Netscreen 5GT config

Feb 27, 2005 4 Replies
S

I have a Netscreen 5GT, and it has ABSOLUTELY the worst documentation I've ever seen...



I'm trying to figure out how make it do transparent firewalling, for some web servers I have at a data center. I don't need any NAT as all servers have public IPs.



I read this post:



formatting link
Which says: You need to install your NetScreen in Transparant L2 mode.


  1. set int vlan1 ip x.x.x.x/yy (use a spare address on your lan this is the address you will manage the firewall with)



  1. unset int trust ip



  1. set int trust zone v1-trust
  2. set int untrust zone v1-untrust
  3. setup policies allowing traffic e.g set policy from v1-trust to v1-untrust any any any permit.
  4. setup a default route if you need one set route 0.0.0.0/0 int vlan1 gate x.x.x.x
  5. save the config from RAM to Flash "SAVE"

However I'm stuck here because after doing step 5, I rebooted the firewall and now I can't manage it via the web interface anymore. I did set the vlan1's IP to 192.168.0.10/24, but still I can't get to it. It was working prior to the reboot. Any ideas how to enable it again?



Also, I tried connecting the incoming data cable to the untrust interface, and trust 1 to my internal switch (which the web servers are attached to). However nothing passes through and traffic isn't routed. I didn't do step #6 because I didn't know what that was for. Help?


Vote
Twitter Facebook LinkedIn
M

Step 6 is so that your vlan1 management interface knows how to route traffic for management only. You set the vlan1 management IP to

192.168.0.10, but if your servers have public addresses and if they don't know how to get to 192.168.0.10 (using static routes or other means, it will never reach your firewall for management (review RFC1918). I believe based on your description that you have a simple configuration problem by not applying a routable address to your firewall (same subnet as your webservers) or your servers don't know how to get to it. Also check your admin settings(get admin) checking for management IP's, UI port assignments, etc. If you don't plan on managing the firewall remotely (unlikely) then #6 isn't required, but you will have to do that once you fix your IP problem.
Vote
Twitter Facebook LinkedIn
S

Ok so basically when I do a "get interface", vlan1 shows 10.0.0.10/24. When I set that to be the public IP it tells me there's an IP conflict. Right now I'm testing this with my cable connection so I only have 1 IP and can't use another. Is this the reason I'm not able to get to the web interface? Does the vlan1 need a public IP, and that IP must be unique and not used by any other internal servers?

Vote
Twitter Facebook LinkedIn
S

Thanks I actually confirmed it last night when I placed the Netscreen on the inside LAN, between the switch and a computer. I assigned it a spare private IP and was able to load up the Web UI using that IP. Thanks for your help. :)

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required