Cisco :: Setup A Juniper VPN Into ASA 5520

Jan 25, 2012

I have a ASA 5520 with a functional IPSEC VPN using the Cisco VPN client. This allows my remote users (Staff) using laptops to come in from anywhere on the Internet and tunnel in. Works great.Next, we need to stand up a VPN over a Juniper SSG5 so that when we have groups working outside of our network, they can tunnel back into our network. If they were going to be coming from a known, fixed IP, or even netblock, we'd probably use Route-based setup from a Juniper SSG5 into the ASA 5520. But they may very well be coming from any IP. I am thinking this leads us to Site-to-Site VPNs- it won't be Network Client access obviously, nor will it be Clientless (browser-based).

View 9 Replies


ADVERTISEMENT

Cisco VPN :: Setting Up LAN To LAN Between ASA 5520 And Juniper Device

May 16, 2011

i am setting up a LAN to LAN VPN between Cisco ASA 5520 and Juniper device. its my first time i am setting this up. What will be the peer device of my device that i need to give to the other person.. is this the outside address of my device ?
 
Also with the setup i have made i am getting the follwong error msg:
 
IKE Peer: 81.45.22.222    Type    : L2L             Role    : responder     Rekey   : no              State   : MM_WAIT_MSG5
 
also i was getting Type: user intead of l2l - what does htis mean as well

View 8 Replies View Related

Cisco VPN :: VPN Tunnel Between ASA 5520 And Juniper Tears Down Intermittently

Feb 13, 2013

VPN tunnel between ASA 5520 ver 8.0(4) and a remote Juniper firewall keep tearing down during Phase 1 rekeying.  After the rekeying process fails, manually pinging one of the remote hosts that are proteced behind the Juniper firewall,initates the tunnel renegoation and rebuilds the tunnel successfully.
 
When the tunnel is down,  sh crypto isakmp sa shows no active SA for the remote peer.  That indicates the PHASE 1 negotation had indeed failed.When the tunnel is working, sh crypto isakmp sa indicates an IKE role of Responder - always.Clearly that also means Phase 1 negotation works only one way, i.e. negotation initated by the remote Juniper unit only.
  
Interestingly, the Syslog server logged the following SNMP trap messages at the time rekeying Phase1.Note, Line#2 and #7 and wrapped to the next line for easy of reading.
  
Line#1:   IP = Remote-Peer-IP-#, Starting phase 1 rekey
Line#2:   IP = Remote-Peer-IP-#, IKE Initiator: Rekeying Phase 1, Intf outside,
IKE Peer Remote-Peer-IP-# local Proxy Address N/A, remote Proxy Address N/A,  Crypto map (N/A)
Line#3:   IP = Remote-Peer-IP-#, constructing ISAKMP SA payload

[code]...
 
As I understand from the above syslog trap, the Responder ( the ASA unit this time) started Phase 1 rekey (Line #1).  It prepare a message to be sent to IKE Initiator, that it is about to start rekeying Phase 1 (Line #2). Down on the next line, it indicated that the local Proxy, remote Proxy and Crypto map as N/A ( not avaiable).Why would the ASA unit send N/A message as shown in Line#2, is that normal?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: How To Setup ACS 5.4 And Juniper J-Web

May 29, 2013

I have set up an ACS 5.4 box and have some test devices connected to it.Cisco and Juniper, both working fine using TACACS I can connect to both using SSH or Telnet but my problem is the J-Web Juniper GUI I can access the J-web no problem with the root account. i can not seem to get it to work, no matter what I try. Here is my shell from the ACS box And the following Juniper configuration.  I have tried binding the local-user-name attribute to both the remote and remoteadmin with no luck.
 
version 9.6R1.13;
system {
host-name Juniper-Firewall;
authentication-order [ tacplus password ];
root-authentication {
encrypted-password "$1$1tRuy9o2$LwSPxNwe4XGNMOMIMo1pd1"; ## SECRET-DATA

[code].....

View 17 Replies View Related

Cisco VPN :: Setup Tunnel On 1721 Router To Juniper Srx 240?

