We have a Cisco 2900 router that we use for VPN, and it's connected to a Comcast business modem. The LAN ip is

I also have a Junipe SRX550 firewall that I want to use for VPN, and it's also connected to the same Comcast business modem. The LAN ip is

The VPN works on the Cisco 2900 router, but not on the Juniper SRX550. I've had Juniper look at my config, and everything is correct. I was looking at the modem, and I noticed that I have the (Cisco) LAN ip on it for port forwarding, I'm guessing I need to add (Juniper) LAN ip also?

What does port forwarding do? I did not setup the Cisco router.

enter image description here

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 10:04

Port forwarding is a mechanism for use with NAT.

In essence, it says that incoming data directed to a given port should be forwarded to an internal address on a given port. In your situation, incoming packets, both TCP and UDP ports 500 and 4500, arriving at the Comcast router from outside, will get forwarded to the internal .2: your Cisco router.

You can't forward the same packets to two internal addresses. If you want, you'll have to run your VPN on different external port numbers for the second VPN, though you should be able to keep the port numbers the same on the Juniper .3. This of course means the other end has to open the VPN to a different port number.

An alternative is if you have several external IP addresses, in which case you could use one for the Cisco and one for the Juniper, on the natural VPN port numbers.

  • The Comcast modem have 4 LAN ports. The Cisco is connected to one, and the Juniper is connected to a different LAN port on the Comcast modem. So if I understand correctly, I can just addd to the port forwarding, and use different port numbers. – Matt Damoz Nov 20 '18 at 13:57
  • ... as far as the port forwarding goes, that's correct. What is going to be at the other end of the VPN connected to the Juniper? Are you able to configure the remote ports for that? – jonathanjo Nov 20 '18 at 16:26
  • I'm trying to add port 500 for the SRX550 VPN, but it won't let me because, port 500 is already taken for the Cisco VPN. I can use port 501 for the Juniper SRX550, would that work? – Matt Damoz Nov 20 '18 at 16:39
  • Just to repeat from my answer: you can't forward the same packets to two internal addresses. If you change the forwarded port numbers, you have to change the configuration of the other end of the VPN to match. What's at the other end? – jonathanjo Nov 20 '18 at 17:51
  • ok thank you. I understand I can't use port 500 again since it's already taken. The other end is the Juniper SRX550. I hope I'm answering your question correctly. I'm new to VPN. So for Juniper SRX550, I'm using port 551, so I need to tell Juniper SRX550 port 551 is for VPN? – Matt Damoz Nov 20 '18 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.