{"id":337,"date":"2007-11-17T02:47:56","date_gmt":"2007-11-17T00:47:56","guid":{"rendered":"http:\/\/www.corelan.be:8800\/index.php\/2007\/11\/17\/juniper-setting-up-an-ipsec-vpn-tunnel-between-a-juniper-netscreen-firewallvpn-device-and-a-cisco-vpn-device\/"},"modified":"2007-11-17T02:47:56","modified_gmt":"2007-11-17T00:47:56","slug":"juniper-setting-up-an-ipsec-vpn-tunnel-between-a-juniper-netscreen-firewallvpn-device-and-a-cisco-vpn-device","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2007\/11\/17\/juniper-setting-up-an-ipsec-vpn-tunnel-between-a-juniper-netscreen-firewallvpn-device-and-a-cisco-vpn-device\/","title":{"rendered":"Juniper : Setting up an IPSec VPN tunnel between a Juniper Netscreen firewall\/vpn device and a Cisco VPN device"},"content":{"rendered":"
\n

Today, I will explain the (easy) steps to set up a route-based IPSec VPN tunnel between a Juniper Netscreen firewall\/VPN device and a remote Cisco device (such as Cisco ASA)<\/p>\n

If you are looking for more generic information on IPSec and building VPNs with Juniper, take a look at my blog post on VPNs with Juniper netscreen : Building IPSec VPN with Juniper Netscreen ScreenOS (CJFV)<\/a><\/p>\n

The example network used in this explanation looks like this :<\/p>\n

  <\/p>\n

\"111707_0952_JuniperSett1\"<\/a><\/p>\n

These are our goals :<\/p>\n

    \n
  1. \n
    Set up a two-way VPN between company A (behind the netscreen device) and company B (behind a Cisco device), using PSK, 3DES\/SHA1<\/div>\n

    PSK (Pre Shared Key) : AD230LdaiJDIdaz392382<\/span><\/li>\n

  2. Set up bidirectional routing from A-LAN1 to B-LAN1 and B-LAN2, no network address translation<\/li>\n
  3. Allow hosts from A-LAN2 and A-LAN3 to access B-LAN1 and B-LAN2, and use the netscreen firewall interface IP address in the WAN zone (eth0\/1 : 2.2.2.1) as source IP address<\/li>\n<\/ol>\n

    The public (internet) IP addresses of each vpn device are 3.3.3.1 (Netscreen, Company A) and 1.1.1.1 (Cisco, Company B)<\/p>\n

    I'm not a Cisco expert, but I can confirm that the setup on the Cisco device is pretty straightforward. You need to define the local and remote network objects (ACL), define Phase 1 and Phase 2 settings and then glue the information together into a VPN (crypto map).<\/p>\n

    We'll assume the following setup on the Cisco (may not be complete or in the correct order, but at least it shows the networks and the Phase1 & Phase2 settings) :<\/p>\n

    Name 3.3.3.1 CompanyA_VPN-Netscreen <\/span><\/p>\n

    object-group network CompanyA
    \nnetwork-object 10.1.1.0 255.255.255.0
    \nnetwork-object 2.2.2.1 255.255.255.255
    \nobject-group network MyCompany
    \nnetwork-object 192.168.1.0 255.255.255.0
    \nnetwork-object 192.168.2.0 255.255.255.0<\/p>\n

    access-list NONAT permit ip object-group MyCompany object-group CompanyA
    \naccess-list CompanyA permit ip object-group MyCompany object-group CompanyA <\/span><\/p>\n

    crypto map MyVPN 40 ipsec-isakmp
    \ncrypto map MyVPN 40 match address CompanyA
    \ncrypto map MyVPN 40 set pfs group2
    \ncrypto map MyVPN 40 set peer CompanyA_VPN-Netscreen
    \ncrypto map MyVPN 40 set transform-set MyVPN
    \nisakmp key AD230LdaiJDIdaz392382 address CompanyA_VPN-Netscreen netmask 255.255.255.255<\/p>\n

    isakmp policy 10 authentication pre-share
    \nisakmp policy 10 encryption 3des
    \nisakmp policy 10 hash sha
    \nisakmp policy 10 group 2
    \nisakmp policy 10 lifetime 28800<\/p>\n

      <\/p>\n

    On the Netscreen, you need to do this :<\/p>\n