Screen OS

hi,

here is my network

my firewall is a SSG 140 running 6.1.0 screenos.

 I need to nat the pc 172.16.13.69 with ip 195.120.222.1 on interface dmz.

at this time i do this with a policie nat but when i try to ping  the server 157.23.17.21 my station isn't nat.

please help 

Hi Outback,

Does the nated ip is 195.120.222.1 ? Cause there is no 195.120 ... networks in your sheme ! So even if you nat your ip , you will have routing problems in this case.

no i have put the right route on booth side.

i can make a connection from 157.23.17.21 to 195.120.222.1 (nat of 172.16.13.69, i use a polici based nat

but when i make a connection from 172.16.13.69 to 157.23.17.21 i cant be natted behind the same address because i don't use a mip.

for the mip i can't use it because when i try it say "The mapped ip must be in the same subnet as the interface" 

Hi Outback,

Put your interface in the "untrust" zone instead of the "DMZ" zone :

You will no longer have the "The mapped ip must be in the same subnet as the interface" message error

You will then have to re-set all your security policy.

i have the solution.

enter the mip in cli and it's ok.

thanks for help