ScreenOS Firewalls (NOT SRX)
Reply
New User
GProietti
Posts: 1
Registered: ‎10-16-2010
0

PBR and MIP on same IP address

Hi heverybody,

 

We have a SSG140 (ScreenOS 6.2.0) and two Internet Providers (ISP1 and ISP2).

Default gateway for all traffic is on ISP1 but we want to direct Mail server to ISP2.

Mail server uses a private address (10.0.0.4) that is translated using MIP.

 

How we can configure a PBR to enforce the Mail traffic to be directed to IPS2 (using a public address fro ISP2 addressing space) ?

Have the PBR to be configured referring to the real server IP or to the translated MIP address ?

Have we to add specific Policy ?

 

We already tried to configure PBR that performs well itself, but when we introduce the MIP in order to translate  10.0.0.4 -> ISP2 public address we fall in trouble.

 

Policies, PBR and interfaces are all configured on the trust-vr.

 

Thanks in advance.

Giuseppe Proietti

 

Distinguished Expert
echidov
Posts: 858
Registered: ‎11-02-2009
0

Re: PBR and MIP on same IP address

Hi Guiseppe,

 

This might be a problem with assymetric routing over Internet.  The outbound direction should be OK.  The problem is the inbound sessions. The packets arriving over ISP2 connection are correctly forwarded to 10.0.0.4 but the response packets are sent to ISP1. I would try to use "unset flow reverse-route-clear text" to disable the route lookup for the reverse direction. The SSG will be sending the response packets using the cached MAC address.

You can also configure source based routing for 10.0.0.4 instead of PBR. SBR is much simpler and does the same in your case.

 

Kind regards,

Edouard

Kind regards,
Edouard
Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.