I have a potential client I am offering a demo for and the network is shown in the picture attached.
The outer Juniper firewalls protect from the internet side. The ASG appliance has a static IP that can be reached from outside and the way we set it so the rules of the Juniper firewalls won't apply to it. The settings for the ASG appliance are as follows:
1. WAN Interface: the public IP address (Public IP 2) with the default gateway set as the Router's public IP (Public IP 1)
2. LAN Interface: the internal IP address range with no default gateway
3. Packet Filter Rules: Internal -to- Any (Web Surfing)
Any -to- Internal (VPN)
Internal -to- Any (VPN)
4. DNS: Global = Internal Network
Forwarders = ISP DNS (two of them)
Request Routing = Domain: client domain name
Target Servers: Client DNS 1 & DNS 2
5. DHCP: Relay was first enabled (Client DHCP server & both LAN and WAN
interfaces), then we disabled it
6. Web Security – HTTP Proxy: enabled with allowed networks set to Internal (Network) and the mode is set to Transparent
The purpose of the demo to do both Site-to-Site & Remote Access (SSL). We started with Remote Access SSL enabled with users allowed to access local network [Internal (Network)]. We managed to download the SSL client and connect to the ASG appliance. However, the ping command is not working for the internal network. That is when we do the VPN connection via SSL we can't ping anything in the internal network (the ICMP options were allowed in the ICMP tab inside the packet filter) except the ASG LAN interface. We don't want to change any of their DNS settings and default gateway neither for the servers nor for the users' workstations. For example, we had our test laptop with us and when we changed the default gateway and DNS for the laptop to point at ASG we managed to ping from outside (via the SSL VPN connection). We can get to the ASG appliance VPN via port 443 while we can't use the administration from outside, port 4444, which is enabled in the web admin settings in ASG setting "ANY" as the allowed networks. The internal Juniper firewalls have Any to Any enabled so they shouldn't stop us from getting to the Internal network.
If you could kindly direct us to where the problem is we would really appreciate it. Thank you in advance.
This thread was automatically locked due to age.
