Question

juniper SSG140 - Inbound Static Nat to Web Servers

Asked by: cyexx

I am having an issue with a new build of the juniper OS and it has dumped some of my standard configs and it is not allowing me to access 2 web servers behind the unit.

I have 2 web servers running behind the juniper one is using the egress Ip the other is using a VIP address.  I am not able to access these machines threw the firewall.  Nothing is even showing up in the logs for policies.

Please see attached code.

set clock timezone 0
set vrouter trust-vr sharable
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset auto-route-export
exit
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "admin"
set admin http redirect
set admin auth timeout 10
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Untrust-Tun" vrouter "trust-vr"
set zone "Trust" tcp-rst 
set zone "Untrust" block 
unset zone "Untrust" tcp-rst 
set zone "MGT" block 
set zone "DMZ" tcp-rst 
set zone "VLAN" block 
unset zone "VLAN" tcp-rst 
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "ethernet0/0" zone "Trust"
set interface "ethernet0/1" zone "Null"
set interface "ethernet0/2" zone "Untrust"
set interface ethernet0/0 ip 10.10.1.1/24
set interface ethernet0/0 nat
unset interface vlan1 ip
set interface ethernet0/2 ip ***.***.***.118/26
set interface ethernet0/2 route
set interface ethernet0/2 gateway ***.***.***.65
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/0 ip manageable
unset interface ethernet0/2 ip manageable
set interface ethernet0/0 manage mtrace
set interface vlan1 manage mtrace
set interface ethernet0/2 vip ***.***.***.119 80 "HTTP" 10.10.1.9
set interface ethernet0/2 vip ***.***.***.119 + 443 "HTTPS" 10.10.1.9
unset flow no-tcp-seq-check
set flow tcp-syn-check
set domain ****.com
set hostname FW2
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set dns host dns1 208.67.222.222 src-interface ethernet0/2
set dns host dns2 208.67.220.220 src-interface ethernet0/2
set dns host dns3 0.0.0.0
set address "Trust" "10.10.1.14/32" 10.10.1.14 255.255.255.255
set address "Trust" "***.***.***.118/32" ***.***.***.118 255.255.255.255
set address "Trust" "Office" 10.10.1.9 255.255.255.0
set ike respond-bad-spi 1
unset ike ikeid-enumeration
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set url protocol websense
exit
set policy id 6 from "Untrust" to "Trust"  "Any" "***.***.***.118/32" "HTTP" nat src dst ip 10.10.1.14 port 80 permit log count 
set policy id 6
exit
set policy id 5 from "Untrust" to "Trust"  "Any" "VIP(***.***.***.119)" "HTTPS" permit log count 
set policy id 5
exit
set policy id 4 from "Untrust" to "Trust"  "Any" "VIP(***.***.***.119)" "HTTP" permit log count 
set policy id 4
exit
set policy id 3 name "Office" from "Untrust" to "Trust"  "Any" "VIP(***.***.***.119)" "ANY" permit log count 
set policy id 3
exit
set policy id 2 from "Trust" to "Untrust"  "Any" "Any" "ANY" nat src permit log count 
set policy id 2
exit
set monitor cpu 100
set nsmgmt bulkcli reboot-timeout 60
set ssh version v2
set ssh enable
set scp enable
set config lock timeout 5
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset add-default-route
exit
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit

                                  
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:

Select allOpen in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2009-08-05 at 23:58:16ID24630533
Tags

