I have two juniper firewalls, an SSG-320M (screenos) and an SRX 340 (junos). I'm required to connect to a third party with an IPSEC VPN, however I'd like some additional protection from my firewall.

I'd like to apply an access list to an IPSEC tunnel. I've used a policy based and route based VPN. In each case I'm asked to specify the services but this appears to have no effect. I'm not sure if I need to bind a tunnel interface into a separate zone or if I should be using another feature altogether.


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 7:55

1 Answer 1


I wanted a route based VPN, but I bound my tunnel interface to the trust zone rather than the untrust zone so my access lists didn't work. It's amazing what happens when you follow the instructions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.