Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual page 94

Configuring ScreenOS Devices Guide
70
You set the Trust zone interface in NAT mode. It uses the Untrust zone interface IP address
as its source address in all outbound traffic except for traffic sent to the central office.
You configure a policy to the central office that translates the source address to an
address in the DIP pool in the extended interface. (The DIP pool ID number is 5. It contains
one IP address, which, with port address translation, can handle sessions for ~64,500
hosts.) The MIP address that the central office uses for inbound traffic is 200.1.1.1, which
you enter as " HQ" in the Untrust zone address book on each security device.
Each ISP must set up a route for traffic destined to a site at the end of a leased line to
use that leased line. The ISPs route any other traffic they receive from a local security
device to the Internet.
Add the devices:
1.
For Office A, add a NetScreen-208 security device.
For Office B, add a NetScreen-204 security device.
Configure ethernet1 (Trust Zone) for Office A:
2.
Double-click Office A device to open the device configuration. In the device navigation
tree, select Network > Interface.
Double-click ethernet1. The General Properties screen appears.
Configure IP address/netmask as 10.1.1.1/24 and Interface Mode as NAT.
3.
Click OK to save your changes.
4.
Configure ethernet3 (Untrust Zone) for Office A:
5.
In the device navigation tree, select Network > Interface.
Double-click ethernet3. The General Properties screen appears.
Configure IP address/netmask as 195.1.1.1/24 and Interface Mode as Route.
In the interface navigation tree, select NAT > DIP. Click the Add icon to display the
6.
New Dynamic IP dialog box. Configure the DIP, and then click OK:
Enter the DIP ID.
7.
Add multiple DIP ranges for a particular DIP ID as follows:
8.
Select the Multiple DIP Range check box.
Click the Add icon. The New MultiRange of DIP dialog box appears.
For Rang ID, enter 1.
For Lower IP, enter 210.10.1.1.
For Upper IP, enter 210.10.1.1.
For Start, enter 210.10.1.1.
9.
For End, enter 210.10.1.1.
10.
For Shift From, enter 10.10.1.2.
11.
Copyright © 2010, Juniper Networks, Inc.