Questions[netscreen](server)

I have two devices here, a Netscreen SSG520 and a Cisco 3750.

#show ver
Cisco IOS Software, C3750 Software (C3750-IPSERVICES-M), Version 12.2(35)SE5, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2007 by Cisco Systems, Inc.

The Cisco is currently being used as the central router. It has an IP interface defined on VLAN1. The revision of IOS is the one recommended to us by Cisco to cover some other oddities we have uncovered in the switch's behavior.

Right now my Netscreen has only an untagged interface. The Cisco treats this as VLAN1, and it works.

I want to add tagged interfaces to the netscreen (I need to remove the Cisco from routing certain VLANs for reasons I won't go into here). So the first thing I do is define the Cisco interface as trunked:

interface GigabitEthernet1/0/1
 description Netscreen SSG520
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 10,11,102
 switchport mode trunk

Now, when I plug in my netscreen, the Cisco reports all the "trunk allowed" VLAN interfaces are UP. It does not report the interface on VLAN1 as up. And the expected traffic does not flow between the Cisco and the Netscreen. Neither can ping the other.

If I plug the Netscreen into an access port defined as so:

interface GigabitEthernet1/0/11
 description castor

...the Cisco then reports VLAN1 as up, both devices can ping each other, and traffic can flow between the Cisco and the Netscreen properly.

I have even tried defining the VLANs as tagged sub-interfaces on the Netscreen, and while the tagged VLANs work, VLAN1 does not.

I've played with the switchport trunk native vlan 1 command and the no switchport trunk native vlan command and the switch still does not use VLAN1 on that interface.

I already have a no shutdown command in the definition for interface vlan1; the fact that when the netscreen is plugged into the access port the VLAN comes up proves that.

For various reasons (mostly involving history) we can't just not use VLAN1.

I've spent the last two hours trying to get these devices to talk to each other the way I want them.

So.

How do I get the Cisco to recognize, and use, VLAN1 when I have a trunk defined?

I've done casual research into the subject and am truly dismayed at the lack of compatible tools for such a simple task. Maybe someone can provide assistance.

We have a NetScreen NS-5GT in the office. I need to be able to get a glance of current traffic per endpoint -- I think the equivalent of 'get sessions' with byte counts/rates. I don't care about bars, graphs, and reports. Something as simple as a classic software firewall display would be perfect.

I can't shell out money on something real like SolarWinds products, so a free solution is essential. I'm willing to do a little work but refuse to program something from scratch. It's not prudent right now for me to install a hub or otherwise mess around physically. There must be something out there I can use, maybe in combination. I don't believe I'm asking too much.

Specific answers only please, e.g. monitoring software you know will actually work with this antiquated device. I've read about general approaches to the broader problem dozens of times already.

I've followed the instructions to configure a VPN between a netscreen device and a Cisco PIX as directed by Cisco's [netscreen to PIX VPN]http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00801c4445.shtml article.

The only differences are that I'm running PIX 6.3(5) and Juniper Netscreen 6.1.0r2.0 (Firewall+VPN). I followed both configurations exactly, and when I try to connect, the Juniper returns with:

2010-02-21 12:54:28  information IKE: Removed Phase 2 SAs after receiving a notification message. 
2010-02-21 12:54:28  information IKE pix_public_IP: Received a notification message for DOI 1 14 NO-PROPOSAL-CHOSEN. 
2010-02-21 12:54:28  information IKE pix_public_IP Phase 2: Initiated negotiations. 

On the Netscreen, I've created a Phase 2 Proposal called ToCorpOffice using DH Group#2, 3DES-CBC, and SHA-1, and when configuring the AutoKey IKE, I chose ToCorpOffice and removed all other transforms. I believe I've configured the same on the PIX with:

sysopt connection permit-ipsec
crypto ipsec transform-set mytrans esp-3des esp-sha-hmac
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address nonat
crypto map mymap 10 set pfs group2
crypto map mymap 10 set peer netscreen_public_ip
crypto map mymap 10 set transform-set mytrans
crypto map mymap interface outside

Saved that and rebooted, so here's the cryptomap info: PIX-FW1# show crypto map

Crypto Map: "mymap" interfaces: { outside }

Crypto Map "mymap" 10 ipsec-isakmp
    Peer = netscreen_public_ip
    access-list nonat; 1 elements
    access-list nonat line 1 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 (hitcnt=0)
    Current peer: netscreen_public_ip
    Security association lifetime: 4608000 kilobytes/28800 seconds
    PFS (Y/N): Y
    DH group:  group2
    Transform sets={ mytrans, }
PIX-FW1#

Any idea why I'm getting a NO-PROPOSAL-CHOSEN error?

I took down an interface using

set interface ethernet0/0 phy link-down

with the intention of cycling it back up - but now I can;'t figure out how to bring it up.

Anyone got a good product for Usage Reporting for a NetScreen Firewall.

I went looking for Webtrends Firewall Suite but it appears to have disappeared into the NetIQ product line up.

I am going to try out ManageEngine (I think is also AdventNet)'s Firewall Log Analyzer.

But wanted to know if anyone had any good recommendations.

Thanks,

Rob