2

I have a Juniper SSG 5 firewall in a datacenter. The first interface (eth0/0) has been assigned a static IP address and has three other addresses configured for VIP Nat. I have a static route configured at the lowest priority for 0.0.0.0/0 to my hosting company's gateway.

Now I need to configure a second IP block. I have the IPs assigned to the second interface (eth0/1) which is in the same security zone and virtual router as the first. However, with this interface enabled I (a) can't initiate outbound sessions (browse the internet, ping, DNS lookup, etc) even though I can access servers behind the firewall just fine from the outside and (b) can't ping the management IP of the firewall/gateway.

I've tried anything I can think of but I guess this is a little above my head. Could anyone point me in the right direction?

Interfaces: ethernet0/0 xxx.xxx.242.4/29 Untrust Layer3
ethernet0/1 xxx.xxx.152.0/28 Untrust Layer3

Routes:

https://i.stack.imgur.com/60s41.png

Improve this question
2
  • Are the two untrust subnets coming from the same ISP? If not, what rules are you contemplating to decide which traffic uses which ISP? I've done a couple of implementations with SSGs with multiple untrust subnets, and they range from simple to ugly depending on what you want to do with them.
    – David Mackintosh
    Jul 14, 2011 at 14:46
  • They both come from the same ISP. I only need these additional IPs for NAT (the original block only has 4 usable and we need ~9 for various websites).
    – Sam
    Jul 14, 2011 at 19:18

2 Answers 2

Reset to default
1

Since the IPs both come from the same ISP, you can just apply the addresses from the new block to the MIPs on the existing untrust interface. You don't have to define a second physical interface.

This works because the Netscreen is also a router.

So, when the world wants to send packets to the new block, the ISP will ARP for the IP on the new block, and your Netscreen will respond.

When the Netscreen needs to send packets back to the rest of the world from an IP on the new block, it will use the default router from the existing block; the ISP should accept this traffic.

This isn't intuitive, but it works.

Improve this answer
0

You can try creating a loopback interface and associate it with new address block then associating them with primary ethernet interface. You will need to maintain your MIPs on loopback interface. I'm using this setup myself and it is working quite well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .