Juniper NetScreen 5GT VIP MIP configuration

i've tried to follow your instructions, but was unable to configure it properly.  telnet was giving me "unknown keyword ..." multiple times.

can you type here exactly what i should type in a telnet session after logging into the NS 5GT?

I am trying to accomplish two things:
1) open ports such as 3389 and forward them from my first public IP to server 1 on the LAN
2) open ports such as 3389 and forward them from my second public IP to server 2 on the LAN

the most important port right now is 3389, so let's only do that one.  use 111.111.111.111 for the first public ip, and 111.111.111.222 for the second public ip.  use 192.168.16.1 for the server #1, and 192.168.16.2 for the server #2.

Like I said i'm new at netscreens, and need some hand holding; please type exactly what i should type.

when i typed:
set interface untrust mip 111.111.111.222 255.255.255.0 192.168.16.2 255.255.255.0 vrouter trust-vr

it said that 255.255.255.0... was an unknown keyword

when i asked for command help through telnet to the firewall, it didn't want a subnet - it said to put "actual host ip" there so i typed:
set interface untrust mip 111.111.111.222 192.168.16.2  .....

and it said that 192.168.16.2 was an unknown keyword...

and it said

ok. i think i got 3389 running on the secondary public IP and it successfully reaches server #2.  that was the creation of the MIP.

so, now there's the VIP left that i'm working on now...

cancel that last comment...  the 3389 is NOT successfully configured on the secondary public ip (supposed to be tied to the server #2).

What version of SOS are you running ? The commands above are tested for 5.4, are you running 5.0 by any chance ?

Cheers,
Rajesh

yes. i'm running 5.0.0r8.1.  with no chance of upgrade because of my unregistered status...

Oops, commands are a little different in 5.0, so the syntax would be as this;

MIP:

set interface untrust mip 111.111.111.222  host 192.168.16.2  vrouter trust-vr
set interface untrust mip 111.111.111.111  host 192.168.16.1  vrouter trust-vr


set policy from untrust to trust any mip(111.111.111.222) RDP permit
set policy from untrust to trust any mip(111.111.111.111) RDP permit

Those are the exact commands. Now for service I have chosen 'RDP', find the exact name for the service and put it in there.

Cheers,
Rajesh

i created a service that i called RDP, and it's for TCP 3389 all the way around.  I'm assuming that i'm using that...  Now, i've seen around the web that after you set policies, then you have to telnet in again, and tell it to "set vip multi-port" and "reset" is this true??

i'm working on this right now.

it says
"one ip in range [111.111.111.222] is in use!!"
"mip: can't be added"
and then lists the failed command.

it also said this for the 111.111.111.111 ip.

how do i remove them?

Do you have this ip address assigned on the untrust interface ? or is there other mip commands that you're tried before ?

If it it is the old command you tried before, do an 'unset mip...' command to remove off.

Cheers,
Rajesh

the 111.111.111.111 IS the untrust ip.

and i had created a MIP previously for the 111.111.111.222.

Ok then you won't be able to create a MIP for that ip but you can create a VIP as below;

set interface untrust vip 111.111.111.111 3389 RDP 192.168.16.1

Cheers,
Rajesh

i've just removed the vip with the unset command.  it would not let me unset MIP, it said bad command or something like that...

i'm trying again.

o.k.  it took this:
set interface untrust vip 111.111.111.111 3389 RDP 192.168.16.1

i've tried the MIP stuff for the secondary IP for the second lan server, but it still says the one ip in range is in use; mip can't be added error.  how do i remove the MIP?

>>set interface untrust mip 111.111.111.222

Try the above.

Cheers,
Rajesh

use 'unset interface untrust mip 111.111.111.222'

Cheers,
Rajesh

and also, is there a "set policy" command for the VIP command that was just accepted?

and what about the "set vip multi-port" and "reset" is that necessary?

after:
unset interface untrust mip 111.111.111.222
it says:
Mip ip(111.111.111.222) host(192.168.16.2) is in use
Mip: can't be removed
Failed command - unset interface untrust mip 111.111.111.222

Did you unset the policy as well ? That is where it is in use.

Cheers,
Rajesh

fl4ian,

  Post all your comments in one post itself, don't split it.

Cheers,
Rajesh

no sir, i don't know how to do that either.

Can you just do a 'get config' on the box and post it here, I'll modify it which you can just re-use.

