juniper ssg 550m

Posted: March 23rd, 2011 | Author: | Filed under: it, juniper, networking, pics | Tags: , , , | No Comments »

sweet !


juniper 5gt

Posted: February 24th, 2011 | Author: | Filed under: it, juniper, linux, networking | Tags: , , | No Comments »

say hello little sweet juniper 5gt for testing purposes; got her on 6.2.0r8 – not recommend by juniper but by now she runs stable 🙂

Ipsec tunnel / openswan <-> juniper ssg5

Posted: February 24th, 2011 | Author: | Filed under: debian, it, juniper, linux, networking | Tags: , , , , | No Comments »

finally got it working: building a bidirectional ipsec tunnel between a juniper ssg5 and openswan@debian, both sites got static ip adresses

openswan config:

conn juniper_ssg5_01
# Linux openswan
left= # expernal ip
# SSG 5
right= # untrust interface

juniper screenos config / route based config

set interface "tunnel.2" zone "Untrust"
set ike p1-proposal "g14-esp-aes256-sha" preshare group14 esp aes256 sha-1 second 28800
set ike p2-proposal "g14-esp-aes256-sha" group14 esp aes256 sha-1 second 3600
set ike gateway "Gateway for" address Main local-id "" outgoing-interface "ethernet0/0" preshare "mysecretpsk" proposal "g14-esp-aes256-sha"
set ike gateway "Gateway for" nat-traversal
set ike gateway "Gateway for" nat-traversal udp-checksum
set ike gateway "Gateway for" nat-traversal keepalive-frequency 0
set ike accept-all-proposal
set ike respond-bad-spi 1
set ike ikev2 ike-sa-soft-lifetime 60
unset ike ikeid-enumeration
unset ike dos-protection
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set vpn "VPN for" gateway "Gateway for" replay tunnel idletime 0 proposal "g14-esp-aes256-sha"
set vpn "VPN for" id 0x3 bind interface tunnel.2
set vpn "VPN for" proxy-id local-ip remote-ip "ANY"
set policy id 34 from "Trust" to "Untrust" "Any" "" "ANY" permit log count

screenOS or junOS ?

Posted: February 8th, 2011 | Author: | Filed under: it, juniper, networking, other | Tags: , , | No Comments »

thinking about the differences between ssg and srx juniper firewall devices. my main focus is on stability and usual features like VPN stuff. srx devices might deliver some more and better features (on the other hand i.e. lack of ipv6 support (but announced)); for me it seems like the ssg devices are more stable and i know that they can do what i need to do.  ssg5 i.e. has been started last year, the end of life of ssg series is far away (hope so). the administration stuff (console, web) has changed completely in junOS – another reason to stay on ssg devices.  anyway: i`m pretty sure in a few years junOS will be the choice …

right now i`m using a SSG550M / planning to replace several linux VPN gateways with SSG5 boxes

vmware / centos 5 network settings

Posted: January 29th, 2011 | Author: | Filed under: centos, it, networking, virtualization | Tags: , , , | No Comments »

copied vm centos 5 machines with fixed ip settings to a different esxi server. put the machines in a vm net with an active dhcp server. the centos machines switched at boot-time to dhcp and automatically disabled the fixed ip settings. centos creates a new interface configuration file with dhcp settings. the old config file is backed. why ? the mac adress has changed ! (vmware moving). to prevent this you should probably configure the mac adresses from the old esxi system or adjust the network cfg files on centos.

network map

Posted: January 25th, 2011 | Author: | Filed under: it, networking, other, pics | Tags: , , , | No Comments »

traffic map after one day … one the left side my machine 🙂