5

I have a client with 5 sites, each using their own private LAN subnet.

They are currently using a service provider to link their branches and for Internet breakout centrally. I need to break them out to the Internet temporarily at another branch, over the existing WAN. I cannot configure the current WAN. My plan is to drop SRX devices at the 5 sites and give them a local LAN IPs, then create a VPN tunnel to the main SRX's local LAN IP. Then route traffic to the main site and breakout to the Internet at the main site.

Since they can ping and route to each over over the existing WAN, this should work?

Can I terminate the VPN on the local LAN IP? I will have to create static routes on the site SRXs to use the existing site gateways to get to the main SRX to initialise the tunnel, and then route all other traffic over the tunnel?

Can I get some pointers?

I have played around with some success, some tunnels did connect but data not flowing etc.. I need to get my head around this first..

Improve this question
4
  • to clarify you want to essentially create a vpn-mesh using the LAN interfaces and dropping the srx in between the current WAN & LAN and then route the traffic statically to a new breakout location. .. can you confirm and provide more detail about what issues you are experiencing with the tunnels currently.
    – DrBru
    Jul 11, 2013 at 11:23
  • Yes, keeping the existing Cisco WAN Routers, I add an SRX on the inside of the local LANs of the various sites. Then try and build a tunnel between the SRXs. I have a diagram, how can I publish it here?
    – Shawn Gradwell
    Jul 14, 2013 at 5:32
  • @ShawnGradwell you can edit your question and click on the insert image button to add it. Otherwise upload it to a free hosting site and add the link. Here's an example of how to do it
    – bigbash
    Jul 18, 2013 at 14:26
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 19:37

1 Answer 1

Reset to default
2

Actually I think most of what you are trying to achieve is answered in that document: http://www.juniper.net/us/en/local/pdf/app-notes/3500192-en.pdf

Since this kind of setup requires two routing instances (one flow based and another packet based) you should be able to use a local "LAN" IP on both sides of the SRX as long as you use two different interfaces.

The SRXes you need to use must be of "HighMemory" type IE: SRX100H (not SRX100B) to be able to support GRE fragmentation.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.