Delete the "metric $METRIC" entry in the ‘Standard PPP options we always use’ section.

Cpstop then cpstart

This message has been scanned for malware by Websense. www.websense.com

Step 1: Stop all of the Websense Services on the Server you are working from:
Step 2: Please go into the Program Files\Websense\bin\ folder
Step 3: Open the Config.xml with Notepad or a similar text editor.
Step 4: Once the Config.xml is open please do a search for the phrase "K2097153"
Step 5: Edit the found container, removing all characters between these tags:
Example: <data name="K2097153">B71368719ACDE94648104686B2C44DD51E4F3E32C76A3B</data>
Step 6: Save the Config.xml file
Step 7: Rename the "config.xml.bak" (also in the bin folder) file to "config.xml.bak.original"
Step 8: Start all of the Websense Services
Step 9: Open the Websense Manager; you should be prompted for a username and password.

Saygılarımla.

This message has been scanned for malware by Websense. www.websense.com

How to defragment with the Eseutil utility (Eseutil.exe)

You can use the Eseutil utility to defragment the information store and director…

You can use the Eseutil utility to defragment the information store and directory in Microsoft Exchange Server 5.5 and to defragment the information store in Microsoft Exchange 2000 Server and in Microsoft Exchange Server 2003. Eseutil examines the structure of the database tables and records (which can include reading, scanning, repairing, and defragmenting) the low level of the database (Ese.dll).

Eseutil is located in the WinntSystem32 folder in Exchange Server 5.5 and in the Exchsrvr/Bin folder in Exchange 2000 and in Exchange 2003. The utility can run on one database at a time from the command line.

Back to the top

MORE INFORMATION

The defragmentation option makes used storage contiguous, eliminates unused stor…

The defragmentation option makes used storage contiguous, eliminates unused storage, and compacts the database, which reduces the database’s size. Eseutil copies database records to a new database. When defragmentation is complete, the original database is deleted or saved to a user-specified location, and the new version is renamed as the original. If the utility encounters a bad record, the utility stops and displays an error message.

Back to the top

Defragmenting an Exchange Server 5.5 database

Note Defragmenting a database requires free disk space equal to 110 percent of the size of the database that you want to process. To determine the actual space required, follow these steps:

1. Make sure that the information store service is not running.

2. At a command prompt, run the following command:

eseutil /ms “database.edb”

3. Calculate the free space by multiplying the number of free pages by 4 KB.

4. Subtract the figure that you obtained in step 3 from the physical size of the database.

5. The figure that you obtained in step 4 represents the data in the database. Multiply this figure by 110 %. The resulting figure that you obtain is the space that you need to have available to defragment the database.

6. Divide the figure that you obtained in step 3 by 9 GB per hour. The figure that you obtain is the approximate time that it will take to defragment the database.

Note 9 GB per hour is the speed at which the Eseutil utility runs. This number is only for reference. The exact number depends on your hardware and production environment.

To defragment the Exchange Server 5.5 database, follow these steps:

1. Stop the service of the database you wish to defragment by using the Services tool in Control Panel.

o For the Exchange Directory database, stop the Microsoft Exchange Directory service.

o For the Exchange Mailbox or Public Folder databases, stop the Microsoft Exchange Information Store service.

2. At the command prompt, change to the WinntSystem32 folder, and then type the eseutil /d command, a database switch, and any options that you want to use.

For example, the following command runs the standard defragmentation utility on the directory and saves the copy in the user-defined file:

C:winntsystem32> eseutil /d /ds /tc:dbbacktempdfrg.edb /p

Use one of the following database switches to run Eseutil on a specific database.

