I have a Juniper SSG5 firewall I'm using for VPN at a remote site, and I'm using Shrew Soft VPN client to connect from my office to this site.

If I connect to the web GUI or SSH of the Juniper from the LAN at the remote site, there are no problems. However, if I try to connect to the Juniper web GUI or SSH through the VPN, it does not respond.

Further details:

  • Pinging the Juniper through the VPN works fine.
  • The VPN itself seems to be working ok - I can connect to other devices on the remote LAN (for example, I can connect to one of the other devices and SSH back to the Juniper).
  • Doing a debug all on the Juniper device shows nothing (neither does debug ike), however, I know the machine in my office is routing the connection attempts through the VPN as I can see the attempts in the log of the policy that allows VPN connections into the network.
  • The log mentioned above shows "Close - AGE OUT" for all my connection attempts (apart from ping, which is working ok).
  • The interfaces involved all have the web GUI and SSH enabled on them.
  • I don't have any IP access policies set up on the device.

I thought perhaps the problem was related to MTU, so lowered the MTU on the Juniper interface and removed SSL from the web GUI, but it doesn't help (pinging at 1500 MTU works though, so I assume that means MTU isn't an issue?).

I'm not really sure why else it wouldn't respond. I can't find anything about VPN connections being disallowed admin access, I can't see any settings to enable/disable VPN admin access.

The only other thing I think might be relevant is that I have the following setting configured for my VPN:

unset ike policy-checking

Anyone have any ideas?

Thanks in advance!

1 Answer 1


For some reason, switching from policy-based to route-based VPN fixed the issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .