3

We have multiple public IP address subnets for various purposes. I need to create an Internal Zone behind NAT that presents itself as having an external IP in External Zone B.

                [UNTRUST]         [TRUST]

ISP---<---External Zone A ---<--- Internal Zone C
           (Public IPs)     nat    (Private IPs)
              |                                   
       routed ^
              |
          External Zone B ---<--- Internal Zone D
           (Public IPs)     nat    (Private IPs)

Putting a DIP pool on Zone B would seem like a logical step but then how do I construct the routing so that the Policy from D to A will be relevant to traffic going out via the ISP?

Is this even possible? I know I could do this with a second firewall between D and B, as this the ssg would happily route traffic with a source in B to the ISP but I am not sure I can get a NAT from D to B, then a route from B to A and out.

(A, B and C all work and route correctly today, currently C&D presents as the egress IP of zone A, I would happily accept a solution where D presents as the IP of the interface in Zone B)

Hardware: SSG320M Software: 6.3.0r21.0

  • What is the purpose of External Zone B? Does it have any interfaces to anywhere else in it? In your question you say "where B presents as the IP of the interface in Zone B" - do you actually mean D? – Benjamin Dale Mar 12 '17 at 15:10
  • I did indeed mean D. We have a whole class of devices that need dedicated public IPs, or enough mapped ports that it might as well be public. I also have a subclass of devices that would be really useful to present from the same IP range (B), as this range is something we privately share for whitelisting by partner companies. – Acyclic Tau Mar 13 '17 at 16:34
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 22:03
0

Have you thought about configuring PIM on the devices....

such as

set protocols pim rib-group inet RPF_RIB
set protocols pim rp static address IP-OF-RP
set protocols pim interface OUTSIDE
set protocols pim interface INSIDE
set security zones security-zone OUTSIDE host-inbound-traffic protocols pim
set security zones security-zone INSIDE interfaces INTERFACE host-inbound-traffic protocols pim

set protocols igmp interface INTERFACE-OUTSIDE version 2
set protocols igmp interface INTERFACE_INSIDE version 2
set security zones security-zone OUTSIDE host-inbound-traffic protocols igmp
set security zones security-zone INSIDE interfaces INTERFACE host-inbound-traffic protocols igmp
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match source-address 224.0.0.0/4
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match destination-address any
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match application junos-udp-any
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then permit
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then log session-init
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then log session-close
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match source-address any
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match destination-address 224.0.0.0/4
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match application junos-udp-any
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then permit
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then log session-init
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then log session-close

Or something similar modeled to your environment. Just a thought and it is a secure way of Achieving your goal.

  • 1
    How is PIM relevant to this question? – Benjamin Dale Mar 12 '17 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.