Option Description

Chekpoint R70 ile Pptp server bağlantısı kurulumunda çıkan problemlerin nedeni Gre servisine tanımlı bir protocol ün olmamasından dolayı bu servisin Napt yani port natlama işlemine tabi tutulamaması. Bu nedenden doalyı Pptp session ı server da düzgün sonlanamıyor. Bu sorunun giderilmesi için yaparak öğrendiğim adımları aşağıda tek tek gösteriyor olacağım;

1) RIP Tanımlamalarının Yapılması:

a) Dış (Real) Ip rip tanımlaması için SmartDashboard üzerinde yeni bir node açıyoruz. Bu kısımda Ip adresi bölümüne sahip olduğumuz dış ipmizi giriyoruz,

b)

c) İç Ip için rip tanımlamasını SmartDashboard üzerinde yeni bir node açıyoruz. Bu kısımda Ip adresi bölümüne sahip olduğumuz Checkpointin Dış bacağına bakan İç ipmizi giriyoruz,

Nat bölümüde ise herhangi bir natlama işlemi yapmıyoruz.

d) Pptp serverımızın rip tanımlamasını SmartDashboard üzerinde yeni bir node açıyoruz. Bu kısımda Ip adresi bölümüne sahip olduğumuz Pptp Serverımızın ipsini yazıyoruz,

Nat bölümünde ise bir önceki adımda oluştumuş olduğumuz Rip in ipsini static nat olarak giriyoruz.

Yeni Gre Servisinin Yaratılması;

Sonraki adımımız ise yeni bir service oluşturmak bu adımı Smartdashboard üzerinde service ler bölümünde “Other” services kısmında sağ tıklayarak new service diyerek başlatıyoruz. Servisimize bir isim verdikten sonra Ip Protocol kısmına “47” yazıyoruz.

Daha sonra Advanced bölümüne geçiyoruz. Bu kısımda ise “Match” kutucuğuna [22:2,b] = 0x880B yazıyoruz. Virtual Session TimeOut kısmını Other yaparak 600 sec. Yapıyoruz ve kaydediyoruz.

Firewall Rule larının Yaratılması;

a) Firewall rule larımızı yaratırken öncelikle “Source Any” —“Destination-(Cp-Pptp_Server-Rip)”— “Service-(Pptp_Tcp-Custom_gre)”— “Accept”Şeklinde yapıyoruz.

b) Hhemen altına bu rule un tam tersi olan “Source-( Cp-Pptp_Server-Rip)— “Destination-Any”— “Service-(Pptp_Tcp-Custom_gre)” — “Accept” rule unu oluşturuyoruz.

Nat Rule larının Yaratılması;

Nat rule oluştuturken de,

Original Packet bölümü “Source-(Dış İp Ripimiz)—“Destination-(İç İp Ripimiz)”— Service “Pptp_Tcp”

Translated Packet bölümüde ise tüm sekmeler “Original” kalacak şekilde ayarlayıp kaydediyoruz.

Tüm Adımlarımız tamamlandıktan sonra ise policy mizi apply ediyoruz. Artık Chekpointimize gelen “Gre” Packetleri başarılı şekilde Pptp Serverımıza iletiliyor ve vpn bağlantımız kuruluyor.

Written By Ahmet Keçeciler.

The integrity check in Eseutil is basically a test run of the repair function. Problems that repair would address will be reported in the <database>.integ.raw file. The .raw file logs results for all tables in the database, not just ones that have problems. For more information about the Eseutil integrity mode, see Eseutil /G Integrity Mode.

Note:

An integrity check may end prematurely if damage to the database is of such a nature that parts of the database must be repaired before other parts can be checked. The fact that an integrity check ends before it finishes does not necessarily mean that repair is unlikely to succeed. Although you can perform an integrity check after a dirty shutdown, we do not recommend this. You should recover the database to Clean Shutdown state before you run an integrity check if you can do so.

Procedure

To run Eseutil /G

• The basic command line syntax to run an integrity check with Eseutil is:

Copy Code

ESEUTIL /G database_filename.edb

For example:

Copy Code

ESEUTIL /G priv1.edb

Note:

There must be disk space available to the equivalent of 25 percent of combined size of the Exchange database (.edb) and streaming database (.stm) files. The streaming database must be in the same folder as the .edb file.