Mar 27, 2011

Is it possible to set up a vpn tunnel on a 1721 router that uses the following ios:
 
c1700-y7-mz.124-13b.bin
  
I thought I had read somewhere that tunnels were not supported on the 1700s but wanted to make sure. If they are I would like to know if they are supported in the above ios.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: 5520 How To Setup Another Access Policy 5.3

Jan 30, 2012

I am new to v5.3, and I am not good at VPN.I just have my consultant to configure this correctly just today. Currently, there is only one rule for the access policy (Single Result Selection). That rule is to use Active Directory as the source for the authentication. And by default will deny any other access which is not found in the rule.Now... I just got an order that I need to setup a new user who will need to access to our network by using Cisco IPSec VPN (the software one). But that user is not setup in our Active Directory, and we do not want him to access our domain anyway. He only needs to access non-domain resourse...such as airconditioning controller by IP. So I am thinking to setup his account by using "internal identtity". If I do this way, what do I need to do to setup another access policy? May you give me some steps with little more details? OR... if it is not the way I should do...what else can I do to achieve this goal? Also, he said he could provide his static IP trying to access from. I have a ASA 5520.

View 4 Replies View Related

Cisco Firewall :: Setup ASA 5520 To Correctly NAT Over Two Wan Links

Jan 18, 2012

I need to setup an ASA 5520 to correctly NAT over two wan links. The idea sounds pretty straingforward but it does not, I have only 2 IPs that are involved with the NAT
 
192.168.1.10(Nated Server) -- 172.16.1.10(Web Server)
 
I have 2 interfaces that sould be applied to it let's say outside1, outside2. The server is reacheable through each outside interface, the outside interfaces is selected uppon dynamic routing and that is working OK.
 
So if link outside1 is up the Nat follows this schema 192.168.1.10(inside) -- 172.16.1.10(outside1)
 
that works fine, but I want that automagically changes over when the link outside1 is down to 192.168.1.10(inside) -- 172.16.1.10(outside2).I know I can't have a NAT with 2 IPs and 2 different interfaces (ASDM doesn't allow me to), is there a way to implement this??

View 22 Replies View Related

Cisco Firewall :: Setup NAT With ASDM On ASA 5520 For A Client?

Sep 15, 2011

I want to setup NAT with ASDM on ASA for a client and I can not make it work. I have several interface:
 
Inside: 10.97.0.1 / 24
Outside: 10.0.1.70 /24
Interco: 192.168.6.1 /24
Other Sites: 10.26.0.4 /24
 
All routing in the network is Ok My customer want to access a server @ ip 10.194.70.1 in https on the interface Interco with his nat address as 10.97.0.11 .This server must be accessible with the address 10.97.0.11:443 from interfaces inside, outside and other sites.And source address must be nated with original destination address 10.97.0.11 to be redirected on 10.194.70.1.

View 7 Replies View Related

Cisco Firewall :: Setup Of IPSec Passthrough On ASA 5520

Mar 28, 2012

I am working on IPSec Passthrough on an ASA 5520, with version 8.3, and ASDM 6.3. Currently I have a requirement for users in my internal network (10.10.249.128 / 25) to be able to connect to external IPSec VPN servers.
 
So I created a network object with 10.10.249.128 / 25, and used dynamic PAT to translate the source ip address to the external internet facing outside interface:

I then added the following rules on the inside-in ACL: However troubleshooting shows that isakmp is passing through the firewall, but esp and ah is not.
 
For isakmp:
 
For ESP:Seems like the nat rule is drawing my ESP traffic,

View 1 Replies View Related

Cisco WAN :: ASA 5520 / Setup A Log Dump That Could Happen Daily Or Perhaps Weekly?

Nov 4, 2012

I am running two ASA 5520 routers synched up with eachother. I had a massive connectivity issue this weekend that I am investigating. Now I have figured out how to get the live logging but I need to know how to get the old logs from my router.Also I am looking to set up a log dump that could happen daily or perhaps weekly.

