ScreenOS Firewalls (NOT SRX)
Showing results for 
Search instead for 
Do you mean 
Reply
Contributor
Posts: 16
Registered: ‎10-31-2008
0 Kudos

NetScreen-204 not connecting to the DNS Server

Here is my simple configuration

 

DSL=>Switch---(untrust:eth3)__NetScreen204__(trust:eth1)---=>solaris10

 

The Ip address are:

 eth3: 72.xx.xxx.xxx/13

 eth1: 10.100.2.183/16

 

I have a web-server running on solaris with public ip 72.xx.xxx.xxx. I followed the guide on howto NAT-src from Egress Interface IP address to implement NAT.

 

My problem is that when I ping from network device connected in eth1 to my DNS server it is not responding.The packet is being dropper somewhere.

 

Trusted Contributor
Posts: 207
Registered: ‎09-03-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Could you please explain how your policies are setup ? Do you see any logging on this ?

 

I asume the device in trust has a DG pointing to eth1 and the solaris server is the dns server ?

Contributor
Posts: 16
Registered: ‎10-31-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Sorry I should have been more clearer. From trust to untrust - I have allowed all the traffic to go through. For inbound I am allowing all traffic from Untrust to trust to come through (Eventually my goal is to only allow 72.xx.xxx.xxx/13 to come through).

Solaris is the web server connected to eth1. The DNS server is on the Internet cloud outside. I will have to check on the logging and get back to the forum.


What surprised me most was even after setting up the policy to accept all inbound and outbound traffic the firewall is dropping packets!

Thanks
Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Do you have MIP's configured on the firewall?  Is the Trust interface setup in NAT mode (default) or Route mode?

 

 

If you have MIP's on the eth3, your policy needs to read from : untrust to trust any mip(73.x.x.x) dns permit.

 

 

-=Q
Contributor
Posts: 16
Registered: ‎10-31-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Thanks for your replies above. I am starting it over again from the very basic.

 

The following are the interfaces:

ethernet1: Static Ip/Netmask:10.100.2.183/16

                   zone:trust

                   Interface Mode:NAT

 

ethernet3Static Ip/Netmask:72.85.***.**/13

                    zone:untrust

                    VIP:72.85.***.** (This is the registered public domain name of my web server and is on the same network as untrust!)

 

The policies are:

Untrust to TrustSource:Any

                              Destination:Any

                             Service:Any

Untrust to TrustSource:Any

                              Destination:VIP(72.85.***.**)

                             Service:Any

                             Action:Permit

 

Trust to UntrustSource:Any

                              Destination:Any

                             Service:Any

 

I am running a web server with private IP address 10.100.2.184. Its public domain name is registered with IP address of 72.85.***.** which is in the same network as the untrust. I can ping from 10.100.2.184 to 72.85.***.** but not to the DNS server. Also, when I ping from  72.85.***.** to 10.100.2.184, it is not responding. 

 

The System Log Event shows the policies I have modified and is not very informative. There is no MIP configured on the firewall.

 

 

Contributor
Posts: 16
Registered: ‎10-31-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Also, I can see the following message on the most recent alarms:

 

2003-11-21 20:59:30  crit VIP server 10.100.2.84 cannot be contacted.
2003-11-20 22:06:59  crit DNS server is not configured.
2003-11-20 22:06:59  crit DNS server is not configured.
2003-11-20 22:06:59  crit DNS server is not configured.
2003-11-20 22:06:59  crit DNS server is not configured.

 

I am relatively new to this so I appreciate your patience. I will try to supply more details.

 

Thanks

Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

The first policy will never work, the trust interface is in NAT mode for one.  The second policy is using a VIP (MIP's are preffered).  VIP's are used for what some call port forwarding.  As it appears that you have a /13 you should be using MIP's.  Remove the second policy, remove the VIP, and then create a MIP.  Then recreate the incoming policy using that new MIP.  If you allow ping from untrust to trust using that MIP, then it will respond.  The CLI would look like this:

 

set policy from untrust to trust any MIP(72.85.***.**) http permit log

 

Then once that policy is created, HTTP should be allowed, then you can add up to 32 service objects against that policy.

 

 

 Let's start there and get your head wrapped around this initial problem.  Please consider reading the Concepts and Examples for initial configuration of your box.

 

-=Q
Trusted Contributor
Posts: 207
Registered: ‎09-03-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Besides the fact that a MIP would be more suitable in the case of a /13 (that is, if you can use those addresses) a VIP should work.

The first policy is actually in the way for the second policy to work. Basic rule of most firewalls is that the policies/rules are processed sequentially. Meaning the first rule is accepting all the traffic while not translating anything to the private IP address (you need a MIP or VIP in the policy for that). So the second rule which contains the translation doesn't recieve the traffic, because it is already processed on rule 1.