You may be faced with the following scenarios when you run an Eseutil /G integrity check on the database:

• Insufficient local drive space for temporary database
• Ignoring streaming database mismatches

Insufficient Local Drive Space for Temporary Database

Many of the integrity checks involve reconstructing indexes and other data inside a temporary database. Afterward, a comparison is done between the two databases.

If you do not have free disk space equivalent to 20 percent of the size of the files being checked, then there is greater likelihood of running out of disk space during the check. You can add this switch to the command to redirect the “scratchpad” database to a drive with more space:

/Tpath_to_temporary_database

For example:

Copy Code

 ESEUTIL /G priv1.edb /T\Server2d$scratchpad.edb

Note:

There is no space between the /T switch and the path specification. You can also use an ordinary drive letter path specification if desired.

Ignoring Streaming Database Mismatches

Exchange will detect whether a database and its streaming database are synchronized with each other. If they are not in synch, you can ignore the problem and force an integrity check to proceed regardless, by using the /I switch. For example:

Copy Code

ESEUTIL /G priv1.edb /I

If there are no SLV files (.stm or streaming database files) checksum errors reported in the .raw file output, then while the two files may be formally out of synch, the likelihood of successful repair and reintegration of the streaming file data is high.

Command line reference

The following is the command line reference that can be obtained by running Eseutil /? and then G from the Exchsrvrbin folder:

Copy Code

INTEGRITY:

 DESCRIPTION: Verifies integrity of a database.

 SYNTAX: ESEUTIL /g <database name> [options]

 PARAMETERS: <database name> - filename of database to verify

 OPTIONS: zero or more of the following switches, separated by a space:

 /s<file> - set streaming file name (default: NONE)

 /t<db> - set temp. database name (default: TEMPINTEG*.EDB)

 /f<name> - set prefix to use for name of report files

 (default: <database>.integ.raw)

 /i - bypass the database and streaming file mismatch er

ror

 /8 - set 8k database page size (default: auto-detect)

 /o - suppress logo

 NOTES: 1) Integrity-check does not run database recovery. If a

 database is in a "Dirty Shutdown" state it is strongly

 recommended that before proceeding with an integrity-

 check, recovery is first run to properly complete

 database operations for the previous shutdown.

 2) The /i option ignores the signature mismatch error if

 the database and streaming file do not match each other.

For More Information

For more information, see the following topics in the Exchange Server Database Utility Guide:

• Eseutil /D Defragmentation Mode
• Eseutil /P Repair Mode
• Eseutil /C Restore Mode
• Eseutil /R Recovery Mode
• Eseutil /M File Dump Mode
• Eseutil /K Checksum Mode
• Eseutil /Y Copy File Mode
• Database Recovery Strategies
• Reference for Common Eseutil Errors

This message has been scanned for malware by Websense. www.websense.com

This article describes how to transfer Flexible Single Master Operations (FSMO) roles (also known as operations master roles) by using the Active Directory snap-in tools in Microsoft Management Console (MMC) in Windows Server 2003.

FSMO Roles

In a forest, there are at least five FSMO roles that are assigned to one or more domain controllers. The five FSMO roles are:

• Schema Master: The schema master domain controller controls all updates and modifications to the schema. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the whole forest.
• Domain naming master: The domain naming master domain controller controls the addition or removal of domains in the forest. There can be only one domain naming master in the whole forest.
• Infrastructure Master: The infrastructure is responsible for updating references from objects in its domain to objects in other domains. At any one time, there can be only one domain controller acting as the infrastructure master in each domain.
• Relative ID (RID) Master: The RID master is responsible for processing RID pool requests from all domain controllers in a particular domain. At any one time, there can be only one domain controller acting as the RID master in the domain.
• PDC Emulator: The PDC emulator is a domain controller that advertises itself as the primary domain controller (PDC) to workstations, member servers, and domain controllers that are running earlier versions of Windows. For example, if the domain contains computers that are not running Microsoft Windows XP Professional or Microsoft Windows 2000 client software, or if it contains Microsoft Windows NT backup domain controllers, the PDC emulator master acts as a Windows NT PDC. It is also the Domain Master Browser, and it handles password discrepancies. At any one time, there can be only one domain controller acting as the PDC emulator master in each domain in the forest.

