ScreenOS Firewalls (NOT SRX)
Reply
Distinguished Expert
spuluka
Posts: 2,514
Registered: ‎03-30-2009
0

Re: Help with SSG5 DMZ Setup...

The problem is likely that your interface nat for the dmz zone does not work.  This really only works from the trust zone interface.  You need to configure policy nat for the general outbound traffic from other zones or apply an outbound public ip rule that does the same function for your server.

 

set interface ethernet0/1 nat

Becomes:

 

set interface ethernet0/1 route

 

set policy id 2 from "DMZ" to "Untrust"  "Any" "Any" "ANY" permit 

set policy id 2

exit

 

Becomes:

set policy id 2 from "DMZ" to "Untrust"  "Any" "Any" "ANY" nat src permit

set policy id 2

exit

Steve Puluka BSEET
Juniper Ambassador
Senior Network Engineer - UPMC Pittsburgh, PA
JNCIA-ER JNCIA-EX JNCIS-SEC JNCIP-SEC
JNCIS-FWV JNCIS-SSL
MCP - Managing Server 2003 MCP - Windows XP Professional
MCTS Windows 7
http://puluka.com/home
Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.