Tags:Juniper, Firewall, SSG 140, Windows server 2003, proxy server
At work I have one server (Windows 2003 SBS) which runs Exchange 2003 and ISA 2004. The server has two NIC cards, one set to the local network (plugs straight into the local NETGEAR switch) and the other directly into a BT modem which dynamically sets a public IP address. This public IP address allows VPN access directly to the server as well as access to Outlook Web Access. We dont host our email domain but the servers public IP is authenticated to send mail from our parent company via FQDN, DNS forward and reverse lookup and SPF.
I have decided to remove the software firewall and install a hardware firewall to sit between the server and the Internet. Our parent companies preference is to go with Juniper firewalls, in preference to Cisco, thus I have purchased a Juniper SSG 140.
My initial plan is to plug the Juniper into the trusted network (NETGEAR) and Internet (un-trusted) via the BT modem.
My question is do I need to assign a second public IP for the Juniper server? I have tried plugging the Juniper into the BT modem, and the IP assigned from the BT modem is a private and not public accessible IP. I have also tried statically assigning the servers public IP to the Juniper to see if it would be accessible from the Internet but it was not.
Ultimately what I am trying to do is enable the Juniper as the firewall for my network which allows:
1) VPN access to the network I have set up the VPN users on the Juniper. 2) Continue to allow OWA. Currently utilised via the servers public IP. 3) Outgoing email must be authenticated against the servers public IP. Some spam filters check the originating server of emails against registered servers thus I need to retain the servers public IP in this fashion. 4) Enable Internet access straight to the Juniper instead of via server proxy.
I strongly recommend you to register on the Juniper website, register your products (will be necessary for getting the firmware updates and all) and to get the Concept and Examples guide. Despite the pdf is big (more than 2000 pages) just read the main thing such as the architecture concept (around 200 or 300 pages) and your will see way better how things working. After you can pickup the information you needs on all the big book. Now to answer to your needs, you need to define a DMZ : BT modem <-> Juniper <-> ISA <-> LAN. Now up to you if you need to define the gateway for everyone on the ISA or just for the needed service, you can just enable the gateway (to use the ISA server as a gateway after enabling the routing) for the needed servers. In this case, it would make something like that : BT modem (111.111.111.1/32) <->(WAN=eth3 111.111.111.2/32) Juniper (DMZ=eth4 10.200.0.1/24) (LAN=10.10.0.1/24) <-> (DMZ=eth1 10.200.0.10/24) ISA (LAN=eth2 10.10.20.10/16). And after on your servers 10.10.20.* you can use the ISA as gateway, while still using the interface LAN of the Juniper for your workstations... depends on your needs ! (your modem can have a transparent IP, and you can use straight the WAN ip as well, etc etc...) Of course, splitted domain routing is recommended, etc etc... but it's quite a long story to explain everything, that's why it would be very good for you to understand first of all the ScreenOs architecture ! :)
