Hi We need to access some of the servers of our busineess partner so I am trying to establish a VPN between our Netscreen Firewall and the partner ASA. Attached are configs and scenario for both. It's failing at Phase 1 . From netscreen side we are NATing (MIP) the private IP 192.168.16.100 to Public IP 199.67.102.2 which is also serving as the Peer Gateway IP for other end. From ASA side, they have 3 servers which needs to be accessed, but they just have one Public IP 100.12.166.28 which they are NATing to one of the servers. The ASA is managed by our partner and I believe that there is a mistake in their NAT and access list config. Kindly check both the attached configs and let me know where is the issue? Also, I dont want to use their private range i.e 10.15.3.x in my configuration as I have the same scheme in my local LAN so it possible that I could access all three of their servers with just one single System Public IP at their end? Thanks P.S: Actual IP addresses have been changed for security purpose -Raheel ... View more

Hi , We are upgrading our Network Infrastructre and I need your comments and help about the following case: Scenario: Two Links on the Site A Router (Receiving all National routes on 1st link from ISP-A and default route on the second link from ISP B)(ISP A will advertise our subnets only nationally on first link and ISP2 will advertise our subnet only internationally on the second link) Third link on Router B receiving default route from ISP B (on this link our subnet will be advertised both nationally and internationally) For our subnet advertisement to ISPs and Incoming load balancing, we will split our subnet into two smaller subnets that will be advertised on the edge routers in parallel with the summarized network. (abcde.com will be mapped to 2 IPs say .1 and .129) For Outgoing load balancing: We will run GLBP between the routers and the default route for the Active Firewall will be the GLBP VIP. So in this way we can have the Routers ACTIVE/ACTIVE. All 3 links would be active All traffic that reaches RouterA and matches the default route should go via ISPB. Traffic matching the national prefixes (in the routing table of Router A) should go through ISP A. All traffic that reaches R2 and matches the default route should go via ISPB (on this link our subnet will be advertised both nationally and internationally) Since all links will be active, failure to any link(national/international) will not affect Network availability nationally or internationally. I am not sure about: Will all sessions from the Active firewall be forwarded to same router even if we configure GLBP? or will it be load balanced between two routers? Can we map two public IP addresses to same domain? Splitting the Network into two halves is correct for incoming load sharing? P.S IP addressing has been changed due to security reasons ... View more

Hi! Please find attached diagram. I want  to have an opinion that which switch shall I replace the Cisco 2960s  with so as to elimintae the need for spanning tree in there but then what would be the design look  like between Netscreen and those new switches. Also would it be vendor independant to work Between Cisco and Netscreens/Cuberguard. Kind Regards, Raheel ... View more

Hi, We are in a process to replace our old end of life switches( mostly Cisco 2950's) with some new offerings from cisco. Attached is our current network diagram. Can you please provide a merit of using Cisco Nexus switches in this design and also what will be the benifit in doing so. Again I am asking about the specific benifits which I will get in my Network  not general benifits of nexus. Any help? Kind Regards, Raheel ... View more