Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Netscreen25 and three networks ( zones ): central, branch office, dial-up vpn, IPs in central network are in 10.0.0.0/24 range, branch office in 10.0.10.0/24 range and dial-up vpn in 10.0.20.0/24 range.

I have no access to branch office's router but would like to be able to give dial-up vpn users ability to connect to branch office PCs from their VPN. They can successfully connect to central network's PC from dial-up vpn network and from central network to branch office PCs (there is a vpn set up between branch office and central network) but would like to make it easier for them to simply use RemoteDesktop to connect to 10.0.10.0/24 PCs directly from dial-up vpn.

Could someone give me some pointers what would be the best way to set up policy for this? Apologies for being brief but I am very new to network /Netscreen admin.

share|improve this question
add comment

1 Answer

Whether or not this will depend on how the Branch Office router is set up. If there's a route from the Branch Office router to your NS25 for 10.0.20.0 (or if the NS25 is its default route), then you're good. Otherwise, return traffic from your VPN clients may be directed into the ether.

You need two things to make this work: routing and policies. I'm making a bunch of assumptions here, so if something doesn't work let me know.

Start with routes. Make sure you have a route for 10.0.10.0 and 10.0.20.0, each going out the correct interface. If they're in different virtual routers, you'll have to make a policy for that (comment if they are, because that's an extra few steps).

Then you need policies. You'll need two of them - one for the VPN->Branch Office, and one for the reverse. Set the policy view to be From the VPN zone, and To the Branch zone. Then create a new policy - match traffic from 10.0.20.0 (or some subset as appropriate) to 10.0.10.0 and set the Action to Permit. Once you've got that set, change your view to be From the Branch zone, and To the VPN zone. This time, the policy should be for traffic from 10.0.10.0 to 10.0.20.0. If you've got an IPSEC VPN on the connection between the NS25 and the Branch Office, the Action should be Tunnel.

As a postscript, I'll mention that network routing equipment like this is pretty critical, both in terms of maintaining uptime and network security. I'd recommend some training to get your feet under you - even with the nice web interface, the NS25 is still complex, and it's easy to accidentally change a setting that results in unexpected results!

share|improve this answer
    
Starting with routes, on the central office's Netscreen I can't see any route set up to '10.0.10.0' (branch) network but access to any pc from central network to branch office works fine? For '10.0.20.0' (dial-up vpn) there is a Static Permanent route with interface set as "tunnel.1" (I am unable to try if user's from central office can access PCs in the Dial-up vpn atm). I can see two virtual routers (untrust-vr and trust-vr) and the tunnel.1 route to '10.0.20.0' is on the trust-vr router. Untrust-vr doesn't seem to have any routes set up. –  Adam Apr 26 '12 at 15:18
    
Policy set up is a bit confusing to me because I am not sure which Zones to select as source and destination for new policy. Since both networks are set up on untrust interface, I would assume I need a policy from untrust to untrust (Untrust Intra-zone policy) with action set as Permit. I have set it up for 10.0.20.0 - 10.0.10.0 but unable to do so for reverse (branch office->DialUp VPN) with error message saying Dial-up VPN must use IPSEC or LT2P in policy. I cant see that action on the list? I agree with the training bit in your post. Asking question(s) on ServerFault helps me with that. –  Adam Apr 26 '12 at 15:30
    
Your situation seems complicated - you may need to find someone who can work on it directly (maybe a consultant). If you've got an IPSEC VPN running, then you need to change the Action to Tunnel rather than Permit. –  NathanG Apr 26 '12 at 21:53
    
Also: You'll need to change the VPN->Branch policy to have its Action be Tunnel - otherwise, the NS25 won't categorize the traffic correctly. –  NathanG Apr 26 '12 at 22:17
    
Thank you for your help, I will study a bit more and report back if I fix it. –  Adam Apr 27 '12 at 8:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.