Viewing Root And Vsys Configurations; Managing Inter-Vsys Traffic With Shared Dmz Zones - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Table 63: Interface Configuration for Root and Vsys (continued)
Interface Configuration
Dedicated Subinterface
Imported Physical/Aggregate
Related
Documentation

Viewing Root and Vsys Configurations

Related
Documentation

Managing Inter-Vsys Traffic with Shared DMZ Zones

Copyright © 2010, Juniper Networks, Inc.
Description
A dedicated subinterface uses VLAN tagging, which enables the device to determine the vsys
to which inbound or outbound traffic through that interface belongs. When you configure a
subinterface in a vsys, the interface is dedicated to that vsys.
A physical or aggregate interface in the null zone is imported from the root system, and then
bound to a shared zone or the Trust-vsys_name zone. When you import a physical or aggregate
interface from the root system, the vsys has exclusive use of that interface. You can also export
interfaces in the null zone to the root system. When you export a interface to the root system,
the root system has exclusive use of that interface.
Using the VLAN Management Interface
To manage a vsys independent of the root system, you can create a management interface
bound to the VLAN zone (automatically created when you create a vsys). Using the VLAN
management interface, a vsys admin can manage the vsys using a unique IP address
and VLAN ID.
You can bind more than one interface to the management zone.
Virtual Router Configurations for Root and Vsys Overview on page 251
Viewing Root and Vsys Configurations on page 253
Zone Configurations for Root and Vsys Overview on page 251
To view a root system configuration, in the NSM navigation tree, select Device Manager
>Devices, and then double-click the root device. To view the vsys devices associated
with the root system, in the device navigation tree, select VSYS.
To view a vsys configuration, in the NSM navigation tree, select Device Manager > Devices,
and then double-click the vsys. A virtual system configuration is similar to a device
configuration, but a vsys configuration displays fewer settings because the root device
controls some settings.
Interface Configurations for Root and Vsys Overview on page 252
Managing Inter-Vsys Traffic with Shared DMZ Zones on page 253
Example: Routing Traffic to Vsys Using VLAN IDs (NSM Procedure) on page 254
Virtual systems across different zones generally use a shared untrust zone for
communication. However, inter-vsys traffic through a shared untrust zone is often
interrupted by external traffic. To overcome such traffic interference in the shared untrust
zone, you can use a shared DMZ zone created at the root level. Each shared DMZ zone
Chapter 8: Configuring VPNs
253