O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

10.7. Interoperability

Problem

You want to create VPN connectivity with a Cisco router. You have noncontiguous subnets on each side of the tunnel, and you must maintain strict proxy ID matching on each SA.

Solution

Use a route-based VPN configuration with a unique Phase-2 SA for each pair of subnets that need to communicate across the tunnel. Policy-based routing is used to ensure that data enters the appropriate SA.

ScreenOS configuration

For the ScreenOS configuration, start by creating the zones and interfaces:

	S1-Denton-> set interface eth0/1 zone dmz
	S1-Denton-> set interface eth0/1 ip 10.10.12.254/24
	S1-Denton-> set interface eth0/1 route
	S1-Denton-> set interface bg0 zone trust
	S1-Denton-> set interface bg0 ip 10.10.10.254/24
	S1-Denton-> set interface bg0 route
	S1-Denton-> set interface eth0/0 zone untrust
	S1-Denton-> set interface eth0/0 ip 10.100.1.1/24
	S1-Denton-> set zone name vpn
	S1-Denton-> set interface tun.1 zone vpn
	S1-Denton-> set interface tun.1 ip unnumbered interface eth0/0
	S1-Denton-> set interface tun.2 zone vpn
	S1-Denton-> set interface tun.2 ip unnumbered interface eth0/0
	S1-Denton-> set interface tun.3 zone vpn
	S1-Denton-> set interface tun.3 ip unnumbered interface eth0/0
	S1-Denton-> set interface tun.4 zone vpn
	S1-Denton->set interface tun.4 ip unnumbered interface eth0/0

Now, configure the default route:

	S1-Denton-> set route 0.0.0.0/0 interface eth0/0 gateway
	10.100.1.254

Configure the Phase-1 gateway with a custom proposal:

	S1-Denton-> set ike p1-proposal ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required