You can transfer FSMO roles by using the Ntdsutil.exe command-line utility or by using an MMC snap-in tool. Depending on the FSMO role that you want to transfer, you can use one of the following three MMC snap-in tools:

Active Directory Schema snap-in
Active Directory Domains and Trusts snap-in
Active Directory Users and Computers snap-in

If a computer no longer exists, the role must be seized. To seize a role, use the Ntdsutil.exe utility.

Back to the top

Transfer the Schema Master Role

Use the Active Directory Schema Master snap-in to transfer the schema master role. Before you can use this snap-in, you must register the Schmmgmt.dll file.

Register Schmmgmt.dll

1. Click Start, and then click Run.

2. Type regsvr32 schmmgmt.dll in the Open box, and then click OK.

3. Click OK when you receive the message that the operation succeeded.

Transfer the Schema Master Role

1. Click Start, click Run, type mmc in the Open box, and then click OK.

2. On the File, menu click Add/Remove Snap-in.

3. Click Add.

4. Click Active Directory Schema, click Add, click Close, and then click OK.

5. In the console tree, right-click Active Directory Schema, and then click Change Domain Controller.

6. Click Specify Name, type the name of the domain controller that will be the new role holder, and then click OK.

7. In the console tree, right-click Active Directory Schema, and then click Operations Master.

8. Click Change.

9. Click OK to confirm that you want to transfer the role, and then click Close.

Back to the top

Transfer the Domain Naming Master Role

1. Click Start, point to Administrative Tools, and then click Active Directory Domains and Trusts.

2. Right-click Active Directory Domains and Trusts, and then click Connect to Domain Controller.

NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.

3. Do one of the following:

o In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.

-or-

o In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.

4. In the console tree, right-click Active Directory Domains and Trusts, and then click Operations Master.

5. Click Change.

6. Click OK to confirm that you want to transfer the role, and then click Close.

Back to the top

Transfer the RID Master, PDC Emulator, and Infrastructure Master Roles

1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

2. Right-click Active Directory Users and Computers, and then click Connect to Domain Controller.

NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.

3. Do one of the following:

o In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.

-or-

o In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.

4. In the console tree, right-click Active Directory Users and Computers, point to All Tasks, and then click Operations Master.

5. Click the appropriate tab for the role that you want to transfer (RID, PDC, or Infrastructure), and then click Change.

6. Click OK to confirm that you want to transfer the role, and then click Close.

This message has been scanned for malware by Websense. www.websense.com

Overview

The User Profile Hive Cleanup service helps to ensure user sessions are completely terminated when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases the user session is prevented from completely ending. This can result in problems when using Roaming User Profiles in a server environment or when using locked profiles as implemented through the Shared Computer Toolkit for Windows XP.

On Windows 2000 you can benefit from this service if the application event log shows event id 1000 where the message text indicates that the profile is not unloading and that the error is “Access is denied”. On Windows XP and Windows Server 2003 either event ids 1517 and 1524 indicate the same profile unload problem.

To accomplish this the service monitors for logged off users that still have registry hives loaded. When that happens the service determines which application have handles opened to the hives and releases them. It logs the application name and what registry keys were left open. After this the system finishes unloading the profile.

System Requirements

• Supported Operating Systems: Windows 2000; Windows Server 2003; Windows XP

• Windows Installer: To use the MSI installation package you must have Windows Installer version 2.0 installed. Otherwise you can follow the manual installation instructions from the readme provided below. Windows Installer 2.0 is included with Windows 2000 SP3 and later, Windows XP and Windows Server 2003. You can install Windows Installer 2.0 using this link Windows Installer 2.0 Redistributable for Windows NT & 2000.

NOTE: The service has not been localized but is expected to run properly on localized version of Windows. The event log messages will be shown in English.