Juniper

,

firewall

,

web servers

,

hosting

Topics

Enterprise Firewalls

,

Network Routers

,

Networking Hardware

Participating Experts
1
Points
500
Comments
25

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. Juniper 5GT NAT Question
    This is probably a simple question, but it has me stumped. I have a Juniper 5GT firewall that is translating the source address of only the mail server on the network. I looked at the policies that I have and none of them (specifily the one that I am watching the log histor...
  2. Juniper NAT woes and Transparency support
    We purchased a Juniper SSG-140 for our Data Center. We currently are using (before deploying the netscreen) an AdTran Switch with VLANs and routing, and a sonicwall firewall. We currently give all devices default gateway of the switch to allow it to route between all the VL...
  3. Juniper nat vpn to Sonicwall
    i have a juniper ssg140 and trying to setup a site-site vpn with a sonicwall pro. We have overlapping subnet so we need to configure NAT. Example: Juniper side is 192.168.1.x with current remote office at 192.168.2.x Sonicwall side is 192.168.2.x as well. Want to translate th...
  4. Juniper VPN remote Users
    I am trying to setup remote VPN users onto a Juniper SSG-140 unit. I have netscreen-remote. I have followed the standard setup for a remote user and I cannot establish a connection with either netscreen-remote and or window VPN client. I am trying to make this as easy to u...
  5. Firewall Policies on Juniper SSG5
    I have a juniper ssg5 and I need to setup a rule to allow a range of ports to an internal Ip address. I have tried using a vip but a vip seems to only allow a single port. I have created a service for my remote phones which allows udp ports 10000-20000. I have then added a...
  6. Juniper SSG5 - status of VIP service reports as "down…
    Juniper SSG5 I have an internal network and an offsite network both protected by Juniper SSG5 firewalls. The way I'm connecting from my machine (on the internal network) to a server located at the offsite location is by RDP. I changed the RDP port number of each server at ...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: deimarkPosted on 2009-08-06 at 01:35:35ID: 25031120

Lets go through yer code here bud.

set interface ethernet0/2 vip ***.***.***.119 80 "HTTP" 10.10.1.9
set interface ethernet0/2 vip ***.***.***.119 + 443 "HTTPS" 10.10.1.9

this says that traffic coming into the external address of ***.***.***.119 on port 80 or 443, should be going to the web server at 10.10.1.9

set address "Trust" "Office" 10.10.1.9 255.255.255.0

This defines the  web server as "Office".

The only reference for this object in a rule is :
set policy id 3 name "Office" from "Untrust" to "Trust"  "Any" "VIP(***.***.***.119)" "ANY" permit log count

Which says that the inbound traffic to the Office object should be allowed through using the VIP on any service (altho the VIP will only forward the 80 and 443 traffic)

The other web server, is using the NAT DST method

set policy id 6 from "Untrust" to "Trust"  "Any" "***.***.***.118/32" "HTTP" nat src dst ip 10.10.1.14 port 80 permit log count

SO this should work also.

One caveat I have at the mo, is that the  rules you have for the above andf the VIP have "any" service listed, I would keep this down to the minimum needed here bud, ie for VIP, keep it at HTTP and HTTPS and for the NAT DST, keep it at HTTP.  This may also be confusing the system as in its trying to take in all traffic and forward to the destination on port 80.

Best to run a debug flow basic to see what is going on with the traffic.

Run the folllowing:

Set flow filters
     set ff dst-port 80
     set ff dst-port 443

Start the debug

    debug flow basic

Clear the buffer
    cl db

< run test, ie try to connect to web servers from outside >

Stop trace
     undebug all

Copy contents of debug buffer to a TFTP server for easier reading and retrieval

get db stream > tftp <ip address of tftp host> trace.txt

Send us this debug stream with details of the server you tried to connect to and from where, we can then review the trace to see where the packet was dropped/lost.

 

by: cyexxPosted on 2009-08-06 at 09:07:53ID: 25035054

I will try the debug dump, I had changed it to any since i had in there only http and https and it was not allowing those threw so said fine just open it up and get it working then i can lock it down.

 

by: deimarkPosted on 2009-08-06 at 09:11:15ID: 25035098

As a quick check though, in your policy page on the webui, click on the log icon to see if there are any other entries created for that rule

 

by: cyexxPosted on 2009-08-06 at 15:27:59ID: 25038698

the only thing that has been dumping to the reports is only on the rule for any to any from trusted to untrusted

I will be able to work on the unit in about an hour since its in production network

 

by: cyexxPosted on 2009-08-06 at 21:24:36ID: 25039985

ok I have just completed the debug I tried connecting from another facility back in.  Still blocked.  I have cleaned up the config so I am pasting the config and the dump.

