3

We have multiple public IP address subnets for various purposes. I need to create an Internal Zone behind NAT that presents itself as having an external IP in External Zone B.

                [UNTRUST]         [TRUST]

ISP---<---External Zone A ---<--- Internal Zone C
           (Public IPs)     nat    (Private IPs)
              |                                   
       routed ^
              |
          External Zone B ---<--- Internal Zone D
           (Public IPs)     nat    (Private IPs)

Putting a DIP pool on Zone B would seem like a logical step but then how do I construct the routing so that the Policy from D to A will be relevant to traffic going out via the ISP?

Is this even possible? I know I could do this with a second firewall between D and B, as this the ssg would happily route traffic with a source in B to the ISP but I am not sure I can get a NAT from D to B, then a route from B to A and out.

(A, B and C all work and route correctly today, currently C&D presents as the egress IP of zone A, I would happily accept a solution where D presents as the IP of the interface in Zone B)

Hardware: SSG320M Software: 6.3.0r21.0

3
  • What is the purpose of External Zone B? Does it have any interfaces to anywhere else in it? In your question you say "where B presents as the IP of the interface in Zone B" - do you actually mean D? Mar 12 '17 at 15:10
  • I did indeed mean D. We have a whole class of devices that need dedicated public IPs, or enough mapped ports that it might as well be public. I also have a subclass of devices that would be really useful to present from the same IP range (B), as this range is something we privately share for whitelisting by partner companies. Mar 13 '17 at 16:34
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 31 '20 at 20:44
1

While this is an old question, it may still be relevant in searches - so I'll attempt a general answer. I think you're needlessly complicating things by trying to cascade multiple zones.

You define zones by trust level. If two zones have the same level of trust they should really be just one. If you need to route between subnets in the same zone there's no need for a firewall - you could use a simple layer-3 switch.

NAT is required to map private IP addresses to a public address (or a pool) for Internet access. If you control the routing in a public address zone of your own, there's no need to NAT private addresses. Removing NAT simplifies things and removes load from your routers; it also enables proper logging.

Now, you'd want to put firewall rules between zones to control traffic. You'd configure policies between any two zones, with the open Internet being one of them. What you certainly won't want for any connection is to use multiple policies.

In your scenario, there should be a policy each for C/D to A/B (without NAT), C/D to the Internet (with source NAT), Internet to A/B, A/B to Internet, possibly A/B to C/D (w/o NAT), and so on.

Whether you use a single firewall for everything or multiple ones doesn't really matter logic wise, only performance wise.

-1

Have you thought about configuring PIM on the devices....

such as

set protocols pim rib-group inet RPF_RIB
set protocols pim rp static address IP-OF-RP
set protocols pim interface OUTSIDE
set protocols pim interface INSIDE
set security zones security-zone OUTSIDE host-inbound-traffic protocols pim
set security zones security-zone INSIDE interfaces INTERFACE host-inbound-traffic protocols pim

set protocols igmp interface INTERFACE-OUTSIDE version 2
set protocols igmp interface INTERFACE_INSIDE version 2
set security zones security-zone OUTSIDE host-inbound-traffic protocols igmp
set security zones security-zone INSIDE interfaces INTERFACE host-inbound-traffic protocols igmp
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match source-address 224.0.0.0/4
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match destination-address any
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match application junos-udp-any
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then permit
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then log session-init
set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then log session-close
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match source-address any
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match destination-address 224.0.0.0/4
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match application junos-udp-any
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then permit
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then log session-init
set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then log session-close

Or something similar modeled to your environment. Just a thought and it is a secure way of Achieving your goal.

1
  • 3
    How is PIM relevant to this question? Mar 12 '17 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.