Multiple External IP Ranges on a Juniper SSG5

Posted by Sam on Server Fault See other posts from Server Fault or by Sam
Published on 2011-07-13T18:35:52Z Indexed on 2012/03/31 23:32 UTC
Read the original article Hit count: 417

Filed under:

juniper

I have a Juniper SSG 5 firewall in a datacenter. The first interface (eth0/0) has been assigned a static IP address and has three other addresses configured for VIP Nat. I have a static route configured at the lowest priority for 0.0.0.0/0 to my hosting company's gateway.

Now I need to configure a second IP block. I have the IPs assigned to the second interface (eth0/1) which is in the same security zone and virtual router as the first. However, with this interface enabled I (a) can't initiate outbound sessions (browse the internet, ping, DNS lookup, etc) even though I can access servers behind the firewall just fine from the outside and (b) can't ping the management IP of the firewall/gateway.

I've tried anything I can think of but I guess this is a little above my head. Could anyone point me in the right direction?

Interfaces: ethernet0/0 xxx.xxx.242.4/29 Untrust Layer3
ethernet0/1 xxx.xxx.152.0/28 Untrust Layer3

Routes:

http://i.stack.imgur.com/60s41.png

Related posts about juniper

SSRS Export to Excel not working through VPN (Juniper SA4000)

as seen on Server Fault - Search for 'Server Fault'
We have a SharePoint (MOSS 2007 on Win2003 R2) with SSRS reports (from SQL 2005) embedded in it. When we connect to the SharePoint portal through our VPN (firewall is Juniper SA4000) and using Internet Explorer (6, 7, and 8) and try to export any SSRS report under Excel, we get an error message: Internet… >>> More
Cisco PIX to Juniper Netscreen Policy-based VPN fails Phase 2 Proposal

as seen on Server Fault - Search for 'Server Fault'
I've followed the instructions to configure a VPN between a netscreen device and a Cisco PIX as directed by Cisco's [netscreen to PIX VPN]http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00801c4445.shtml article. The only differences are that I'm running PIX 6.3(5)… >>> More
Juniper SSL-VPN Application Data encoding

as seen on Server Fault - Search for 'Server Fault'
Hi, I want to know how the request & response from the VPN server on e.g.: https://host.tld/dana/jw?con=1234567890&seqno=7 is encoded, the output seems to be binary. I assume it is the application data which gets exchanged with this request, am I right in this? If not, what else gets transferred… >>> More
What is the equivalent of Cisco's 'ip virtual-reassembly' for a Juniper ISG 2000

as seen on Server Fault - Search for 'Server Fault'
I tested my dns servers with the oarc test and my size limit is at least 1403 bytes. I performed the same test before my Juniper ISG 2000 and the result is 2047 bytes. According to the chapter IP "Fragments Filtered" and this article, I think I have a fragmentation problem. This article talks about… >>> More
Juniper SSG5 find bandwidth eater

as seen on Server Fault - Search for 'Server Fault'
Hello forum, I looking for a way to get the list of the top bandwidth eater on my Juniper ssg5. On my old OpenBSD Box I had a command line version of ntop. It was just perfect. How can I do the same thing whith the SSG? Thank you ! >>> More

Developer IT