View 1 Replies View Related

Cisco VPN :: 5520 - Setup Environment That Allows Users To Use Dameware To Connect

Feb 23, 2012

I have been tasked with attempting to setup an enviroment that allows users to VPN from home and use Dameware to connect, from home, to another machine in another users home that is VPN'd into the same network. Is this possible?
 
We are using 2 5520 ASA's and CiscoAnyConnect.

View 1 Replies View Related

Cisco VPN :: ASA 5520 - Setup Clientless Access To SharePoint 2010

Aug 3, 2011

We have a 5520 ASA running 8.4(2). We are trying to setup Clientless VPN access to our SharePoint 2010 environment. We have most of it working, however there are a few things that do not function right in SharePoint via the VPN but function fine internally. Are there any special things to configure specific to SharePoint? Some of the things that do not work include the SharePoint ribbon, up level function, opening of documents within SharePoint, etc.

View 3 Replies View Related

Cisco Firewall :: 5520 Running 8.4(2) - Setup Active / Standby Failover

Jan 30, 2012

I am trying to setup an active/standby failover with 5520's running 8.4(2) and am having problems with it not dropping connections during the failover. I am using a portchannel from the switch to each ASA and using sub-interfaces off that. I'm using the command Failover mac address Port-Channel1 “mac-address on primary Port-Channel1” “mac-address on standby Port-Channel1”.The command goes through but doing a show interface port-channel1 doesn't show a change in the mac address on the secondary unit after a failover when it becomes active.

View 3 Replies View Related

Cisco Wireless :: LAG Between WLC And Juniper EX-4200

Sep 1, 2011

I'm trying to enable LAG between WLC and a Juniper switch EX-4200 but it is not working.
 
In the lab i managed to enable LACP between Cisco 2960 and juniper EX-4200 and works with the atached configs that i found on juniper forum. Also LACP between Cisco 2960 and WLC works with te same config, but never between the WLC and Juniper. I've tried with passive mode and slow mode, always seems that juniper is not seeing the WLC BPDUs. I tried with WLC 4402 and 5508 both with 7.0 firmware.

View 4 Replies View Related

Cisco WAN :: WAN Design Using Juniper SRX 2800

Jan 10, 2011

Local LAN is connected with cisco 2800 router and SRX 210 Firewall, currently all LAN segment will go to my Data Center via ISP A and all internet traffic from LAN segment will go to internet via SRX firewall, there is no relation/connection between cisco router and SRX firewall. I have separate AS no. s for both the ISP

I am having attached scenario. based on current one I would like to do following.

1. I need to use PBR at LAN Switch ( its L3 Switch) such that in normal scenario - local VLAN traffic is equally distributed on both ISP.
2. dedicated internet traffic will flow through ISP B only and if WAN link of ISP B goes down, the internet traffic will pass through ISP A.

( in normal scenario, ISP A will utilized 100 % for LAN traffic to reach it to DC but once ISP B link goes down, the b/w of ISP A will be divided to route 50% traffic for LAN segment to DC and rest 50% traffic of LAN segment to internet)

View 2 Replies View Related

Cisco VPN :: ASA 5505 To Juniper Switch

Jun 25, 2012

Any known issues connecting an ASA to a Juniper switch?
 
We have a remote site where we have an ASA 5505 installed set up running EzVPN.  We do not have not have control/access to the internet connection or the internal infrastructure.  We basically have an office within their building.  Our ASA has one of their external IP addresses and is connected to thier Juniper switch.  Our pc's/printers are patched to another Juniper switch which is uplinked to our ASA.  The issue we are having is that the connection is intermittently dropping where we cannot ping the pc's/printers at the remote site through the VPN tunnel but we are still able to ping the external IP address of our remote ASA.  The strange thing is that we cannot manage the ASA via SSH or ASDM using the outside interface but can ping it when this occurs.  For the most part the VPN tunnel does not drop when we check the sessions at the headend although it occasionally will.

View 6 Replies View Related

DIR-655 Untangle And Juniper VPN Client

May 30, 2011

I decided to switch away from my DIR-655 wireless router due to multiple issues and go with an Untangle box. Everything appears to be set up great... except when it comes to my VPN connection to work via Juniper VPN Client v. 6.5.0.15507. For some reason, the VPN connection keeps dropping every 3-5 minutes and I have to wait for it to either reconnect, or sometimes the client completely stops and I have to restart it.