Top of page

Instructions

Below you will find the readme.txt so you can read more about the service before using it. The readme discusses what causes these problems and how to tell whether the service will help and how it does what it does.

It is easiest to install using the MSI package — you only need UPHClean-setup.msi for this. If you do not have Windows Installer 2.0 you may find the manual installation instructions from the readme to be more convenient. You can get the UPHClean executable from an existing installation.

To download a file from the list below do one of the following:

• To start the installation immediately, click Open or Run this program from its current location.
• To copy the download to your computer for installation at a later time, click Save or Save this program to disk.

Top of page

Additional Information

You can get more information about UPHClean through our blog: http://blogs.technet.com/uphclean

Please uninstall UPHClean v1.6d before upgrading to Windows Vista. To uninstall UPHClean after an upgrade to Windows Vista make the following changes:

1. Using Explorer navigate to C:Program FilesUPHClean
2. Right click UPHClean.exe and select Properties…
3. Select the Compatibility tab
4. Click the “Show settings for all users” button – click Continue when prompted to continue
5. Check “Run this program in compatibility mode for:”
6. Insure that “Windows XP (Service Pack 2) is selected under Compatibility mode
7. Click OK to close both copies of the uphclean Properties dialog boxes

You can now uninstall UPHClean v1.6d from Windows Vista.

UPHClean v1.6d does not function under Windows XP x64 Edition or Windows Server 2003 x64 Edition. A future version of UPHClean may be supported under those operating systems.

Files in This Download

The links in this section correspond to separate files available in this download. Download the files most appropriate for you.

This message has been scanned for malware by Websense. www.websense.com

Prior to Microsoft Exchange Server 2003 Service Pack 2 (SP2), there was no method to configure database size limits for Exchange Server 2003. Exchange Server 2003 SP2 introduces the following new features:

• For the Standard Edition, the default configured database size limit will now be 18 GB, a 2 GB addition to the previous limit, with a new maximum size of 75 GB.

• For the Enterprise Edition, there is no default configured database size limit, and no software set maximum size.
• Both versions of Exchange Server 2003 with SP2 have the ability to configure a limit, a warning threshold, and a warning interval set through registry keys.
• Size check done against the database now uses logical database size. Empty or white space in the database does not count against the configured database size limit; therefore, no offline defragmenting is required for recovery exceeding the configured or licensed database limits.
• Limit checks, done at regular intervals, are now controlled by the store process instead of JET. The default time interval is 24 hours and this interval is configurable through the registry.

Registry Settings

• The database size limit registry keys are read when the database mounts (not when the service starts up), and when each limit check task runs.

You must set registry parameters for each database targeted for size limit modification. The registry entries should be located under each database entry in the local server registry. Accordingly, you must reset the registry keys manually if the server has to be rebuilt using the /disasterecovery setup switch.

Note:
Incorrectly editing the registry can cause serious problems that may require you to reinstall your operating system. Problems resulting from editing the registry incorrectly may not be able to be resolved. Before editing the registry, back up any valuable data.

All registry settings discussed in this topic are created in the following registry location:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesMSExchangeIS<SERVER NAME>Private-013e2e46-2cd7-4a8e-bfec-0e4652b94b00

The GUID in this key (Private-013e2e46-2cd7-4a8e-bfec-0e4652b94b00) is an example and should match the value of the objectGUID attribute on the database’s Active Directory object.

Note:
By default, registry entries mentioned in this article are not present; when you create the entry, you override the default value set in code.

Note:
All of registry values mentioned in this article are in decimal, not hexadecimal.

• The following new registry settings are available with SP2:
• Database Size Limit in GB
• Database Size Buffer Warning in Percentage
• Database Size Check Start Time in Hours from Midnight

Database Size Limit in GB

The Database Size Limit in GB setting is the configurable maximum size of a database not to exceed the maximum licensed size of your database. For Standard Edition, you can set the database size limit between 1 and 75 GB. By default, the limit is 18 GB. For Enterprise Edition you can set the database size limit between 1 and 8,000 GB. By default, there is no limit.

