN through for the 3rd. NS support says I must use MIPs but then I can't host my web or mail like I currently am (I only have one public IP). I set up a rule/VIP to forward Protocols 50 and 51 and UDP 500 like I am supposed to but it won't go. Linksys and other cheaper vendors make a simple button that opens the rule, but NS support says a VIP only supports 16 ports and not the whole range (0-65535) that I need for 2 protocols (ESP and AH). What in the heck can I do? Get another public and MIP it? Put a hub upstream of the 5xp and hang off that? Thanks, . . .

Nick, CISSP

 

[danaarp]

Tragically, you need more public addresses. IPSec and PPTP do work just fine through the 5xp but not with VIP running and taking over the available IP.

 

[MarkhP]

I know its been a while since you posted this question, sorry I havent checked this forum for a while. If the question is still relevant. Assuming that you also have a Netscreen box at the other end, it is fairly straight forward (he says!). Create a Manual Key VPN definition at siteA & siteB that have a gateway address of the remote site untrusted IP address. Define an address for the remote site from each end with the internal IP range assigned to it (eg. siteA has an untrusted address as SITEB 10.0.0.0/255.0.0.0). Then create a policy that says traffic going from InsideAny to SiteB is to tunnel using the VPN you created earlier.

Any traffic destined for the internal network at the remote site will go via VPN. All other traffic such as web browsing will go out to the internet as normal.

Does that give you what you want?.

 

[pcfreakx]

Thanks for the advice. I should have been more clear. Actually we are using a software VPN product (ATT's Globalnet) that goes to an ISP's "cloud". Since it is a 3rd party, I have no real way of making a simple IPSEC compliant tunnel between 2 routing devices. It passes through fine as long as I forward EVERYTHING through the NS to my one internal IP. But when I use VIPs instead of MIPs to send different ports to different boxes, I can't get it to go at all. It breaks during key exchange. I have forwarded Protocols 50 and 51 (ESP and AH) and UDP 500 according to IPSEC standard. Any other ideas? It sux that my friends have cheap $100 devices that support it and mine won't do it!