Juniper Networks - Need help troubleshooting my NetScreen device. - Knowledge Base

Browse Knowledge Base Categories

Printer Friendly

Need help troubleshooting my NetScreen device.

Knowledge Base ID:	KB7737
Version:	3.0
Published:	07 Oct 2008
Updated:	07 Oct 2008
Categories:	NS-5GT NS-5XT NS-25 NS-50 NS-204 NS-208 NS-500 IPSec ScreenOS

Synopsis:

The steps below provide assistance with troubleshooting a box-to-box NetScreen VPN configuration.

Solution:

Follow the Question/Answer links below for assistance with troubleshooting a box-to-box NetScreen VPN:

Step 1	Can you PING the remote firewall public interface IP Address? [How do I do this?]	If [Yes], go to Step 2
		If [No], go to Step 4
Step 2	Can you perform an extended PING from the trust network to the remote gateway's trust interface? [How do I do this?]	If [Yes], go to Step 3
		If [No], view the event log entries for the VPN and consult the following links for further assistance: How do I find the VPN Entry in the Event Log? How do I Edit Policies referencing a VPN? How do I ensure that the Phase 1 Proposals on both sides of a VPN Match? How do I check the Phase 2 Proposals on both sides of a VPN? How do I ensure that Pre-shared keys match Phase 1 configuration? How do I ensure that the Outgoing VPN Interfaces configured in Phase 1 match?
Step 3	Consult the following links for additional assistance: How do I confirm the VPN Status? How do I resolve VPN connectivity problems? Why can't I Map a Network Drive through the VPN? Why can't I see some computers in Microsoft's network neighborhood over a VPN?
Step 4	Is PING management enabled on the public interface of the firewall?	If [Yes], go to Step 5
		If [No], Click the appropriate interface for instructions on how to enable the functionality on the Public Interface or Trust Interface.
Step 5	Is there a route defined in the Virtual Router? The route should be defined on both firewalls to which the appropriate zone and public interface are bound. [How do I check this?]	If [Yes], go to Step 6
		If [No], Configure a route to the Virtual Router.
Step 6	Can you PING the gateway IP that is defined in the route to the remote firewall? [How do I do this?]	If [Yes], go to Step 7
		If [No], consult the following article for additional assistance: Why Can't I PING the Gateway IP?
Step 7	Can you PING any other public IP address? [How do I do this?]	If [Yes], consult the following article for additional assistance: What are some additional VPN Troubleshooting Steps?
		If [No], Verify connectivity with your ISP

Purpose:

Troubleshooting

Login assistance