The following registry value controls the Configurable Database Size Limit:

Database Size Buffer in Percentage

The Database Size Buffering in Percentage setting is a configurable error threshold that will warn you with an event log entry when your database is at or near capacity, and will shut down within 24 hours of the event being logged. By default, Exchange Server 2003 SP2 logs events when the database has grown to within 10 percent of the configured database size limit. This threshold is configurable. The smallest buffer is 1 percent of the configured size limit.

The following registry value controls the Database Size Buffer:

Database Size Check Start Time in Hours from Midnight

The Database Size Check Start Time in Hours from Midnight setting allows you to configure when the system will check your database to see if it is over the currently configured Database Size Limit. By default, the database size check happens at 05:00 (5:00 A.M.) every day. This time can be changed. If modified, the next task is scheduled at the new Offset hour. Checks at Database Size Check Interval are skipped until new start time.

First database size check will not take the database offline if the size limit has been exceeded. Because the database does not go offline, you are ensured at least 24 hour of availability after the limit is exceeded for default settings.

Behavior When the Configured Database Size Limit or Licensed Database Size Limit Are Reached

When a database mounts, the store process compares the physical database size against the Configured Database Size Limit in GB. If the physical size is within or exceeds the configured Database Size Warning Buffer in Percentage, the store performs a logical calculation of the database size. If it is below this warning buffer, there is no need to calculate the free space because the logical size will never exceed the physical size. Generally, the physical size is less than the warning threshold, so the size check should take under a millisecond to complete. If the free space calculation must be performed, the size check may require a few seconds to parse through the database to generate the logical size calculation.

If the Database Size Warning Buffer in Percentage is reached or exceeded, an error event, event ID 9688, is logged in the Application event log.

With Exchange Server 2003 SP2 or later, the server performs the following tasks when the configurable (or default configured) database size limit is reached:

• If the first check after a database mount finds the database size above the limit, the database will not be taken offline but an error event (ID 9689) will be logged in the Application event log.
• If it is the second check, an error event will be logged in the Application event log and the database will be taken offline.

After the administrator remounts the database, he or she has 24 hours (or until the next database size check or 05:00 if the default is set) to take corrective actions.

Licensed Database Size Limit

Exchange Server 2003 Standard Edition is limited to a single storage group with a single private information store database and a single public folder database. Prior to SP2, each database was limited to 16 GB of total physical size. SP2 increases the licensed database size limit for Exchange Server 2003 Standard Edition from 16 GB to 75 GB; the default configured database size limit will be 18 GB. Exchange Server 2003 Enterprise Edition storage group and Exchange store options do not change with the application of SP2. However, a configurable Exchange store size limit is added to the Enterprise Edition.

Note:
The current hard coded limit of the JET database is 8,192 GB, or 8 terabytes (TB).

Disaster Recovery Planning Considerations

If you change the size limit of your Exchange databases, you may want to re-evaluate your Exchange database backup and restore plan. Specifically, if you increase the size limit of the Exchange databases, be sure to test your backup and recovery operations using the new database size limits to make sure that you can still meet your service level agreements. For example, if the previous size of a mailbox store was 15 GB and you were able to meet your service level agreement by recovering the data in less than 8 hours, you may no longer be able to recover the database that quickly if you increase the size of a mailbox store to 20 GB or larger.

This message has been scanned for malware by Websense. www.websense.com

interface Dialer0
bandwidth 2048 , 1024 , 512 (opsiyonel)
ip address negotiated
ip directed-broadcast
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp pap sent-username xxxxxxxxx@ttnet password 7 xxxxxxxxx

Solution:

To configure your Juniper Firewall Site A for a Route Based LAN to LAN VPN when one side has a Dynamic IP using Pre-shared Keys, perform the following steps:

In this article, Site A is the site with a static IP address, and Site B has a dynamically (DHCP) assigned IP address.

