I'm trying to set up a config very similar to the one described here: https://kb.juniper.net/InfoCenter/index?page=content&id=KB28198
which is basically: route-based VPN between SRX and ASA with multiple subnets behind SRX and single subnet behind ASA. Difference in my situation is I need to set up 4 subnets behind the SRX as opposed to 2 in the example. I think that means similar setup to example, but creating 3 virtual-router instances as opposed to 1. Anyway, I think I understand the example, but I had some questions I hoped someone could answer: * It seems to me the interface-routes object, the rib-groups object and the policy-statement object are all required to allow the return traffic to 192.168.3.0/24 subnet in its own virtual router. If that is the case, why does the rib-group import both inet.0 and ASA.inet.0? Should it not just need import ASA.inet.0 which actually has the route to 192.168.3.0/24? Secondly, I have some questions about the policy statement: * In my case, I have 4 subnets behind SRX I want to pass over vpn. Can I just add extra subnets as term 2, term 3, term 4 in the existing policy-statement? * the route-filter in the policy-statement has an 'exact' suffix after the subnet. Is that required? In my case, one of the subnets I want to permit over the vpn is a /20 with 16 /24s within. How should I create the route-filter? As a /20 but without the 'exact'? would the 'orlonger' match type be what I should be using? Why would you put in the 'exact' in any case? _______________________________________________ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp
