Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given a ScreenOS 6.3.0 firewall with this configuration:

unset flow reverse-route clear-text
set interface "ethernet0/0" zone "Trust" 
set interface ethernet0/0 ip 
set interface ethernet0/2 ip 
set interface ethernet0/2 mip host netmask vr trust-vr
set interface ethernet0/2 mip host netmask vr trust-vr
set route interface ethernet0/2 gateway

... (and assuming appropriate policies) is there a way to control which MIP the firewall selects for outbound connections initiated by (presumably because I want the upstream to do different things with the packet depending on what its source IP is).

Update: OK, my scenario is this: I have two ISP uplinks, each giving me a different IP space. Each ISP will only route the IP space they have assigned me.

So in order for the server to be reachable by both ISPs, I need two MIPs for the same server, one on each interface. Inbound traffic will work fine with the 'unset flow reverse-route clear-text' option in use.

But for outbound (think an email server sending a message) I need a way to select an appropriate MIP depending on which outbound link I want the system to use, and I want this to be resiliant so that if the link the firewall prefers goes down overnight I don't have to manually flip something to keep the mail flowing.

Basically I'm trying to avoid having to buy a link-balancer appliance (or two since I'll need a cluster).

Is there a way to do this?

share|improve this question
up vote 1 down vote accepted

Assuming you want to have active control over both outbound links at the same time (ie system A uses IP A and goes out uplink A, System B uses IP B and goes out uplink B) the answer is no, you can't. You need a link balancer.

If you don't care which link outbound traffic uses, you can set up two MIPs (one for each ISP link) and set ip-tracking routes and the firewall will pick the "best" one (ie it will use one and then stop using it when it fails). You can bias the selection with route ordering and metrics.

But the bottom line is that to have control, you need a link balancer.

If you have support, call the JTAC.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.