Open the WebUI. For more information on accessing the WebUI, go to KB4060 — Accessing Your NetScreen, SSG, or ISG Firewall Using the WebUI.

From the Juniper Firewall menu, click Network, and then click Interfaces.

Click New.

From the Tunnel Interface Name text box, enter a tunnel name.

For this example, we have entered 1.

From the Zone drop-down menu, click to choose a Zone.

For this example, we have selected Untrust (trust-vr).

Click to select Unnumbered. From the Interface drop-down menu, click to choose an Interface.

For this example, we have selected ethernet (trust-vr).

Click OK.

From the Juniper Firewall menu, click VPNs, select AutoKey Advanced, and then click Gateway.

Click New.

From the Gateway Name text box, enter a Gateway Name.

For this example, we have entered Site B GW.

From Security Level, click to select Custom.

From Remote Gateway Type, click to select Dynamic IP Address, and then enter a Peer ID.

For this example, we have entered siteb.netscreen.com.

In the Preshared Key text box, enter a Preshared Key, and then in the Local ID text box, enter a Local ID.

For this example, we have entered a Preshared Key of netscreen.

The pre-shared keys on Juniper Firewall device A and Juniper Firewall device B must be identical.

From the Outgoing Interface drop-down menu, click to choose an Outgoing Interface. Click Advanced.

For this example, we have selected ethernet3.

From the Phase 1 Proposal drop-down menu, click to choose a Phase 1 Proposal.

For this example, we have selected pre-g2-3des-sha.

From Mode (Initiator), click to select Aggressive. Click Return.

Click OK.

From the Juniper Firewall menu, click VPNs, and then click AutoKey IKE.

Click New.

From the VPN Name text box, enter a VPN Name. From Security Level, click to select Custom.For this example, we have entered Site B VPN.

From Remote Gateway, click to select Predefined. From the Remote Gateway drop-down menu, select Site B GW.

Click Advanced.

From the Phase 2 Proposal drop-down menu, click to choose Phase 2 Proposal.

For this example, we have selected g2-esp-3des-sha.

From Bind to, click to select Tunnel Interface. From the Tunnel Interface drop-down menu, click to select tunnel.1.

Click to select Proxy-lD. In the Local IP/Netmask text box, enter a Local IP/Netmask, and then in the Remote IP/Netmask text box, enter a Remote IP/Netmask.For this example, we have entered 10.1.1.0/24 for the Local IP/Netmask and 172.16.10.0/24 for the Remote IP/Netmask.

From the Service drop-down menu, click to select ANY. Click Return.

Click OK.

From the Juniper Firewall menu, click Policies.

In the From drop-down menu, click to select Trust. From the To drop-down menu, click to select Untrust.

Click New.

From Source Address, click to select New Address, and then enter a New Address.

For this example, we have entered 10.1.1.0/24.

From Destination Address, click to select New Address, and then enter a New Address.

For this example, we have entered 172.16.10.0/24.In the Service drop-down menu, click to select ANY. From the Action drop-down menu, click to select Permit.

Click to select Position at Top.

Click OK.

From the Juniper Firewall menu, click Policies.

In the From drop-down menu, click to select Untrust. From the To drop-down menu, click to select Trust.

Click New.

From Source Address, click to select New Address, and then enter a New Address.

For this example, we have entered 172.16.10.0/24.

From Destination Address, click to select New Address, and then enter a New Address.

For this example, we have entered 10.1.1.0/24.In the Service drop-down menu, click to select ANY. From the Action drop-down menu, click to select Permit.

Click to select Position at Top.

Click OK.

From the Juniper Firewall menu, click Network, select Routing, and then, for 5.2 and below, click Routing Table; for 5.3 and above, click Destination.

Click New.

From Virtual Router Name, enter a Network Address/Netmask.

For this example, we have entered 172.16.10.0/255.255.255.0.

Click to select Gateway. From the Interface drop-down menu, click to select tunnel.1.Click OK.

This message has been scanned for malware by Websense. www.websense.com