Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SSG5 firewall with some route based VPN. I have a LAN, a DMZ, an another net and WAN. How should I do to make DMZ use VPN and not LAN? I think it's a routing problem. But Source routing doesn't solve my problem.

It was easier on my old OpenBSD Box 'cause route where made by the system automatically. I think it was using Sthe VPN (SA/ProxyID) configuration to add configure them.

Thank U !

share|improve this question
Could you please give more informations as i don't fully understand your question, please? – Maxwell Aug 12 '09 at 7:33
Ok, If I configure a destination route to tell the ssg to send trafic to the VPN, this route will apply to all interfaces. But this route must be used for DMZ only, not LAN. Do I need to change my route based VPN to Policy based VPN to do this? – Matthieu Aug 12 '09 at 7:58
Did you tried Policy Based Routing if available on your SSG? – Maxwell Aug 12 '09 at 8:10
Well.. not yet. I will try :) Thank You. – Matthieu Aug 12 '09 at 8:14
up vote 0 down vote accepted

In ScreenOS, you can use PBR (Policiy based routing) which opers at the interface level to selectively cause packets to take different paths, PBR acls are processed in the first part of the route lookup. This should fit your needs.

Here's the online documentation for PBR routing un ScreenOs 61.0.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.