set clock timezone 0
set vrouter trust-vr sharable
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset auto-route-export
exit
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set auth radius accounting port 1646
set admin http redirect
set admin auth timeout 10
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Untrust-Tun" vrouter "trust-vr"
set zone "Trust" tcp-rst 
set zone "Untrust" block 
unset zone "Untrust" tcp-rst 
set zone "MGT" block 
set zone "DMZ" tcp-rst 
set zone "VLAN" block 
unset zone "VLAN" tcp-rst 
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "ethernet0/0" zone "Trust"
set interface "ethernet0/1" zone "Null"
set interface "ethernet0/2" zone "Untrust"
set interface ethernet0/0 ip 10.10.1.1/24
set interface ethernet0/0 nat
unset interface vlan1 ip
set interface ethernet0/2 ip ***.***.***.118/26
set interface ethernet0/2 route
set interface ethernet0/2 gateway ***.***.***.65
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/0 ip manageable
unset interface ethernet0/2 ip manageable
set interface ethernet0/0 manage mtrace
set interface vlan1 manage mtrace
set interface ethernet0/2 vip ***.***.***.119 80 "HTTP" 10.10.1.9
set interface ethernet0/2 vip ***.***.***.119 + 443 "HTTPS" 10.10.1.9
unset flow no-tcp-seq-check
set flow tcp-syn-check
set domain taostechnologies.com
set hostname FW2
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set dns host dns1 208.67.222.222 src-interface ethernet0/2
set dns host dns2 208.67.220.220 src-interface ethernet0/2
set dns host dns3 0.0.0.0
set address "Trust" "10.10.1.14/32" 10.10.1.14 255.255.255.255
set address "Trust" "***.***.***.118/32" ***.***.***.118 255.255.255.255
set ike respond-bad-spi 1
unset ike ikeid-enumeration
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set url protocol websense
exit
set policy id 6 from "Untrust" to "Trust"  "Any" "***.***.***.118/32" "HTTP" nat src dst ip 10.10.1.14 port 80 permit log count 
set policy id 6
set service "HTTP-EXT"
set service "HTTPS"
exit
set policy id 4 from "Untrust" to "Trust"  "Any" "VIP(***.***.***.119)" "HTTP" permit log count 
set policy id 4
set service "HTTP-EXT"
set service "HTTPS"
exit
set policy id 2 from "Trust" to "Untrust"  "Any" "Any" "ANY" nat src permit log count 
set policy id 2
exit
set monitor cpu 100
set nsmgmt bulkcli reboot-timeout 60
set ssh version v2
set ssh enable
set scp enable
set config lock timeout 5
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset add-default-route
exit
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit
                                              
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:

Select allOpen in new window

 

by: deimarkPosted on 2009-08-07 at 00:28:50ID: 25040507

Can you throw us a bone here bud and tell us what your source was, what destination you tried to connect to and what was the internal address that you should have been redirected to?

Having this info makes it a lot easier for us to review the trace

 

by: deimarkPosted on 2009-08-07 at 00:35:11ID: 25040538

I see no traffic being collected for .119 at all

I see some traffic for .118 however, this is being dropped:

****** 166587.0: <Untrust/ethernet0/2> packet received [48]******
  ipid = 63244(f70c), @1d5ce114
  packet passed sanity check.
  ethernet0/2:209.***.***.145/2109->***.***.***.118/80,6<Root>
  no session found
  flow_first_sanity_check: in <ethernet0/2>, out <N/A>
  self check, not for us
  chose interface ethernet0/2 as incoming nat if.
  packet dropped: for self but not interested
 first pak no session
  POLL_DROP_PAK: vlist 0x191a664, 0x191a664

All 3 packets that came in were dropped with the error of:

  packet dropped: for self but not interested

This is the NAT configured as DST-NAT.

Can I ask why you are using 2 different types of NAT to achieve the same thing?  You use DST-NAT for 1 and VIP for the other.  Did you know that you can create 2 VIPs on the untrust interface and then have their own port bindings as per the one for 119?

It might be better to try both webservers as the same and then work on it as at the moment we are trying to debug 2 different technologies and even then, we only see traffic going to the 1 web server.

Can you confirm that the 119 address was being connected?

 

by: cyexxPosted on 2009-08-07 at 11:10:09ID: 25045444

yes I can arp from my cisco router which is infront of the juniper the 119 which is showing the correct mac address as in the VIP mac address.

The setup for this juniper is as such.

the ingress is 118 which it is using to nat the computer behind it.  It should then allow port 80 and 443 traffic to be forwarded on 118 inbound to 10.10.1.14

Setup VIP as 119 with allowed inbound traffic of port 80 and 443 to be directed to 10.10.1.9

These should be the only traffic other then statefull packets allowed in.

After the unit is working just fine then I am adding VPN connections to it.  But base config of 2 Public IP addresses forwarding in with standard NAT behind the unit.

 

by: deimarkPosted on 2009-08-07 at 12:17:30ID: 25046040

Sorry bud, but I still don't understand why you use nat dst for 118 and VIP for 119.  Especially when you test only for 118.

Can you create another VIP for 118(which will then create the upstream arp) and then add the policies as per the 119 VIP.

Re run the trace and test both VIPs please.  Show us the trace and we will be able to help more.

 

by: cyexxPosted on 2009-08-07 at 12:21:41ID: 25046078

I have been using the web-interface for the config of the unit.

It will not allow me to create a VIP for 118 since 118 is the WAN egress of the unit

 

by: deimarkPosted on 2009-08-07 at 12:48:51ID: 25046277

Try the CLI of

set interface ethernet0/0 vip interface-ip 80 "HTTP" 10.10.1.14
set interface ethernet0/0 vip interface-ip + 443 "HTTPS" 10.10.1.14

I don't have web access to my firewall, but I do have SSH.

And using the "set interface ethernet0/0 vip interface-ip" allowed me to use the actual interface IP

 

by: cyexxPosted on 2009-08-07 at 13:04:12ID: 25046427

I will try that out after I am back on-site with the unit.  I will be going on-site around 7pm EST

 

by: cyexxPosted on 2009-08-07 at 20:20:39ID: 25048186

I have cleared out the VIP settings and the policys that go to them See below commands and error

FW2-> set interface ethernet0/2 vip **.**.***.118 80 "HTTP" 10.10.1.14
Service (port=80) not supported for this vip 209.60.224.118.

Failed command - set interface ethernet0/2 vip **.**.***.118 80 "HTTP" 10.10.1.14

FW2-> set interface ethernet0/2 vip **.**.***.119 80 "HTTP" 10.10.1.9
###VIP on untrusted interface already defined.

Failed command - set interface ethernet0/2 vip **.**.***119 80 "HTTP" 10.10.1.9

 

by: cyexxPosted on 2009-08-07 at 20:38:15ID: 25048227

I have it setup so I can remote into the unit since it is out of production environment until monday at 8am EST

 

by: deimarkPosted on 2009-08-08 at 04:27:02ID: 25049334

You will need to change the default parameters for the web management access on the box.

Change the default web port to be something other than port 80, ie 8080 and change the defaullt SSL port for the webui to be something like 4433

Once this is done, you will then be able to add the VIP to the external interface

 

by: cyexxPosted on 2009-08-09 at 19:24:50ID: 25056823

I have changed over the ports and its not letting me in via web interface.

Also the info on the unit is below.  I have asked for a refresh on the OS so that it can be up-to date.

FW2-> get system
Product Name: SSG-140
Serial Number: **************, Control Number: ffffffff
Hardware Version: 1010(0)-(00), FPGA checksum: 00000000, VLAN1 IP (0.0.0.0)
Software Version: 5.4.0r1a.0, Type: Firewall+VPN
Feature: AV-K
Compiled by build_master at: Thu Aug 31 17:35:57 PDT 2006
Base Mac: 0017.cb48.6d80
File Name: ssg140.5.4.0r1a.0, Checksum: b0590f86
, Total Memory: 512MB

Date 08/27/2002 03:22:25, Daylight Saving Time enabled
The Network Time Protocol is Disabled
Up 116 hours 29 minutes 20 seconds Since 22Aug2002:06:53:05
Total Device Resets: 0

System in NAT/route mode.

Use interface IP, Config Port: 8080
User Name: admin

 

by: cyexxPosted on 2009-08-09 at 21:33:05ID: 25057181

I have the http and https management moved over to 8080 and 4433

It will not let me set the VIP of the main interface at the same time as adding another public IP to the unit.

FW2-> set interface ethernet0/2 vip ***.***.***.119 + 80 "HTTP" 10.10.1.9
###VIP on untrusted interface already defined.

Failed command - set interface ethernet0/2 vip ***.***.***.119 + 80 "HTTP" 10.10.1.9

I have tired accessing the site from the outside that 118 goes to and it does not forward threw so i dumped another debug log.

set clock timezone 0
set vrouter trust-vr sharable
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset auto-route-export
exit
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set auth radius accounting port 1646
set admin port 8080
set admin http redirect
set admin auth timeout 10
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Untrust-Tun" vrouter "trust-vr"
set zone "Trust" tcp-rst 
set zone "Untrust" block 
unset zone "Untrust" tcp-rst 
set zone "MGT" block 
set zone "DMZ" tcp-rst 
set zone "VLAN" block 
unset zone "VLAN" tcp-rst 
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "ethernet0/0" zone "Trust"
set interface "ethernet0/1" zone "Null"
set interface "ethernet0/2" zone "Untrust"
set interface ethernet0/0 ip 10.10.1.1/24
set interface ethernet0/0 nat
unset interface vlan1 ip
set interface ethernet0/2 ip ***.***.***.118/26
set interface ethernet0/2 route
set interface ethernet0/2 gateway ***.***.***.65
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/0 ip manageable
unset interface ethernet0/2 ip manageable
unset interface ethernet0/0 manage web
set interface ethernet0/0 manage mtrace
set interface ethernet0/2 manage ping
set interface vlan1 manage mtrace
set interface ethernet0/2 vip untrust 80 "HTTP" 10.10.1.14
set interface ethernet0/2 vip untrust 443 "HTTPS" 10.10.1.14
unset flow no-tcp-seq-check
set flow tcp-syn-check
set domain taostechnologies.com
set hostname FW2
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set dns host dns1 208.67.222.222 src-interface ethernet0/2
set dns host dns2 208.67.220.220 src-interface ethernet0/2
set dns host dns3 0.0.0.0
set address "Trust" "10.10.1.14/32" 10.10.1.14 255.255.255.255
set address "Trust" "***.***.***.118/32" ***.***.***.118 255.255.255.255
set ike respond-bad-spi 1
unset ike ikeid-enumeration
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set url protocol websense
exit
set policy id 8 from "Untrust" to "Trust"  "Any" "VIP(ethernet0/2)" "HTTPS" permit log count 
set policy id 8
exit
set policy id 7 from "Untrust" to "Trust"  "Any" "Any" "HTTP" permit log count 
set policy id 7
exit
set policy id 2 from "Trust" to "Untrust"  "Any" "Any" "ANY" nat src permit log count 
set policy id 2
exit
set monitor cpu 100
set nsmgmt bulkcli reboot-timeout 60
set ssh version v2
set ssh enable
set scp enable
set config lock timeout 5
set ssl port 4433
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset add-default-route
exit
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit
                                              
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:

Select allOpen in new window

 

by: deimarkPosted on 2009-08-10 at 00:39:35ID: 25057762

OK, lets take this back to basics here.

1.  Delete the address object you have for the external address (used on the nat dst)

ie unset address "Trust" "***.***.***.118/32" ***.***.***.118 255.255.255.255

2.  Use the webUI to access the firewall.  Make sure that you use the following syntax:
   http://<ip address of firewall>:8080
or
  https://<ip address of firewall>:4433

3.  Go to the untrust interface, e0/2 and click on VIP.
4.  At the top you will have the option of adding a new VIP entry (you should already see one for the main interface IP of 118)
5.  Click on "add new VIP using a Virtual IP" enter the 119 address
6.  Ensure you have all the VIP services configured as they should be and bind to the correct VIP.
7.  Delete the current policies you have for teh VIPs.
8.  Re add the policies ensuring you are selecting both HTTP and HTTPS for each VIP as the destination.
9.  Re test.


From the trace you sent, all the traffic for the 118 server appeared to be allowed through as it pertained to a previous known session, however, your rules were a bit odd.  Policy 8 allows HTTPS, not HTTP to the VIP you created and the trace was for HTTP.

Policy 7 simply allowed HTTP through the firewall, no NAT was taking place.

We are almost there bud, keep at it and make sure that you are testing something that you have actually set up, otherwise the test itself will be meaningless.

 

by: cyexxPosted on 2009-08-10 at 04:16:30ID: 25058774

I will go in and remove all of the external interfaces and rebuild them again.

That is what I tried doing this last time.  I removed all inbound policies and untrusted networks.

 

by: cyexxPosted on 2009-08-11 at 23:02:10ID: 25076043

I have it working now.  I when I pushed the new core OS at it then it stoped having the issues with the multiple VIP on the untrusted interface.