View 16 Replies View Related

Cisco VPN :: VPN To Juniper ISG 1000 Dropping Packets

Aug 1, 2012

I have ASA 5510 with 8.4 connected to ISG 1000, when traffic is passing the VPN tunnel is working fine, when the traffic stops, ASA will drop the packet but the VPN tunnel on ISG still up .When new traffic started from ISG side, it will drop, as the tunnel is not up on ASA side.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Authentication Radius Juniper NSM?

May 24, 2011

I am trying to authenticate on Juniper NSM express using cisco ACS 5.2.  The request is arriving at the cisco ACS but i am getting the following error.RADIUS requests can only be processed by Access Services that are of type Network Access.

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 Authorization With Juniper WXC-3400

May 5, 2013

In the process of migrating from ACS 4.1 to ACS 5.3. Authentication works fine, but having issues with authorization on the Juniper WXC-3400 devices. In ACS  4.1 we were passing TACACS+Shell (exec) Custom attributes Privilege level=15, which allowed a user to login with read/write privileges. In ACS 5.3  tried setting the Shell Profiles common task to 15 for both Default and Maximum (one at a time, and together), as well as setting the Custom Attributes for priv-lvl=15 (with and without Common Tasks set).
 
A capture shows Auth Status: 0x11  (ERROR).

View 15 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Radius Accounting From ASA And Juniper?

Apr 10, 2013

i changed from ACS 4 to ACS 5.2. Everything works fine but i have authentication failed in the Radius accouting reports every time when users connect through ASA or Juniper into our network. Juniper amd ASA only send accounting informations to ACS. The users are not configured on the ACS, authentication is done via external LDAP. So my question is why do o see authentication error on ACS because Juniper and ASA only send accounting packets ?

View 2 Replies View Related

Cisco LAN :: 3750 Switch To Juniper Firewall

Oct 6, 2012

We have a 3750 as core switch with critical oracle servers ( production & development ) connected to this. The goal is to have these servers behind a firewall, which is to be done by logically routing the traffic towards the device.Now, we need to connect the 3750 with two juniper srx firewall physically. The oracle server VLAN will be removed from 3750 and same layer 3 vlan will be created in the juniper firewall. How do i connect the 3750 to the two junipers. what configurations will be involved, on a logical basis.

View 11 Replies View Related

Juniper Core With Baystack Switches?

May 21, 2011

Is there any problems expected in working with core switch of Juniper EX8208 with access switches of Nortel Baystack5520 / 380 / 425 and 325? Whether the VLAN, Multicasting, streaming, STP, SNMP, etc will work without any issues?

View 2 Replies View Related

Juniper EX4200 - CA / CS Required To Deploy 802.1x?

Sep 26, 2012

Is a CA/CS required to deploy 802.1x? Google searches is confusing me with multiple answers. Im currently trying to test without a CA/CS and im having no luck.

Lab
2008 R2 DC
2008 R2 NPS
Juniper EX4200
User Win 7 PC

This is for a wired connection

View 3 Replies View Related

Cisco VPN :: 3825 And 878 With Juniper SRX3600 Shows Tunnel Down

Apr 16, 2013

We have VTI tunnels between Cisco (3825 and 878) and Juniper (SRX3600).Sometimes tunnel is going down and I should manualy shutdown and no shutdown tunnel interface to bring it up.This is logs from Cisco:%%crypto-4-recvd_pkt_inv_spi: decaps: rec'd ipsec packet has invalid spi for destaddr=X.Y.100.200, prot=50, spi=0xc5d07a33(3318774323), srcaddr=X.Y.100.100 ,%%crypto-4-ikmp_no_sa: ike message from X.Y.100.100 has no sa and is not an initialization offer.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Juniper JWEB Authentication Via TACACS To ACS 5.1?

