1. Home
  2. Networking Firewalls
  3. Netscreen 25 - transparent firewall

Netscreen 25 - transparent firewall

Hi,

I'm trying to get my Netscreen 25 configured as a transparent firewall, but cannot get it to work. The way I wolud like to set it up as followed:

--------------

--------------------- INTERNET ----------|ROUTER|

-------int1--|NETSCREEN|--int3-------TRUSTED NETWORK -------------

--------------------

I'm configuring the Netscreen with a console cable, since I'm not able to get access to the Netscreen on the VLAN1 IP address. When I look at the status of the interface, it's Down.

It is very hard to find a configuration example for a Netscreen in transparent mode. I've tried to follow the instructions from Netscreen Concepts and Examples, but it did not get me further. A few other topics in the discussion groups did not solve it.

Can someone please tell me what I should adjust to get the device working as a transparent firewall? I really need this desparately.

The following confiiguration is used:

set clock timezone 0 set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set auth-server "Local" id 0 set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "netscreen" set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn" set admin auth timeout 10 set admin auth server "Local" set admin format dos set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" set zone "DMZ" vrouter "trust-vr" set zone "VLAN" vrouter "trust-vr" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Untrust" block unset zone "Untrust" tcp-rst set zone "MGT" block set zone "DMZ" tcp-rst set zone "VLAN" block unset zone "VLAN" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop set zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src set zone "V1-Untrust" screen land set interface "ethernet1" zone "Trust" set interface "ethernet2" zone "DMZ" set interface "ethernet3" zone "Untrust" set interface vlan1 ip 66.249.93.100/24 set interface vlan1 nat unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface vlan1 ip manageable set interface ethernet1 manage mtrace unset flow no-tcp-seq-check set flow tcp-syn-check set hostname ns25 set pki authority default scep mode "auto" set pki x509 default cert-path partial set ike respond-bad-spi 1 unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set url protocol sc-cpa exit set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit set policy id 1 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set config lock timeout 5 set snmp port listen 161 set snmp port trap 162 set vrouter "untrust-vr" exit set vrouter "trust-vr" unset add-default-route set route 0.0.0.0/0 interface ethernet1 gateway 66.249.93.1 exit set vrouter "untrust-vr" exit set vrouter "trust-vr" exit

thank you very much@!!

Reply to
deamen
Loading thread data ...

The details vary depending on ScreenOS version, but for starters you need to place your interfaces in Layer 2 zones - you currently have them in Layer 3:

Try:

set interface "ethernet1" zone "V1-Trust" set interface "ethernet3" zone "V1-Untrust"

Triffid

Reply to
Triffid

Thanks for the tip Triffid. I found that my "drawing" in my previous post is not correct. eth1 is connected to the trust and eth3 is untrust.

Currently I cannot connect tot he management webpage from outside the trusted network (from the internet). Can anyone tell me how I can configure this? Will setup an ACL for this webpage eventually.

Thanks!

set clock timezone 0 set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set zone "DMZ" vrouter "trust-vr"-vr" set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "netscreen" set admin password "nCCJsjn" et zone "VLAN" vrouter "trust-vr" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Untrust" block unset zone "Untrust" tcp-rst set zone "MGT" block set zone "DMZ" tcp-rst set zone "VLAN" block unset zone "VLAN" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop unset zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src unset zone "V1-Untrust" screen land set interface "ethernet1" zone "V1-Trust" set interface "ethernet2" zone "V1-DMZ" set interface "ethernet3" zone "V1-Untrust" set interface vlan1 ip 66.249.93.100/25 set interface vlan1 route unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface vlan1 ip manageable set interface vlan1 manage mtrace unset flow no-tcp-seq-check set flow tcp-syn-check set hostname ns25 set pki authority default scep mode "auto" set pki x509 default cert-path partial set ike respond-bad-spi 1 unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set url protocol sc-cpa exit set policy id 1 from "V1-Trust" to "V1-Untrust" "Any" "Any" "ANY" permit set policy id 1 exit set policy id 100 from "V1-Untrust" to "V1-Trust" "Any" "Any" "ANY" permit set policy id 100 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set config lock timeout 5 set snmp port listen 161 set snmp port trap 162 set vrouter "untrust-vr" exit set vrouter "trust-vr" unset add-default-route exit set vrouter "untrust-vr" exit set vrouter "trust-vr" exit

Reply to
deamen

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.