I have included the config.  Take a look to make sure I did not miss anything but I can access the sites threw the firewall now from the outside world.

unset key protection enable
set clock timezone 0
set vrouter trust-vr sharable
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset auto-route-export
exit
set alg appleichat enable
unset alg appleichat re-assembly enable
set alg sctp enable
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set auth radius accounting port 1646
set admin port 8080
set admin http redirect
set admin auth web timeout 10
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Untrust-Tun" vrouter "trust-vr"
set zone "Trust" tcp-rst 
set zone "Untrust" block 
unset zone "Untrust" tcp-rst 
set zone "MGT" block 
unset zone "V1-Trust" tcp-rst 
unset zone "V1-Untrust" tcp-rst 
set zone "DMZ" tcp-rst 
unset zone "V1-DMZ" tcp-rst 
unset zone "VLAN" tcp-rst 
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "ethernet0/0" zone "Trust"
set interface "ethernet0/1" zone "Null"
set interface "ethernet0/2" zone "Untrust"
set interface ethernet0/0 ip 10.10.1.1/24
set interface ethernet0/0 nat
unset interface vlan1 ip
set interface ethernet0/2 ip ***.***.***.118/26
set interface ethernet0/2 route
set interface ethernet0/2 gateway ***.***.***.65
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/0 ip manageable
unset interface ethernet0/2 ip manageable
unset interface ethernet0/0 manage web
set interface ethernet0/0 manage mtrace
set interface ethernet0/2 manage ping
set interface vlan1 manage mtrace
set interface ethernet0/2 vip interface-ip 80 "HTTP" 10.10.1.14
set interface ethernet0/2 vip interface-ip 443 "HTTPS" 10.10.1.14
set interface ethernet0/2 vip ***.***.***.119 80 "HTTP" 10.10.1.9
set interface ethernet0/2 vip ***.***.***.119 + 443 "HTTPS" 10.10.1.9
unset flow no-tcp-seq-check
set flow tcp-syn-check
unset flow tcp-syn-bit-check
set flow reverse-route clear-text prefer
set flow reverse-route tunnel always
set hostname FW2
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set dns host dns1 208.67.222.222 src-interface ethernet0/2
set dns host dns2 208.67.220.220 src-interface ethernet0/2
set dns host dns3 0.0.0.0
set address "Trust" "10.10.1.14/32" 10.10.1.14 255.255.255.255
set address "Trust" "***.***.***.118/32" ***.***.***.118 255.255.255.255
set crypto-policy
exit
set ike respond-bad-spi 1
set ike ikev2 ike-sa-soft-lifetime 60
unset ike ikeid-enumeration
unset ike dos-protection
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit
set url protocol websense
exit
set policy id 12 from "Untrust" to "Trust"  "Any" "VIP(ethernet0/2)" "HTTPS" permit log count 
set policy id 12
exit
set policy id 11 from "Untrust" to "Trust"  "Any" "VIP(ethernet0/2)" "HTTP" permit log count 
set policy id 11
exit
set policy id 10 from "Untrust" to "Trust"  "Any" "VIP(***.***.***.119)" "HTTPS" permit log count 
set policy id 10
exit
set policy id 9 from "Untrust" to "Trust"  "Any" "VIP(***.***.***.119)" "HTTP" permit log count 
set policy id 9
exit
set policy id 2 from "Trust" to "Untrust"  "Any" "Any" "ANY" nat src permit log count 
set policy id 2
exit
set nsmgmt bulkcli reboot-timeout 60
set ssh version v2
set ssh enable
set scp enable
set config lock timeout 5
unset license-key auto-update
set telnet client enable
set ssl port 4433
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset add-default-route
exit
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit
                                              
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:

Select allOpen in new window

 

by: deimarkPosted on 2009-08-12 at 00:44:52ID: 25076440

That seems fine bud.

You can combine the policies of 11 and 12, and 9 and 10 to use both HTTP and HTTPS in the services filed, but given that yuo don't have that many policies there in the first place, it should be all good.

If you notice anything else that's not quite right with the workings of the config, let us know and we can review again but this seems fine to me

 

by: cyexxPosted on 2009-08-12 at 05:13:30ID: 25077840

thanks for the help I am going to stress it out for the remainder of 24 hours if no issues i will close it out.  Thank you for all of the help.

FYI the upgrade in the OS helped alot since part of the problem was that I was used to the JOS of version 6 so the old one was giving me issues and just causing layered problems

 

by: deimarkPosted on 2009-08-12 at 05:49:25ID: 25078129

Kewl bud, let us know how it goes.

DM

 

by: cyexxPosted on 2009-08-13 at 19:30:27ID: 25094865

Its all working well, now off to work on site to site and client vpn connections for me.

 

by: deimarkPosted on 2009-08-14 at 00:25:40ID: 25095807

Glad to hear its all good bud.

DM

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...