1

Thanks in advance to anyone who will take time to provide a possible solution. This is my actual situation:

                               ___________________       ________________
INTERNET --------------------- |                 |-------|               |
                               | Main router     |       |  PC 1         |
                               | 192.168.10.254  |       | IP from DHCP  |
        -----------------------|_________________|       |_______________|
   _____|________________
   |                    |
   | Juniper netscreen  |
   | Untrusted interface|                UNTRUSTED ZONE
   | 192.168.10.95      |
   |--------------------|---------------------------------------------------
   | Trusted interface  |
   | 192.168.2.1        |                TRUSTED ZONE
   |____________________|
         |            |
   ______|__________  |       _____________________
   |               |  |______|                     |
   | PC 2          |         | Other PCs in the    |
   | 192.168.2.100 |         | 192.168.2.x range   |
   |_______________|         |_____________________|

I need to give Internet access to all the 192.168.2.x devices (.100 included), but to allow requests from the untrusted zone only to the PC with IP 192.168.2.100. I created some rules so that the 192.168.2.x devices (.100 included) now have Internet access, and I can also ping PC1.

The problem is that I cannot ping any 192.168.2.x device from PC1 exception made for the virtual router 192.168.2.1. I tried creating several routes but it didn't work. There surely is something I'm doing wrong.

The final goal is to allow only 192.168.2.100 to be reachable (and ping-able) from the untrusted zone, while still allowing Internet access in the whole trusted zone. I tried reading the Netscreen documentation, but I couldn't find anything useful.

The Juniper Netscreen model is NS-5GT with 5.4.0r3a.0 firmware.

  • did you configure any natting on the netscreen to allow the 192.168.2.x range to access the internet? is it possible to post the configuration of netscreen ? – Mr.lock Sep 5 '17 at 10:18
1

Its seems that your NetScreen has its operational mode configured to route and NAT. In that case, you cannot access any computer in the trust zone by setting the destination IP as 192.168.2.X. In fact the 192.168.2.X net is unreachable from the untrusted interface.

In order to fullfill your requirements, you have to configure port forwarding on the NetScreen equipment (please see Juniper Knowledge Base).

Then you have to route the virtual IP to the untrusted interface on your main router, in order to allow PC 1 to reach the virtual IP

  • Thank you for your answer. I saw the link and I followed the guide. As you said, the NetScreen is set to route and NAT. I now configured port forwarding (on http, since PC2 hosts a webserver on port 80) with virtual IP 192.168.10.100 forwarded to trusted IP 192.168.2.100. On the main router, I set to route requests to 192.168.10.100 on 192.168.10.95. Still, this doesn't appear to work for some reasons. I'm now checking the entire configuration, resetting policies and interfaces. If you have other suggestions, I'm ready to listen. – Giulio Ganzerli Sep 6 '17 at 13:15
  • Do you test the configuration by using ping command ? – vera Sep 6 '17 at 13:20
  • No, I tried connecting (with the web browser) to 192.168.10.100:80 because I forwarded that port and, if I remember correctly ping works with ICMP and you cannot really forward it. – Giulio Ganzerli Sep 6 '17 at 13:47
  • Yes you're right, that's why I asked. I'll look at your comment more precisely tonight – vera Sep 6 '17 at 13:53
  • Thank you. I want to underline that the webserver on PC2 normally works when you are inside the trusted network. There must be something I'm still doing wrong. I'm now repeating the forwarding and routing on a different destination to see if something changes. – Giulio Ganzerli Sep 6 '17 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.