Netscreen 5gt - How to map IP's

Posted on 2006-05-12
Last Modified: 2011-10-03
I have a netscreen 5gt that I'm trying to set up to host 1 web server and one SQL server.
I was told the best way to do it was to put the web server in a DMZ and the SQL server in a protected zone

I went out and got a netscreen 5gt that doesn't have a 'DMZ' setting because its the cheaper model, but I was told that if I used the Untrusted/Work/Home zone setup the 'Home' Zone would work as the 'protected/firewalled' zone and the Work zone would act as the DMZ.

The problem is that the netscreen doesn't allow the 'Home' zone to talk to the 'Work' zone but the 'work' zone can talk to the 'home' zone.

So a netscreen salesperson said that I could work around this by mapping Ip's from the work zone to the home zone.

So I set up the netscreen with the home/work/untrusted setup and setup the following addresses.

Untrusted = 66.45.xx.xx
Work =
Home =

My servers are
#1 Webserver - = Work Zone
#2 SQL Server - = Home Zone

How do I map these IP's so the SQL server is protected in the home zone but the webserver can get data from the it?
Also does it have anything to do with what juniper calls 'Virtual IP"?
Question by:Matrix1000
    LVL 3

    Assisted Solution

    I am pretty amazed by your statement that you cannot have the two zones talk to each other.  Did you set up routing correctly so that any traffic from the home zone is routed to the specified interface of your work zone?  How do you have set up your current policies?

    Virtual IP's are what other routers sometimes call Virtual Servers or Port Forwarding: you make your Netscreen respond to a certain IP number so that when traffic arrives at that IP for a certain port, it is forwarded to the port on the DMZ or LAN address of a certain machine.
    LVL 9

    Accepted Solution

    Firstly you can create your own zones.

    You have to have policies allowing traffic between zones, especially if you have intrazone blocking enabled.

    VIP and MIP are similar but different :P you want the VIP sorry if confusing.

    Taken from junipers web page.
    "What is a VIP? Virtual IPs (VIP) are one to many mappings of IP address that distinguish traffic based on port number to determine what IP address to send the traffic to.  A common application of VIPs is to have one public IP address represent the Web server, email server and FTP server, each of which has a unique private IP address.  This sharing of one external IP address provides a good way to conserve public IP addresses."

    Taken from Juniper C&E
    "MIP: Mapped IP Address: A MIP is a direct one-to-one mapping of traffic destined for one IP address to another IP

    have you checked out the concepts and examples doc? you can get it from it talks about how to set it up and gives you good examples.
    you can get it here

    other good references.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Let’s list some of the technologies that enable smooth teleworking. 
    Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now