Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an SSG-140 by Juniper (similar to a netscreen 25, just a newer version of ScreenOS and more physical ports).

I find setting up new VPN profiles to be a PITA. I have to follow a bunch of steps, test it out, etc etc.

I find running an SSH server is easier as far as new user set up (e.g. the user accounts are in active directory, and there are other easy tings about it.)

I really prefer the IPSec VPN, and prefer that the netscreen do all this work.

Currently I just have three VPN clients (one using a PC client, and two using dedicated netscreen boxes). I would like to support 3 more dedicated devices and a few more users.

How can I make this easy as pie to administer and manage?

share|improve this question

closed as primarily opinion-based by Magellan, TheCleaner, Scott Pack, squillman, kce Oct 17 '13 at 3:58

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 2 down vote accepted

We are handling 80+ vpns (site to site) on a SSG140 using Route based VPNs. We've set up a tunel interface for each VPN purpose, next it's mainly a three steps conf.

  • Setting up a routing entry
  • Setting up a AutokeyIKE and Gtw.
  • Modify/add the corresponding filtering rule or policy group object containing your remote Networks.

Note that this can be achieved with dynamic peer addresses for VPN failover.

Also with use Dialup Policy based Vpns for the roaming users.

Hope this helps.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.