Hi,
I'm trying to get my Netscreen 25 configured as a transparent firewall, but cannot get it to work. The way I wolud like to set it up as followed:
--------------
--------------------- INTERNET ----------|ROUTER|
-------int1--|NETSCREEN|--int3-------TRUSTED NETWORK -------------
--------------------
I'm configuring the Netscreen with a console cable, since I'm not able to get access to the Netscreen on the VLAN1 IP address. When I look at the status of the interface, it's Down.
It is very hard to find a configuration example for a Netscreen in transparent mode. I've tried to follow the instructions from Netscreen Concepts and Examples, but it did not get me further. A few other topics in the discussion groups did not solve it.
Can someone please tell me what I should adjust to get the device working as a transparent firewall? I really need this desparately.
The following confiiguration is used:
set clock timezone 0 set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set auth-server "Local" id 0 set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "netscreen" set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn" set admin auth timeout 10 set admin auth server "Local" set admin format dos set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" set zone "DMZ" vrouter "trust-vr" set zone "VLAN" vrouter "trust-vr" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Untrust" block unset zone "Untrust" tcp-rst set zone "MGT" block set zone "DMZ" tcp-rst set zone "VLAN" block unset zone "VLAN" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop set zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src set zone "V1-Untrust" screen land set interface "ethernet1" zone "Trust" set interface "ethernet2" zone "DMZ" set interface "ethernet3" zone "Untrust" set interface vlan1 ip 66.249.93.100/24 set interface vlan1 nat unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface vlan1 ip manageable set interface ethernet1 manage mtrace unset flow no-tcp-seq-check set flow tcp-syn-check set hostname ns25 set pki authority default scep mode "auto" set pki x509 default cert-path partial set ike respond-bad-spi 1 unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set url protocol sc-cpa exit set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit set policy id 1 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set config lock timeout 5 set snmp port listen 161 set snmp port trap 162 set vrouter "untrust-vr" exit set vrouter "trust-vr" unset add-default-route set route 0.0.0.0/0 interface ethernet1 gateway 66.249.93.1 exit set vrouter "untrust-vr" exit set vrouter "trust-vr" exit
thank you very much@!!