Configuring a VPN between a Juniper Firewall and a Cisco PIX

Juniper tends to have pretty good documentation in their knowledgebase, on how to configure equipment for different situations. I recently had to setup a VPN between a Juniper SSG-140 (at HQ) and a remote Cisco PIX. Going to Juniper's knowledgebase, you would most likely come across the article: http://kb.juniper.net/KB4147 . This article describes setting up a “route-based” VPN between the two devices. I believe these directions would work if you were trying to connect one subnet on each end.

My particular setup required accessing two completely different subnets (10.204.0.0/16 and 192.168.0.0/16) at HQ to one subnet (10.99.0.0/16) at the remote site. I worked with JTAC for several hours, and they could not explain why it wasn't working with the above directions. The JTAC insisted we just needed an additional route to make it work… and couldn't explain why we couldn't get it working. At one point we were able to have the remote site connect to both subnets at HQ, but only one subnet at HQ could get back. It was an odd situation.

At this point most of my previous experience had been with the Cisco PIX, and I was confused by the Juniper. I then realized that the traditional Cisco PIX VPN implementation is NOT a route-based VPN, but is a policy-based VPN.

I completely deleted all previous work from the above directions and rebuilt the Juniper side with policies instead of the tunnel interface and routes. Everything worked perfectly and was much more reliable.

Juniper Policy Based VPN documentation:
http://kb.juniper.net/KB6694
http://kb.juniper.net/KB4124
http://kb.juniper.net/KB4757

netscreen, cisco, pix, firewall, vpn,

Leave a Reply

Your email address will not be published. Required fields are marked *