Customer Support Center

Route-Based VPN is up, but, not passing traffic (KB ID: KB5352)

Article ID:	KB5352
Former Article ID:	nskb1013
Published:	Jan 27, 2007
Last Modified:	Jan 27, 2007
Visible By:	Employee, PTAC, Partner, Customer, Public

Back to Previous Page | Knowledge Base Home

Article URL

http://kb.juniper.net/KB5352

Synopsis

The Route-Based VPN is not working although the Phase 1 and 2 negotiations are complete. A route is needed to reach a remote network across a site-to-site VPN via a tunnel interface. Confirm a route has been created to the tunnel interface for the VPN.

Problem

Environment:

Route based VPN

Symptoms & Errors:

Phase 1 IKE cookies established
Phase 2 SA established
VPN is not working
No traffic goes through the VPN

Solution

Make sure a route is provided for the destination network for the VPN.

Example: Two sites, with NetScreen-204 at each end. One site has internal network address 192.168.1.0. The remote network address is 10.1.1.0.

At Site A, for the VPN to work:

Create a tunnel interface. All VPN traffic will be routed through the tunnel interface

A static route needs to be added so the Firewall will know how to route the packet destined for network 10.1.1.0/24.

From the WebUI:

Click Network > Routing > Destination (or Routing Entries)

Select the appropriate Virtual Router, for this example choose untrust-vr, fom the pull-down tab next to the New button

Click New

Network Address: 10.1.1.0
Netmask: 255.255.255.0
Click Gateway button
Interface: tunnel.1
Gateway IP Address: IP address of Internet router

Click OK

From the CLI:

set vrouter untrust-vr route 10.1.1.0/24 interface tunnel.1 [Enter]

To verify the route, consult: KB4435 - How Do I Verify a Route to the Virtual Router?

Category Description

By Product » Hardware » Firewalls » NetScreen Firewall/IPSec VPN
By Product » Software » Network Operating Systems » ScreenOS Software
By Network Technology » IP Protocols » Tunneling Protocols

Purpose

Troubleshooting

Support Knowledge Base>Submit Feedback