I'm trying to set up a config very similar to the one described here:
https://kb.juniper.net/InfoCenter/index?page=content&id=KB28198
which is basically: route-based VPN between SRX and ASA with multiple subnets behind SRX and single subnet behind ASA.
Difference in my situation is I need to set up 4 subnets behind the SRX as opposed to 2 in the example. I think that means similar setup to example, but creating 3 virtual-router instances as opposed to 1.
Anyway, I think I understand the example, but I had some questions I hoped someone could answer:
* It seems to me the interface-routes object, the rib-groups object and the policy-statement object are all required to allow the return traffic to 192.168.3.0/24 subnet in its own virtual router.
If that is the case, why does the rib-group import both inet.0 and ASA.inet.0?
Should it not just need import ASA.inet.0 which actually has the route to 192.168.3.0/24?
Secondly, I have some questions about the policy statement:
* In my case, I have 4 subnets behind SRX I want to pass over vpn. Can I just add extra subnets as term 2, term 3, term 4 in the existing policy-statement?
* the route-filter in the policy-statement has an 'exact' suffix after the subnet. Is that required?
In my case, one of the subnets I want to permit over the vpn is a /20 with 16 /24s within. How should I create the route-filter? As a /20 but without the 'exact'? would the 'orlonger' match type be what I should be using?
Why would you put in the 'exact' in any case?
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp
https://kb.juniper.net/InfoCenter/index?page=content&id=KB28198
which is basically: route-based VPN between SRX and ASA with multiple subnets behind SRX and single subnet behind ASA.
Difference in my situation is I need to set up 4 subnets behind the SRX as opposed to 2 in the example. I think that means similar setup to example, but creating 3 virtual-router instances as opposed to 1.
Anyway, I think I understand the example, but I had some questions I hoped someone could answer:
* It seems to me the interface-routes object, the rib-groups object and the policy-statement object are all required to allow the return traffic to 192.168.3.0/24 subnet in its own virtual router.
If that is the case, why does the rib-group import both inet.0 and ASA.inet.0?
Should it not just need import ASA.inet.0 which actually has the route to 192.168.3.0/24?
Secondly, I have some questions about the policy statement:
* In my case, I have 4 subnets behind SRX I want to pass over vpn. Can I just add extra subnets as term 2, term 3, term 4 in the existing policy-statement?
* the route-filter in the policy-statement has an 'exact' suffix after the subnet. Is that required?
In my case, one of the subnets I want to permit over the vpn is a /20 with 16 /24s within. How should I create the route-filter? As a /20 but without the 'exact'? would the 'orlonger' match type be what I should be using?
Why would you put in the 'exact' in any case?
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp