Two Netscreen Questions

I do this with different HTTP rules, one for the general users and one for special users. If you have the problem user setup with a fixed IP in the network (or a reservation), or if you have AD support, you can limit the user via HTTP rule 1 while allowing the others to use HTTP rule 2.

I have not set this up in NS units, but it works that way with WG firewalls.

Where is it set? IIRC, it's a global setting that you enable or disable in the DI setup, which you can then apply or not apply to a policy. But I don't think you can apply or not apply it selectively from the rest of the DI configs to different policies. I could be wrong though, I havent' played with the DI on those units in a long time.

Yes, VIPs are actually global. It will work. Just set up the VIP like you think it should be, with the correct destination address, and when you make the policy, make it to the right zone, and you'll be fine.

BTW, I think you can do more than one VIP on a GT, just not if you're using PPoE. At least, I've done it on XPs and XTs enough times, and generally the GT's work about the same.

-Russ.

According to the documentation, these are two examples of CLI commands to enable HTTP content filtering:

set zone untrust screen component-block jar set zone untrust screen component-block exe

So it looks like this filtering applies to an entire zone and can't be applied to single IP addresses or ranges of addresses.

If anyone has any further info on this, I'd appreciate hearing it.

I can confirm it is for an entire zone. You might be able to get what you want by using deep inspection, if you have a license for that...

For the second question: yes, you can have a VIP redirect to different zones. Just make sure you define your policy using the right zone. Are you sure you can't add a second VIP? You need a separate IP address for that, though.