 

What does the configuration of you VIP look like ? (under interfaces -> untrust -> VIP).

Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Clearly it would work, but you have a limited number of VIP's.  And if someone is new to configuring the device, then it's cleaner and easier to begin to understand MIP's.
-=Q
Contributor
Posts: 16
Registered: ‎10-31-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Like you guys suggested, I deleted the first 2 policies (including VIP) and set MIP (72.85.***.**) on ethernet3.

 

Now I can ping from outside side host to the 10.100.2.184. But when I ping from 10.100.2.184 to the outside it is failing. My current policy for the outbound traffic (Trust to Untrust) is

 

Source: Any

Destination: Any

Service: Any

NAT: Enabled

 

Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

To the outside what?  What IP?  And I assume that your policy is set to permit right (default)?

 

Try to ping 4.2.2.2 from the server and see what the results are.

-=Q
Trusted Contributor
Posts: 207
Registered: ‎09-03-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

[ Edited ]

Did you put logging on that policy ? Do you see traffic leaving and getting translated ?

Can you ping other devices on the untrust side of the firewall ?

 

edit:

seems that we're chatting here :+

Message Edited by dennish on 03-11-2008 10:37 PM
Contributor
Posts: 16
Registered: ‎10-31-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

From the machine 10.100.2.183 on the trust zone, I'm pinging to the Ip address 72.85.234.109 on ethernet3 on the untrust. The policy is set to permit. The result of the ping 4.2.2.2 from the server is

 

ns204-> ping 4.2.2.2
Type escape sequence to abort

Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 1 seconds
ip 4.2.2.2 is unreachable in vr trust-vr

Success Rate is 0 percent.

 

 

 

Trusted Contributor
Posts: 207
Registered: ‎09-03-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

ip 4.2.2.2 is unreachable in vr trust-vr <- this is suggesting there is no default route in the NS.

You might need to set that under network->destination routing or on cmdline by using "set route 0.0.0.0/0 gateway <x.x.x.x>".

 

Does not explain why you cant ping to a connected network though.

Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Looks like a route issue.  Make sure you have setup a default route to your upstream router.

 

CLI: set route 0.0.0.0/0 interface ethernet3 gateway 72.85.234.X

 

WebUI: Network > Routing > Destination.

 

 

 

-=Q
Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

I'm going to step away from the conversation at this point and let dennish take over.
-=Q
Trusted Contributor
Posts: 207
Registered: ‎09-03-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Hmm i was about to go to bed ;-)
Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Ok, off to bed you go.  Smiley Wink

 

 

Setup that route and report back. 

-=Q
Contributor
Posts: 16
Registered: ‎10-31-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Like you guys suggested I set up the route to 72.85.234.*. (set route 0.0.0.0/0 interface ethernet3 gateway 72.85.234.X)

 

It is now responding to pings from the telnet session


ns204-> ping google.com
Type escape sequence to abort
Sending 5, 100-byte ICMP Echos to google.com [64.233.187.99], timeout is 1 secon
ds
!!!!!
Success Rate is 100 percent (5/5), round-trip time min/avg/max=57/60/64 ms
ns204-> ping 4.2.2.2
Type escape sequence to abort
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 1 seconds
!!!!!
Success Rate is 100 percent (5/5), round-trip time min/avg/max=33/34/35 ms

When I try doing the same from a server connected to ethernet1 interface, it times out.
Here, I am pinging my DNS server

Pinging 71.243.0.12 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 71.243.0.12:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss

IP information of server connected to ethernet1

IP Address: 10.100.2.85
Subnet Mask: 255.255.255.0
Default Gateway: 10.100.2.183
DNS 1: 71.243.0.12
DNS 2: 68.237.161.12
MIP: 72.85.234.99
public hostname:***********
public ip:72.85.234.**

The log from Trust to Untrust looks like this

Source Address/Port Destination Address/Port Translated Source Address/Port Translated Destination Address/Port Service Duration Bytes Sent Bytes Received
2003-11-25 21:57:04 10.100.2.185:45568 4.2.2.2:512 72.85.234.99:45568 4.2.2.2:512 ICMP 61 sec. 78 0

For the Untrust to Trust the received byte is same as the incoming byte and there is no problem.

I really appreciate your help.

Thanks.

Trusted Contributor
Posts: 192
Registered: ‎10-02-2008
0 Kudos

Re: NetScreen-204 not connecting to the DNS Server

Sanitize your config and save it in a text file and upload it so we can see what it looks like.
-=Q