<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2654.19">
<TITLE>RE: [j-nsp] FW: VPN 3005 concentrator 3DES to Juniper M20 [7:70444]</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Hi,</FONT>
</P>
<P><FONT SIZE=2>I have seen a related IPSec issue where juniper does not reassemble fragmented ESP packets; hence ES-PIC discards the packet due to not receiving all data.</FONT></P>
<P><FONT SIZE=2>Solution was to 'prefragment' the packets before encapsulating into ESP/AH - most Cisco routers have such an option; not sure what the Junos equivalent option is.</FONT></P>
<P><FONT SIZE=2>Also recommend what the other guy suggested; try pinging with increasing packet size to determine if an MTU issue exists - perhaps a firewall/router ACL is blocking ESP or AH protocol yet letting IKE through?</FONT></P>
<P><FONT SIZE=2>Regards,</FONT>
</P>
<P><FONT SIZE=2>Tony</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: Bosco Sachanandani [<A HREF="mailto:Bosco.Sachanandani@orange.co.in">mailto:Bosco.Sachanandani@orange.co.in</A>]</FONT>
<BR><FONT SIZE=2>Sent: Tuesday, 10 June 2003 20:13</FONT>
<BR><FONT SIZE=2>To: juniper-nsp@puck.nether.net</FONT>
<BR><FONT SIZE=2>Subject: [j-nsp] FW: VPN 3005 concentrator 3DES to Juniper M20 [7:70444]</FONT>
</P>
<BR>
<P><FONT SIZE=2>I have send this mail to the Cisco group too to get some insights.....would appreciate some feedback from you all too!</FONT>
</P>
<P><FONT SIZE=2>TIA</FONT>
<BR><FONT SIZE=2>Bosco</FONT>
</P>
<BR>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: Bosco Sachanandani </FONT>
<BR><FONT SIZE=2>Sent: Tuesday, June 10, 2003 2:21 PM</FONT>
<BR><FONT SIZE=2>To: cisco@groupstudy.com</FONT>
<BR><FONT SIZE=2>Subject: VPN 3005 concentrator 3DES to Juniper M20 [7:70444]</FONT>
</P>
<BR>
<P><FONT SIZE=2>Hey Group</FONT>
</P>
<P><FONT SIZE=2>I have a Cisco 3005 series concentrator box configured to run between my</FONT>
<BR><FONT SIZE=2>Externel router and Checkpoint firewall such that:</FONT>
</P>
<P><FONT SIZE=2>INTERNET Router -------> VPN 3005 --------> Checkpoint------LAN</FONT>
</P>
<P><FONT SIZE=2>This is one segment of my network. On another segment of the network I have</FONT>
<BR><FONT SIZE=2>a Juniper M20 router with an encapsulation card that is connected to the</FONT>
<BR><FONT SIZE=2>internet via a different ISP.</FONT>
</P>
<P><FONT SIZE=2>I have sucessfully established a 3DES IPSec tunnel between these too</FONT>
<BR><FONT SIZE=2>although I must admit that the freakin GUI interface of the VPN3005 sucks</FONT>
<BR><FONT SIZE=2>big time and is confusing compared to the ultra cool Juniper CLI. It took me</FONT>
<BR><FONT SIZE=2>a while to explore the damn hidden options in the GUI!</FONT>
</P>
<P><FONT SIZE=2>The problem is that although the tunnel is established, no data can pass</FONT>
<BR><FONT SIZE=2>through it! From what I have heard from a reliable source, there is some</FONT>
<BR><FONT SIZE=2>compatibility issue relating to the frame size and packet fragmentation when</FONT>
<BR><FONT SIZE=2>it arrives at the Juniper Interface. Juniper says that it's router's are</FONT>
<BR><FONT SIZE=2>designed for a high amount of Internet traffic and that packet fragmentation</FONT>
<BR><FONT SIZE=2>is not something a gateway router should be bothered about. However, they</FONT>
<BR><FONT SIZE=2>have suggested certain Cisco boxes like the 3662 that allows for packet</FONT>
<BR><FONT SIZE=2>fragmentation and other such stuff....</FONT>
</P>
<P><FONT SIZE=2>Any of you guys wanna shed some like on this and tell me how I can make the</FONT>
<BR><FONT SIZE=2>3005 talk to the M20??</FONT>
<BR><FONT SIZE=2>Thanks a ton</FONT>
<BR><FONT SIZE=2>Cheers</FONT>
<BR><FONT SIZE=2>Bosco</FONT>
</P>
<BR>
<BR>
<BR>
<P><FONT SIZE=2>Message Posted at:</FONT>
<BR><FONT SIZE=2><A HREF="http://www.groupstudy.com/form/read.php?f=7&i=70444&t=70444" TARGET="_blank">http://www.groupstudy.com/form/read.php?f=7&i=70444&t=70444</A></FONT>
<BR><FONT SIZE=2>--------------------------------------------------</FONT>
<BR><FONT SIZE=2>FAQ, list archives, and subscription info: <A HREF="http://www.groupstudy.com/list/cisco.html" TARGET="_blank">http://www.groupstudy.com/list/cisco.html</A></FONT>
<BR><FONT SIZE=2>Report misconduct and Nondisclosure violations to abuse@groupstudy.com</FONT>
</P>
<P><FONT SIZE=2>_______________________________________________</FONT>
<BR><FONT SIZE=2>juniper-nsp mailing list juniper-nsp@puck.nether.net</FONT>
<BR><FONT SIZE=2><A HREF="http://puck.nether.net/mailman/listinfo/juniper-nsp" TARGET="_blank">http://puck.nether.net/mailman/listinfo/juniper-nsp</A></FONT>
</P>
</BODY>
</HTML>