Screen OS

Hi,

I have already two TCP port forwardings to a trusted IP via VIP - each one to a different port.

Now I added a new service which is UDP and assigned to a third port.

Since the transmitting device is an embedded mobile phone module I am not sure why data is not coming in.

The TCP ones show nicely under "Reports - Policies" the log items for incoming session. For this UDP one, there is nothing.

How can I see whether data arrived at my SSG5 at all, but dropped occasionally due to a checksum error or alike before reaching the VIP?

Since there are three different ports I have not to "set vip multi-port" have I? 

Is there something I have to take care off when handling UDP? 

Now if I send an UDP from a Delphi application to my Untrusted fix IP, WireShark shows it leaves my Trusted machine's IP and a second item showing the message incoming from Untrusted to the IP address I defined in the VIP, which means my firewall received and successfully redirected it!

On the SSG5 the package can be seen in the Trust-to-Untrust policy's log. I guess the VIP is doing its job, but since the message originates from Trusted it doesn't leave the device at all, but everything is managed internally.   

Regards,

Akos 

Hi,

>How can I see whether data arrived at my SSG5 at all, but dropped occasionally due to a checksum error or alike before reaching >the VIP?

Try running "debug flow basic" with appropriate filters on the firewall.

There is an excellent  tutorial how to do this in this forum:

 http://forums.juniper.net/jnet/board/message?board.id=Firewalls&thread.id=2719

> Since there are three different ports I have not to "set vip multi-port" have I? 

multi-port is used only if you are using multiple port services in VIP configuration. 

AOL is an example of predefined multiple port service.

> Is there something I have to take care off when handling UDP? 

There is no special config for UDP.

Hope this help.

Kind Regards,

Nemanja

Thank you Nemanja!

It is clearly the problem with my mobile phone gadget - their packages don't reach my public IP.

The debug flow basic is a bit difficult to interpret, but I was able to see the incoming packages from my correctly transmitting Delphi-program.

Pozdrav,

Akos