Hi everyone,I bought recently a SRX5308 firewall. I want to achieve a Client to Gateway IPSec VPN with this device. I used the VPN Wizard to configure the Gateway and I installed the Netgear VPN Prosafe client on a Windows 7 computer. I can open the tunnel but I get two issues :* When the tunnel is open, I can't go on Internet (DNS fails)* I can't ping any host in the remote LAN, even the VPN gateway.I made some tests and I found that the client ping packets reach the LAN host I want to ping, the LAN host send its reply to gateway, but gateway doesn't arrive to send packets to the client.What should I do to solve my problem ?Thanks for your help.

IPsec tunnel will only uses local internet traffic for http etc IPsec tunnel will not resolves PC name via tunnel unless you use modeconfig with own DNS serverIPsec needs 2x public and 2x private with BOTH side different LAN subnet (ex, 192.168.50.x and 192.168.60.x)

IPsec tunnel will only uses local internet traffic for http etcThis means that client http requests cross the VPN tunnel ?IPsec tunnel will not resolves PC name via tunnel unless you use modeconfig with own DNS serverSo, I have to use modeconfig if I want to go on Internet while tunnel is open ?IPsec needs 2x public and 2x private with BOTH side different LAN subnet (ex, 192.168.50.x and 192.168.60.x) It's already done. I also created a static route between the gateway and the client.

Http will NOT use IPSec . Local where client is connected Only SSL-VPN in full tunnel

If HTTP doesn't use the IPSec tunnel, why I can't go on Internet when the tunnel is open?

No static route needed. Post screenshots of what you did.

IPSec VPN with SRX5308 | NETGEAR Communities

49 Replies

franck_martin2
Aspirant
May 30, 2013
these are the screenshots of my settings.

VPN policy:

IKE policy:

Client parameters:
franck_martin2
Aspirant
May 31, 2013
I deleted ALL my configurations, static routes, ...

I used the VPN Wizard to create a policy. I used two differents subnets for VPN and LAN.

I configured the Netgear VPN client. I can open the tunnel and go on Internet while the tunnel is open. But when I type "ipconfig /all" on the remote client, I can see that the tunnel interface doesn't have any gateway. How can I set a gateway for the tunnel?

Thanks for your help.
jmizoguchi
Virtuoso
May 31, 2013
192. is private.. SHOW ...
also show FQDN if you are not using dyndns alias

Only public IP of last octet should be masked
franck_martin2
Aspirant
May 31, 2013
I found it's normal that the tunnel doesn't have any gateway. But my problem is I can't ping any remote host. I think the problem is VPN packets aren't routed to LAN. Am I right? How can I solve it?
jmizoguchi
Virtuoso
May 31, 2013
192. is private.. SHOW ...
also show FQDN if you are not using dyndns alias

Only public IP of last octet should be masked
franck_martin2
Aspirant
Jun 03, 2013
Hi everyone,

Here is my VPN configuration, for the gateway and for the client. There are no static routes.

VPN policy:

IKE Policy:

Client parameters:

I can open the tunnel, but I can't ping a LAN host. Where is the problem? Routing between VPN and LAN?

Thanks for your help.
jmizoguchi
Virtuoso
Jun 03, 2013
You can not use same LAN subnet in not side

Ex
129.168.1.x and 192.168.50.x
jmizoguchi
Virtuoso
Jun 03, 2013
SRX is 192.168.1.x ..

What is the remote LAN subnet ?
franck_martin2
Aspirant
Jun 03, 2013
The remote LAN subnet is 192.168.1.0 /24. So it's different from the LAN one.
jmizoguchi
Virtuoso
Jun 03, 2013
won't work

It has to be different.

Forum Discussion

IPSec VPN with SRX5308

49 Replies

Related Content

Getting SRX5308 VPN IPSec to work with Android (when using DynDNS)

Bridge 2 Networks with SRX5308 Help

SRX5308 IPsec Mode Config - [IKE] ERROR: No configuration found for...

SRX5308 nicht nachvollziehbare Protokolleinträge

Netgear SRX5308 SSL - Aufruf im Browser nicht möglich

NETGEAR Academy

ProSupport for Business