Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been assigned to establish a Internet IPsecVPN connection between two sites using Cisco ASA5505
A site currently has following setup.(Same setup is expected in another site)
Internet----->ADSL Router----->Juniper SSG5----->Intranet
(Im not sure what is configured on SSG5 and if router is in bridge mode or if NAT is configured)

I was thinking if I should install ASA5505 along with Juniper SSG5?
Internet----->ADSL Router----->Juniper SSG5----->Cisco ASA5505(for vpn only)------>Intranet
Internet----->ADSL Router----->Cisco ASA5505(for vpn only)----->Juniper SSG5------>Intranet

My question is if it is possible?
What should be the normal way to achieve this goal?


share|improve this question

I'm not sure what the point is with adding the 5505 to the location the Juniper is at.

The SSG5 can easily establish an IPSEC VPN with the 5505, I've done it multiple times with higher end SSG's and the code/cli is the same on the 5.

You'll need to setup the IKE negotiations and settings on both ends (remote gateways to connect to, policies or routes depending on type of VPN, etc.) but this is definitely doable and not hard to accomplish.

There are tons of walkthroughs online if you want help, such as:

share|improve this answer
>TheCleaner SSG5 is used for IP Phones. I assume that SSG5 is configured with VPN for those IP phones. I know that the VPN can be set up using the SSG5 but its client's requirement to place ASA5505. I dont know if it is possible to place ASA5505 behind SSG5 that is configured with VPN for IP Phones. – i_ch3ry Nov 5 '13 at 23:28
If you haven't already, you can (although if I were required to use the 5505, I'd simply remove the Juniper at that point altogether) put the 5505 behind the SSG5. You'd have to create a VIP on the Juniper to point to the 5505 outside port and set it's outside port to some random /30 network or similar. It's doable, but messy. – TheCleaner Nov 20 '13 at 22:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.