Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a two-parter:
I set up a LAN to LAN VPN yesterday (following this juniper kb article) and it was almost working, so I found another guide and went through the process of making route entries for the static IP addresses, after that everything was working fine. This morning, I got up and it was no longer functional.

Upon further inspecting the settings, I found that my routing entries didn't look quite right. On site-A's firewall I used the settings:

  • site-B's Static IP (let's say 12.345.67.89) which is the IP address I can ping
  • Subnet mask 30
  • Gateway site-A's Static IP (987.654.32.10)
  • Interface e0/0

I reversed these settings for site-B, though site-A's subnet is different.

The problem is that the routes come up with a different IP/Netmask entry, where on site-A settings, site-B's Static IP reads 12.345.67.87. Similarly, site-B's settings read site-A's Static IP as: 987.654.32.08. In short, the issue is that the last two digits of the IP address is 2 less than what I initially entered.

  1. Is it normal for the ip addresses to display differently like that?
  2. Does anyone have any suggestions as to why my VPN is no longer functional?

Using just the Juniper KB article, I am able to create an almost functional VPN where both firewalls report an Active tunnel. Also, my DHCP server (a Windows machine) shows entries for the workstations on site-B, but I cannot ping them nor can they browse the internet, ping me, or access their networked drives (which are hosted at site-A).

Both sites use a Juniper SSG5 firewall

Thanks in advance for any help!

Edit - Providing more information

From any computer on site-A, I can ping two private IP addresses that are on site-B: which is the interface ip address for bgroup0 on the site-B firewall and which is a workstation that the site-B office can't seem to physically locate.

From any computer on site-B, pinging a private IP addresses on site-A ( gets no reply.

When logged into either firewall via PuTTY I cannot ping any of the LAN ip addresses (eg pinging from site-A to site-B, and pinging from site-B to site-A, but I can ping the static WAN IP addresses of each device.

The 2nd article that I reference suggests that I needed to also create routes for the static IP WAN addresses, those are the addresses that I'm referring to in my OP. The netmasks that I'm using I obtained from each site's ISP. Site-A's netmask is 29 and Site-B's netmask is 30

share|improve this question
up vote 0 down vote accepted

Didn't I answer your questions the other day in regards to this? Was the question deleted?

The CIDR entries you created would set it that way because of the mask.

If you are putting a mask of /30 then technically the first one (albeit the 2nd octect isn't valid) should be similar to: -, with .88 as the route/network and .89 and .90 valid hosts and .91 the broadcast address.

You need to make sure your subnets and routing entries follow proper subnetting.

In short for setting up the VPN:

  1. Setup the tunnel with the two WAN addresses, ike settings, etc.
  2. Setup the routes - each side should have routes to the remote sides LAN subnets with the gateway being the tunnel
  3. The policies should be setup to allow traffic from the local LAN subnets to the remote LAN subnets and vice versa...this should be done on by FWs.


OK, after looking at the diagram here's what I see:


  • It looks fine. You don't really need the Proxy ID settings (at least it appears you have some with the Local and remote IP ranges), but if you do, that's fine.


  • You should have two sets of policies, one for "TRUST TO UNTRUST" and matching bidrectional policies for "UNTRUST TO TRUST". You should setup policy elements for the 2 LANs on both firewalls. Something like "Florida LAN" = and "Michigan LAN" =
  • Then the policies on the Michigan side should be "TRUST TO UNTRUST" Source = "Michigan LAN", Destination "Florida LAN", Service = ANY, Action = TUNNEL, Tunnel = "Florida VPN", check the box for "matching bidirectional policy". That should create a TRUST TO UNTRUST and an UNTRUST TO TRUST policy on the Michigan SSG5 to tunnel. You will want to create the same thing on the Florida side, this time with source being "Florida LAN" and destination being "Michigan LAN", but same type of policy (action=tunnel, tunnel=Michigan VPN)


MICHIGAN SSG5 (note: I'm assuming you have only one WAN link, and that the current default route points to the gateway being

  • trust-vr should have an entry for the local LAN to know how to get to it. Make sure there is a " with gateway there or at least a "C" meaning connected in protocol entry for that

FLORIDA SSG5 (same note as the Michigan one)

  • trust-vr should have an entry for the local LAN to know how to get to it. Make sure there is a " with gateway there or at least a "C" meaning connected in protocol entry for that

All that said...

  1. You don't need static routing entries for your WAN ISP connections.

  2. I think your main problem comes down to the fact that your Florida LAN subnet is but your bgroup1 ip is which is in the middle of that subnet, ideal would be for it to be and not .50. On BOTH sides, make sure the workstations default gateway is correct. For the Michigan side they should be all set to and on the Florida side they should be set to

Assuming all of the SSG5 vpn, policy, and routing entries are correct, I'm betting the problem lies right there, with the default gateways on the computers.

share|improve this answer
Yes you were helping me the other day and thank you very much for doing so, as well as providing input today. I'm sorry, I did delete the post, I was told that I'm not supposed to have a question with a long comment thread. Also, I was getting confused as the problem seemed to grow. When I follow the three steps that you have listed (which are very similar to the kb article), I cannot get site-B online and they cannot access their mapped network drives. I've provided an Edit to the OP, if you could read it and give me your thoughts I'd be very grateful – Kyle May 2 '12 at 18:06
If you can provide a network drawing with LANs, switch IPs, firewall IPs/ports, etc. then I can provide you more detail. Otherwise, you'll probably need to reach out to Juniper TAC if you don't already know how to setup flow filters and debug traffic to see what is happening. – TheCleaner May 2 '12 at 19:09
Thank you, I will make a diagram and add it to another comment with a link. – Kyle May 2 '12 at 19:26
I've created the diagram and added it as an edit to the op. I didn't include policy information, but I'm certain I have that correct. Please let me know if there's anything else you need. – Kyle May 2 '12 at 20:39
I've updated my answer. – TheCleaner May 3 '12 at 14:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.