Cheers,
Rajesh

Here's the "get config":
Remote Management Console
login: netscreen
password:
ns5gt-> get config
Total Config size 3431:
set clock timezone -5
set vrouter trust-vr sharable
unset vrouter "trust-vr" auto-route-export
set service "Groove SSTP" protocol tcp src-port 2492-2492 dst-port 2492-2492
set service "PPTP VPN" protocol tcp src-port 1723-1723 dst-port 1723-1723
set service "RDP" protocol tcp src-port 3389-3389 dst-port 3389-3389
set service "RWW" protocol tcp src-port 4125-4125 dst-port 4125-4125
set service "Sharepoint" protocol tcp src-port 444-444 dst-port 444-444
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set admin name "netscreen"
set admin password "nKjlMtrKMD8PcOUKcsUD/8Bt6nLm0n"
set admin scs password disable username netscreen
set admin auth timeout 10
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Trust" tcp-rst
--- more ---
set zone "Untrust" block
unset zone "Untrust" tcp-rst
set zone "MGT" block
set zone "VLAN" block
set zone "VLAN" tcp-rst
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "trust" zone "Trust"
set interface "untrust" zone "Untrust"
unset interface vlan1 ip
set interface trust ip 192.168.16.254/24
set interface trust nat
set interface untrust ip 216.153.224.15/24
set interface untrust route
--- more ---
set interface untrust gateway 216.153.224.1
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface trust ip manageable
set interface untrust ip manageable
set interface untrust vip untrust 25 "MAIL" 192.168.16.1 manual
set interface untrust vip untrust 443 "HTTPS" 192.168.16.1 manual
set interface untrust vip untrust 123 "NTP" 192.168.16.1 manual
set interface untrust vip untrust 3389 "RDP" 192.168.16.1 manual
set interface untrust vip untrust 4125 "RWW" 192.168.16.1 manual
set interface untrust vip untrust 1723 "PPTP VPN" 192.168.16.1 manual
set interface untrust vip untrust 444 "Sharepoint" 192.168.16.1 manual
set interface "untrust" mip 216.153.224.16 host 192.168.16.2 netmask 255.255.255
.255 vrouter "trust-vr"
set flow tcp-mss
set hostname ns5gt
set dns host dns1 64.65.196.6
set dns host dns2 64.65.208.6
set address "Trust" "hickory" 192.168.16.2 255.255.255.0
set address "Trust" "Willow" 192.168.16.1 255.255.255.0
set ike respond-bad-spi 1
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
--- more ---
set av scan-mgr pattern-update-url http://5gt-t.activeupdate.trendmicro.com:80/a
ctiveupdate/server.ini interval 60
set policy id 1 name "outgoing" from "Trust" to "Untrust"  "Any" "Any" "ANY" per
mit
set global-pro policy-manager primary outgoing-interface untrust
set global-pro policy-manager secondary outgoing-interface untrust
set ssh version v2
set config lock timeout 5
set ntp server "nist.gov.in"
set modem speed 115200
set modem retry 3
set modem interval 10
set modem idle-time 10
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset add-default-route
exit
ns5gt->

a) it wouldn't allow the high end of the source port to go that high; it wanted 65535 instead, so i put it there, it appears to have taken the change to the RDP.
b) after set vip multi-port it said"you must restart the device for the VIP changes to take effect.
c) i continued with : set policy id 2 name "incoming" from untrust to trust any mip(216.153.224.16) RDP permit, and it said: ### Zone Untrust->trust : following address(es) not defined: (dst mip(216.153.224.16)).
i  have saved and reset...

o.k.  the 216.153.224.16 RDP to 192.168.16.2 is working correctly, i've just verified it.

what about the 216.153.224.15 RDP to 192.168.16.1? I beleive i've successfully created a VIP by doing what you suggested earlier:
set interface untrust vip 111.111.111.111 3389 RDP 192.168.16.1

should i set some kind of policy for that?  or in other words, what is my next step?

Okay, so far so good. Now, the vip is created and you need to create a policy to allow the vip connections which would be as below;

set policy id 2 name "incoming" from untrust to trust any vip::1 RDP permit
save

Cheers,
Rajesh

slam dunk, brother.  that works now also.

would it be true to say that port forwarding for MIP goes like:
set service "RDP" protocol tcp src-port 1024-65635 dst-port 3389-3389
set vip multi-port
set policy id 2 name "incoming" from untrust to trust any mip(216.153.224.16) RDP permit
save
reset

and that port forwarding for VIP goes like:
set interface untrust vip 111.111.111.111 3389 RDP 192.168.16.1
set vip multi-port
set policy id 2 name "incoming" from untrust to trust any vip::1 RDP permit
save
reset

in other words, i can add additional port forwarding with different ports/services by using the same syntax, and subbing out IPs and service names and port numbers?  and should all source ports be the spread between 1024-65535, or how do i know when to use the spread vs just the port that it's coming in on, or should be coming in on?

See the source port of any application or service will always be between 1024-65535, the listening end is the one where the application actually listens to.

So when we say ftp works on port 21, it is the listening port and so on for all other services.

You got it pretty much covered now :-)

Why ? => Look at the other services you have defined, both the source port and destination port are same and it would never work even if you wanted it to, you need to change the source port on those as well.

Cheers,
Rajesh

thank you very much rsivanandan!  you've been most helpful to me!  i know who to go to with the next netscreen question :)

thanks again, especially on a late sunday night.  really appreciate your effort.