I want to setup a configuration for a Juniper SRX-1100.

I have an office where I need 3 site to site VPNs to two Cisco ASAa and one to a Juniper SSG 5. I also have work at home users who need to access the office servers via VPN. I also need the work at home users to access the remote servers across the site to site VPN's. The remote site to site networks are not under my control, they belong to our customers.

How do I do this?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12 '17 at 20:30

You'll configure and allow hairpin NAT on your SRX (http://kb.juniper.net/InfoCenter/index?page=content&id=KB24639&actp=search), make sure to allow the traffic from the VPN zone to the other VPN zones for services that are needed. Depending on your setup you'll either add the customer network list to the protected networks for split tunneling on the clients, if it's not split you'll don't have to add anything client side.

On the site to site VPNs you and your customers will have to add your VPN subnet to their cryptomaps so the client VPN traffic will be encrypted and forwarded to the remote sites.

If you are using a pulse appliance for the VPN the configuration could be more simple if you just NAT it out of the pulse box to an already trusted network, that way the traffic appears to the SRX as already coming from the inside and the client sites will already know of the network that it's coming from so no further configuration on their end would be needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.