ScreenOS Firewalls (NOT SRX)
Showing results for 
Search instead for 
Do you mean 
Reply
Trusted Expert Trusted Expert
Trusted Expert
Posts: 791
Registered: ‎07-26-2008
0 Kudos

Re: Netscreen 25 with new ISP

hm, not sure I got your qn? You just want to migrate your ISP link to the 12.x subnet right? Based on the old configuration, thats going to be fine.

But you want to keep some of your 208.x stuff?

****pls click the button " Accept as Solution" if my post helped to solve your problem****
Contributor
Posts: 19
Registered: ‎04-09-2009
0 Kudos

Re: Netscreen 25 with new ISP

Yeah basically here, our old network is on eth1 & 3 in transparent mode, our current ip's are public and wanna go nat;

   ethernet1 0.0.0.0/0 V1-Trust Layer2 Up - Edit

   ethernet2 192.168.1.1/29 V2-Trust Layer3 Up - Edit

   ethernet3 0.0.0.0/0 V1-Untrust Layer2 Up - Edit

   ethernet4 12.54.120.33/27 V2-Untrust Layer3 Up  Edit

   vlan1 208.36.7.6/24 VLAN Layer3 Up - Edit

 

so we wanna do is change over eth1 to 208.36.7.xx address, just so we don't have to mess with the current internal network, servers and some production machines are in that subnet. We just used eth 2 & 4 to test it. So we change eth1 to 208.36.7.0/32 and add the source route as well.

 

carlo

Contributor
Posts: 19
Registered: ‎04-09-2009
0 Kudos

Re: Netscreen 25 with new ISP

Hi WL, got a question, can we use any of the ip blocks from ATT and use that to match an inside IP address and NAT it,

ex. 192.168.1.2 > 12.54.120.2 and so on. Thanks

 

carlo

Trusted Expert Trusted Expert
Trusted Expert
Posts: 791
Registered: ‎07-26-2008
0 Kudos

Re: Netscreen 25 with new ISP

Hi

 

Yes, we can do that. We would just need to configure a MIP for that. MIP does one-to-one bidirectional mapping.

 

Heres a pretty good explanation for it;

http://kb.juniper.net/index?page=content&id=KB12835&actp=search&searchid=1239737373306

 

I think there is also a NAT starter guide posted on this forum if you need more stuff on natting:

http://kb.juniper.net/KB11909

 

Let me know if you cant view the stuff

****pls click the button " Accept as Solution" if my post helped to solve your problem****
Contributor
Posts: 19
Registered: ‎04-09-2009
0 Kudos

Re: Netscreen 25 with new ISP

Thanks WL, we'll give it a read.

 

carlo

Contributor
Posts: 19
Registered: ‎04-09-2009
0 Kudos

Re: Netscreen 25 with new ISP

Hi WL, question, do we need to setup vlan1 on eth2 & 4, just trying to compare settings, we have that on the current network eth1 & 3, (in transparent mode), we re-did it again from scratch cause there were slowdowns on some sites.
Trusted Expert Trusted Expert
Trusted Expert
Posts: 791
Registered: ‎07-26-2008
0 Kudos

Re: Netscreen 25 with new ISP

Actually in transparent mode you will need to vlan1 for managment purpose etc, etc. I dont think you are going to be able to configure another one for the actual L3 stuff you are trying to do.

 

Will you be arunning the FW in L2 and L3 together? It could cause some other issues if the routing is not set up properly though..

****pls click the button " Accept as Solution" if my post helped to solve your problem****
Contributor
Posts: 19
Registered: ‎04-09-2009
0 Kudos

Re: Netscreen 25 with new ISP

 I see, this is kinda tough cause the current network is that way, and we're trying to setup the other 2 ports another way, we're kinda doing this like a parallel setup, how are we gonna do this migration if those modes aren't supported together, should we get another FW? can we go tranparent also on the new one but will we be able to use NAT? Once we figure out some of the steps, we wanna come in on a weekend and change it over, but wanna make sure we're doing it right.

Trusted Expert Trusted Expert
Trusted Expert
Posts: 791
Registered: ‎07-26-2008
0 Kudos

Re: Netscreen 25 with new ISP

hmmm, so what you are doing is somthing like this:

 

Trust (dhcp for users on 192.168.X.X net) --------FW-----------(unstrust) public ip-----Internet

                                                                                   ------------(dmz) public ip --------Internet

 

If it is then pretty much you can do the FW totally in L3 mode. It would simplify alot of stuff for you if you do it that way. So all of your users would then be in a private subnet.

 

Not sure if this is going to fit all your requirements though

****pls click the button " Accept as Solution" if my post helped to solve your problem****
Contributor
Posts: 19
Registered: ‎04-09-2009
0 Kudos

Re: Netscreen 25 with new ISP

This is is but without the dmz(no dmz port on ns25) and keeping old ip's

 

Trust (dhcp for users on 192.168.X.X net) --------FW-----------(unstrust) public ip-----Internet

                                              ^

                                    we wanna keep the old ip's from old isp (208.36.7.x)

Highlighted
Contributor
Posts: 19
Registered: ‎04-09-2009
0 Kudos

Re: Netscreen 25 with new ISP

Hi WL, I think we got it figured out, we're able to setup MIP(192.xx inside > 12.xx outside), we just need to unplug the old network, cause it's not letting us have two 208.36.7.x network entries in the interfaces. We'll give it a test run at the end of the day, but I think we got it tackled. Thanks for all your help.
Trusted Expert Trusted Expert
Trusted Expert
Posts: 791
Registered: ‎07-26-2008
0 Kudos

Re: Netscreen 25 with new ISP

thats great! Smiley Happy
****pls click the button " Accept as Solution" if my post helped to solve your problem****