Dec 20, 2009

Having an issue with authenticating Juniper J Series and SRX devices with ACS 5.1 The devices can authenticate using TACACS to ACS 5.1 via the CLI (telnet / ssh connections) but cannot using the JWEB management page.Doing packet captures between the Juniper devices and the ACS 5.1 box shows the Authenticate phase passing, but it does not progress onto the Authorisation phase.  There is nothing of interest in the ACS Logs (Even with the debugging levels turned right up) The same Access service is in use for both the CLI and GUI (JWEB).Using ACS 4.1, both CLI and JWEB authentication works.[URL]I'm thinking the issue is with ACS 5.0 / 5.1 and it maybe not liking the response from the Juniper (even though it should be the same mechanism)

View 6 Replies View Related

Cisco VPN :: Juniper Firewall To ASA 5540 Drops Every 45 Minutes

Oct 10, 2012

We have a VPN established between the above devices (I don't have more info on the Juniper as it's a client site) The Juniper initiates the VPN and all is well, tunnel is up all ok but approx every 45 minutes the VPN drops.
 
the tunnel parameters are set to keep it alive for 8 hours but that doesn't work.

View 4 Replies View Related

Cisco VPN :: 6500 VPN To Juniper Redundant Firewall Active

Jul 15, 2012

I am using 6500 with VPN Accelerator on this device.  I have a dozen other VPN connections GRE and IPSEC to routers and ASA and other Juniper Firewalls.
 
They all work perfectly.The error I get is map_db_find_best did not find matching map (Never seen this error be for) [code]I can't put the whole config for security reasons.

View 5 Replies View Related

Cisco Routers :: Rv042 As Vpn Behind Juniper SSG5 Firewall

Aug 25, 2012

I need to configure a new RV042 behind a SSG5 firewall. All VPN connections is client to gateway.
 
Firstly, i tried doing a direct connection(bypassing the firewall), the quickVpn status says connect but I can't even ping the rv. I suspect is due to client own ip is 192.168.1.x and the gateway ip is also 192.168.1.10. How do I resolve this such that users can connect anywhere without having to worry about clash of ip?

View 10 Replies View Related

Cisco AAA/Identity/Nac :: Juniper Netscreen Integration In ACS 5.1 Tacacs

Oct 21, 2011

I wants to inegrate Juniper netscreen firewall in Tacacs Cisco Acs 5.1.As I go through Juniper KB which mentioned that I need to enable Netscreen Service in Cisco ACS 5.1. how to enable Netscreen service in Cisco Acs 5.1 and how I got Further to integrate Juniper Netscreen Device in Cisco cs 5.1

View 2 Replies View Related

Cisco VPN :: 5510 IPSec Tunnel With Juniper Netscreens

Apr 25, 2011

I'm having an issue bringing a L2L tunnels up between my ASA 5510 and an ISPs Netscreens. I can establish the tunnels from my side by initiating traffic to the far end. The tunnels come up and stay up as long as there is traffic. Once the tunnels drop, they will not re-establish with inbound traffic. The only way to re-establish the tunnel is to send traffic outbound from our network. My ASAs are on ASA Version 7.0(8) in active/standby. [code]

View 2 Replies View Related

Juniper EX4200 / When Try To Reconnect Subnet For Switch Is Different?

Jan 4, 2013

I work for a small company and we just brought in a Juniper EX4200 switch so that we are able to test our SFP's and XFP's. I went through the EZSetup process however when I try to re-connect afterwards it just tells me that my subnet for the switch is different then the PC. I have tried assigning a static IP but that is not working for me either

View 8 Replies View Related

AAA/Identity/Nac :: Juniper Netscreen Radius Authentication With ACS 5.1

Jun 3, 2011

Several of my older netscreen devices only support radius authentication and I'm having trouble migrating them from ACS 4.2 to ACS 5.1. When I try to authenticate, the authentication passes in ACS but it doesn't log you into the Netscreen (you see a auth failure in the Netscreen logs). I believe that the custom attributes are not being passed from ACS to the Netscreen. The custom attribute we are trying to pass is "NS-Admin-Privilege" with type integer and a value of 2. The netscreen is setup so that the user privledges are obtained from the ACS server.
 
Any setup where they are using Cisco radius authentication to authenticate Netscreen devices?

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved