Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Juniper SSG 5 firewall in a datacenter. The first interface (eth0/0) has been assigned a static IP address and has three other addresses configured for VIP Nat. I have a static route configured at the lowest priority for to my hosting company's gateway.

Now I need to configure a second IP block. I have the IPs assigned to the second interface (eth0/1) which is in the same security zone and virtual router as the first. However, with this interface enabled I (a) can't initiate outbound sessions (browse the internet, ping, DNS lookup, etc) even though I can access servers behind the firewall just fine from the outside and (b) can't ping the management IP of the firewall/gateway.

I've tried anything I can think of but I guess this is a little above my head. Could anyone point me in the right direction?

Interfaces: ethernet0/0 Untrust Layer3
ethernet0/1 Untrust Layer3


share|improve this question
Are the two untrust subnets coming from the same ISP? If not, what rules are you contemplating to decide which traffic uses which ISP? I've done a couple of implementations with SSGs with multiple untrust subnets, and they range from simple to ugly depending on what you want to do with them. – David Mackintosh Jul 14 '11 at 14:46
They both come from the same ISP. I only need these additional IPs for NAT (the original block only has 4 usable and we need ~9 for various websites). – Sam Jul 14 '11 at 19:18

Since the IPs both come from the same ISP, you can just apply the addresses from the new block to the MIPs on the existing untrust interface. You don't have to define a second physical interface.

This works because the Netscreen is also a router.

So, when the world wants to send packets to the new block, the ISP will ARP for the IP on the new block, and your Netscreen will respond.

When the Netscreen needs to send packets back to the rest of the world from an IP on the new block, it will use the default router from the existing block; the ISP should accept this traffic.

This isn't intuitive, but it works.

share|improve this answer

You can try creating a loopback interface and associate it with new address block then associating them with primary ethernet interface. You will need to maintain your MIPs on loopback interface. I'm using this setup myself and it is working quite well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.