{"id":258,"date":"2017-08-13T17:14:03","date_gmt":"2017-08-13T21:14:03","guid":{"rendered":"http:\/\/puluka.com\/home\/?p=258"},"modified":"2017-08-13T17:14:03","modified_gmt":"2017-08-13T21:14:03","slug":"screenos-remote-site-uses-vpn-to-core-site-for-internet-access","status":"publish","type":"post","link":"http:\/\/puluka.com\/home\/networking\/screenos\/screenos-remote-site-uses-vpn-to-core-site-for-internet-access\/","title":{"rendered":"ScreenOS – Remote Site Uses VPN to Core Site for Internet Access"},"content":{"rendered":"

Product<\/strong>: ScreenOS SSG Series
\nVersion<\/strong>: 6.0 and up<\/p>\n

Network Topology:<\/h2>\n

Network diagram:<\/strong><\/p>\n

Two sites connect via IPEC VPN across the internet. The internet requests from the remote site are forwarded down the VPN tunnel to the core site and uses the core site internet access connection.<\/p>\n

\"\"<\/a><\/p>\n

Description:<\/h2>\n

Each site has internet access to establish the VPN connection. But all browsing from client machines on the remote site are directed to the core site. The process uses source based routing to force all requests from the remote LAN down the VPN to the core site gateway. On arrival at the core site the source address needs to be translated to a local core site LAN ip and then forwarded for internet access.<\/p>\n

The process utilizes IPSEC VPN in route mode, source based routing and address translation.<\/p>\n

    \n
  1. Create an IPSEC VPN between sites<\/li>\n
  2. Configure source routing on the remote site<\/li>\n
  3. Configure the address translation for the remote LAN on the core site<\/li>\n<\/ol>\n

    Zone Layout<\/h3>\n

    untrust interface is ethernet0\/0<\/p>\n

    trust interface is bgroup0<\/p>\n

    tunnel.1 interface is in trust zone<\/p>\n

    This zone layout puts all sites and tunnels into the same security zone.\u00a0 No policies need to be created on any device for full communications across the entire core and remote network.\u00a0 This is assuming that intra zone blocking is NOT enabled on any of the firewalls for the trust zone.\u00a0 This is the default behavior for the trust zone. You can change the zone of the tunnel interface to untrust and create policies as needed to allow traffic.<\/p>\n

    Configuration<\/h3>\n

    1. Create IPSEC VPN Between Sites <\/em><\/strong><\/p>\n

    Create the tunnel.1 interface on each site as unnumbered and associated with bgroup0. This is the same on both sites.<\/p>\n

    CLI<\/strong>
    \nset interface tunnel.1 zone Trust
    \nset interface tunnel.1 ip unnumbered interface bgroup0
    \nSet routes to these tunnel interfaces for each site<\/p>\n

    CLI
    \nCore site<\/strong>
    \nset route 10.0.2.0\/24 interface tunnel.1 gateway 10.0.2.1
    \nRemote Site
    \nset route 10.0.1.0\/24 interface tunnel.1 gateway 10.0.1.1<\/p>\n

    WEB
    \nCore site<\/strong>
    \nNetwork \u2013 Routing \u2013 Destination
    \nNew button
    \n10.0.2.0\/24
    \ninterface tunnel.1
    \ngateway 10.0.2.1<\/p>\n

    Remote Site<\/strong>
    \nNetwork-Routing \u2013 Destination
    \nNew button
    \n10.0.1.0\/24
    \ninterface tunnel.1
    \nGateway 10.0.1.1<\/p>\n

    WEB<\/strong>
    \nNetwork \u2013 Interfaces \u2013 List
    \nNew tunnel interface in the upper right
    \nTrust zone
    \nUnnumbered with the bgroup0 interface
    \nCreate the VPN gateways<\/p>\n

    CLI<\/strong>
    \nCore Site<\/strong>
    \nset ike gateway Remote-GW address 2.2.2.2 Main outgoing-interface ethernet0\/0 preshare juniper sec-level standard<\/p>\n

    Remote Site<\/strong>
    \nset ike gateway Core-GW address 1.1.1.1 Main outgoing-interface ethernet0\/0 preshare juniper sec-level standard<\/p>\n

    WEB
    \nCore Site<\/strong>
    \nVPNs \u2013 AutoKey Advanced \u2013 Gateway
    \nCreate new gateway
    \nName Remote-GW
    \nIP: 2.2.2.2
    \nAdvanced button
    \nPreshared key: juniper
    \nOutgoing interface ethernet0\/0<\/p>\n

