Juniper NetScreen Policy for intra-vpn

Question

I have Netscreen25 and three networks ( zones ): central, branch office, dial-up vpn, IPs in central network are in 10.0.0.0/24 range, branch office in 10.0.10.0/24 range and dial-up vpn in 10.0.20.0/24 range.

I have no access to branch office's router but would like to be able to give dial-up vpn users ability to connect to branch office PCs from their VPN. They can successfully connect to central network's PC from dial-up vpn network and from central network to branch office PCs (there is a vpn set up between branch office and central network) but would like to make it easier for them to simply use RemoteDesktop to connect to 10.0.10.0/24 PCs directly from dial-up vpn.

Could someone give me some pointers what would be the best way to set up policy for this? Apologies for being brief but I am very new to network /Netscreen admin.

Answer 1

Whether or not this will depend on how the Branch Office router is set up. If there's a route from the Branch Office router to your NS25 for 10.0.20.0 (or if the NS25 is its default route), then you're good. Otherwise, return traffic from your VPN clients may be directed into the ether.

You need two things to make this work: routing and policies. I'm making a bunch of assumptions here, so if something doesn't work let me know.

Start with routes. Make sure you have a route for 10.0.10.0 and 10.0.20.0, each going out the correct interface. If they're in different virtual routers, you'll have to make a policy for that (comment if they are, because that's an extra few steps).

Then you need policies. You'll need two of them - one for the VPN->Branch Office, and one for the reverse. Set the policy view to be From the VPN zone, and To the Branch zone. Then create a new policy - match traffic from 10.0.20.0 (or some subset as appropriate) to 10.0.10.0 and set the Action to Permit. Once you've got that set, change your view to be From the Branch zone, and To the VPN zone. This time, the policy should be for traffic from 10.0.10.0 to 10.0.20.0. If you've got an IPSEC VPN on the connection between the NS25 and the Branch Office, the Action should be Tunnel.

As a postscript, I'll mention that network routing equipment like this is pretty critical, both in terms of maintaining uptime and network security. I'd recommend some training to get your feet under you - even with the nice web interface, the NS25 is still complex, and it's easy to accidentally change a setting that results in unexpected results!