Ali, perfect. Thanks.

Creating a tunnel from a subnet to subnet doesn’t necessarily mean you will have access to every computer or service on the other side. In a policy based tunnel you will have to create a policy after a tunnel is created to allow access from one side to the other. Therefore, you can have the provider’s IT limit their policy to allow your subnet access to those IP’s only instead of creating a two way any-any policy. There might be other ways of doing that but this is what I would recommend.

As far as multiple IP’s, you can either create three policies or add the IP’s in Policy Elements, then select Multiple when you are creating the policy.

Ali,

I need you expert advise. I have to connect my office site with a service providers site over site to site ipsec vpn tunnel. I’m using juniper ssg5. Now the service provider is not giving me access to their subnet but to specific host ip’s within their network eg.192.168.4, 192.168.1.9 and 192.168.1.11.

So how do i configure these remote ip details in the AUTOKE IKE screen of the Pase 2 proposal because on that screen it allows you to enter only 1 remote ip /netmask ?

Just to add more flesh to my earlier post,
Site-to-Site VPN is Route-Based (configured on router A btw internet interface in untrust zone and remote peer device; Dialup VPN is Policy-Based and the remote clients have access to all resources on the LAN but as earlier indicated, do not have access to resources on LAN B.

Hi Ali,

Am a newbie to the Juniper world and my enquiry is similar to one raisd by Murtuza. Forgive if I missed the answer. Site-to-Site IPSEC VPN exists between LAN (router)A and LAN (router)B. Client VPNs terminate on router A but have no connection to LAN B. Appreciate your help