    Remote Site<\/strong>
    \nVPNs \u2013 AutoKey Advanced \u2013 Gateway
    \nCreate new gateway
    \nName Core-GW
    \nIP: .1.1.1.1
    \nAdvanced button
    \nPreshared key: juniper
    \nOutgoing interface ethernet0\/0
    \nCreate AutoKey IKE Objects<\/p>\n

    Core Site
    \nCLI<\/strong>
    \nset vpn Remote gateway Remote-GW sec-level standard
    \nset vpn Remote bind interface tunnel.1<\/p>\n

    WEB<\/strong>
    \nVPNs \u2013 AutoKey IKE
    \nCreate New
    \nName Remote
    \nAssociated gateway Server-GW
    \nAdvanced button
    \nTunnel interface tunnel.1<\/p>\n

    Remote Site
    \nCLI<\/strong>
    \nset vpn Core gateway Core-GW sec-level standard
    \nset vpn Core bind interface tunnel.1<\/p>\n

    WEB<\/strong>
    \nVPNs \u2013 AutoKey IKE
    \nCreate New
    \nName Core
    \nAssociated gateway Core-GW
    \nAdvanced button
    \nTunnel interface tunnel.1<\/p>\n

    2. Configure Source Routing on Remote Site<\/strong><\/em><\/p>\n

    Enable source routing on the trust virtual router<\/p>\n

    CLI<\/strong>
    \nset source-routing enable<\/p>\n

    WEB<\/strong>
    \nNetwork \u2013 Routing \u2013 Virtual Routers (edit trust-vr)
    \nCheck box – Enable Source Based Routing
    \nCreate a rule to forward all LAN traffic down the VPN tunnel<\/p>\n

    CLI<\/strong>
    \nset route source 10.0.2.0\/24 interface tunnel.1 gateway 10.0.1.1<\/p>\n

    WEB<\/strong>
    \nNetwork \u2013 Routing \u2013 Source (new button upper right)
    \nNetwork: 10.0.2.0\/24
    \nInterface: tunnel.1
    \nGateway: 10.0.1.1<\/p>\n

    3. Configure the address translation for the remote LAN on the core site <\/strong><\/em><\/p>\n

    Create a standard web access policy from trust to untrust using policy based source nat.<\/p>\n

    CLI<\/strong>
    \nset policy from Trust to Untrust Any Any ANY nat src permit log<\/p>\n

    WEB<\/strong>
    \nPolicy \u2013 Policies
    \nSelect trust to untrust (new button upper right or edit the existing general policy)
    \nSource: any
    \nDestination: any
    \nAction: permit
    \nLogging: checked
    \nAdvanced button
    \nSource translation: checked for egress interface<\/p>\n

    Verification:<\/h2>\n

    Confirm internet access on remote site and observe translations in the policy log on the core site.<\/p>\n

    References:<\/h2>\n

    ScreenOS Concepts & Examples Guides<\/h3>\n

    http:\/\/www.juniper.net\/techpubs\/software\/screenos\/screenos6.2.0\/index.html<\/a><\/p>\n

    Route based VPN tunnels<\/strong>
    \nVolume 5 Virtual Private Networks
    \nChapter 3 VPN Guidelines
    \nChapter 4 VPN: Sit-to-site VPN Configurations<\/p>\n

    Source Based Routing<\/strong>
    \nVolume 7 Routing
    \nChapter 2 \u2013 Source Based Routing Table<\/p>\n

    Network Address Translation <\/strong>
    \nVolume 8 Address Translation
    \nChapter 2<\/p>\n

    Originally Posted May 22, 2011
    \nLast Revised on May 22, 2011<\/p>\n","protected":false},"excerpt":{"rendered":"

    Product: ScreenOS SSG Series Version: 6.0 and up Network Topology: Network diagram: Two sites connect via IPEC VPN across the internet. The internet requests from the remote site are forwarded down the VPN tunnel to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-258","post","type-post","status-publish","format-standard","hentry","category-screenos"],"_links":{"self":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts\/258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/comments?post=258"}],"version-history":[{"count":1,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts\/258\/revisions"}],"predecessor-version":[{"id":260,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts\/258\/revisions\/260"}],"wp:attachment":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/media?parent=258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/categories?post=258"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/tags?post=258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}