Screen OS

Hello everyone my name is John and I haven`t been able to properly access my servers from the outside.

 

I have a free nas box sitting on a vlan (tag 11) it has an ip of 10.1.1.203 it resides on the DMZ zone on a sub interface 1.2

 

Internally i can go from my trust zone (home wifi)  to the freenas on the DMZ , i used  sftp to test and it works fine.

 

But when I added a policy from untrust to dmz and try to sftp to my freenas box , it does not work.

 

I have a few other servers i would like to configure in the same zone and interface 1.2 but i guess If i`m told how to get the free nas box to respond to external requests i`ll be able to mimic the setup for the other servers.

 

&

 

I also have a pbx connected to sub interface 6.2 that i would also like to have access to externally for remote extentions to be able to connect to my pbx. This machine is in a new zone i created called "new DMZ"

 

thank you all for your time and help.

 

Best Regards ,

 

John

 

Please see screen shots of my setup attached..

 

 ** My hunch is that i`m missing static routing to the sub interfaces , because when i create a VIP on the untrust interface(internet in) the status is allways "down"

 

 

#DMZ
#SSG5
#firewall
#vip

Hi John,

You mentioned 10.1.1.203 address is on interface eth0/1.2(DMZ zone), however, as per interface list this is in Trust zone.
Also, look for arp entry for the server on the firewall (get arp)


Hope this helps.

Thanks.
Hardeep

Please see the ARP reply and the current inferface list, there was an entry for 10.1.1.203

 

thanks!

Hi,

You mentioned that VIP is always down, can you share the VIP config as well.
Do you see any hits on the VIP policy?
A debug can be tried to look for the packet handling.

1. set ff dst-ip <vip-ip> dst-port <port-no>
2. undebug all
3. clear db
4. debug flow basic
5. initiate traffic to VIP
6. undebug all
7. get db st


Thanks.
Hardeep

This is my current config : Thanks Sahota:

 

get config
Total Config size 14957:
set clock ntp
set clock timezone -5
set vrouter trust-vr sharable
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset auto-route-export
exit
set vrouter name "VMVR" id 1025 sharable
set vrouter "VMVR"
unset auto-route-export
set preference ebgp 250
set preference ibgp 40
set preference ospf-e2 254
exit
set service "FREENAS" protocol tcp src-port 0-65535 dst-port 2255-2255
set service "GOOSE" protocol tcp src-port 0-65535 dst-port 34443-34443
set service "MTS.NET" protocol tcp src-port 0-65535 dst-port 8223-8223
set service "PBX" protocol tcp src-port 0-65535 dst-port 9445-9445
set service "PBX-RTP" protocol udp src-port 0-65535 dst-port 10001-11201
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "netscreen"
set admin password "nKuZIxccxhr5GtjJcbgIOs+BBmMtptAKnn"
set admin user "xxxxxx" password "nKa7Fbr+EObHcxcxcxxccRgNPseMBmMtGOCE5n" privilege "all"
set admin port 8080
set admin mail alert
set admin mail server-name "smtp.gmail.com"
set admin mail mail-addr1 "a@gmail.com"
set admin mail traffic-log
set admin auth timeout 10
set admin auth server "Local"
set admin format dos
set vip multi-port
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone id 100 "VMNET"
set zone "VMNET" vrouter "VMVR"
set zone id 101 "NEWDMZ"
set zone "Untrust-Tun" vrouter "trust-vr"
set zone "Trust" block
set zone "Trust" tcp-rst
set zone "Untrust" block
unset zone "Untrust" tcp-rst
set zone "DMZ" tcp-rst
set zone "VLAN" block
unset zone "VLAN" tcp-rst
set zone "VMNET" tcp-rst
unset zone "NEWDMZ" tcp-rst
set zone "Trust" screen port-scan
set zone "Trust" screen ip-sweep
set zone "Untrust" screen icmp-flood
set zone "Untrust" screen udp-flood
set zone "Untrust" screen winnuke
set zone "Untrust" screen port-scan
set zone "Untrust" screen ip-sweep
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ip-spoofing
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "Untrust" screen syn-frag
set zone "Untrust" screen icmp-fragment
set zone "Untrust" screen icmp-large
set zone "Untrust" screen limit-session source-ip-based
set zone "Untrust" screen syn-ack-ack-proxy
set zone "Untrust" screen block-frag
set zone "Untrust" screen limit-session destination-ip-based
set zone "Untrust" screen icmp-id
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set zone "DMZ" screen alarm-without-drop
set zone "DMZ" screen icmp-flood
set zone "DMZ" screen udp-flood
set zone "DMZ" screen winnuke
set zone "DMZ" screen port-scan
set zone "DMZ" screen ip-sweep
set zone "DMZ" screen tear-drop
set zone "DMZ" screen syn-flood
set zone "DMZ" screen ip-spoofing
set zone "DMZ" screen ping-death
set zone "DMZ" screen ip-filter-src
set zone "DMZ" screen land
set zone "DMZ" screen syn-frag
set zone "DMZ" screen tcp-no-flag
set zone "DMZ" screen unknown-protocol
set zone "DMZ" screen ip-bad-option
set zone "DMZ" screen ip-record-route
set zone "DMZ" screen ip-timestamp-opt
set zone "DMZ" screen ip-security-opt
set zone "DMZ" screen ip-loose-src-route
set zone "DMZ" screen ip-strict-src-route
set zone "DMZ" screen ip-stream-opt
set zone "DMZ" screen icmp-fragment
set zone "DMZ" screen icmp-large
set zone "DMZ" screen syn-fin
set zone "DMZ" screen fin-no-ack
set zone "DMZ" screen limit-session source-ip-based
set zone "DMZ" screen syn-ack-ack-proxy
set zone "DMZ" screen block-frag
set zone "DMZ" screen limit-session destination-ip-based
set zone "DMZ" screen component-block zip
set zone "DMZ" screen component-block jar
set zone "DMZ" screen component-block exe
set zone "DMZ" screen component-block activex
set zone "DMZ" screen icmp-id
set zone "DMZ" screen ip-spoofing drop-no-rpf-route
set zone "NEWDMZ" screen alarm-without-drop
set zone "NEWDMZ" screen icmp-flood
set zone "NEWDMZ" screen udp-flood
set zone "NEWDMZ" screen winnuke
set zone "NEWDMZ" screen port-scan
set zone "NEWDMZ" screen ip-sweep
set zone "NEWDMZ" screen tear-drop
set zone "NEWDMZ" screen syn-flood
set zone "NEWDMZ" screen ip-spoofing
set zone "NEWDMZ" screen ping-death
set zone "NEWDMZ" screen ip-filter-src
set zone "NEWDMZ" screen land
set zone "NEWDMZ" screen syn-frag
set zone "NEWDMZ" screen tcp-no-flag
set zone "NEWDMZ" screen unknown-protocol
set zone "NEWDMZ" screen ip-bad-option
set zone "NEWDMZ" screen ip-record-route
set zone "NEWDMZ" screen ip-timestamp-opt
set zone "NEWDMZ" screen ip-security-opt
set zone "NEWDMZ" screen ip-loose-src-route
set zone "NEWDMZ" screen ip-strict-src-route
set zone "NEWDMZ" screen ip-stream-opt
set zone "NEWDMZ" screen icmp-fragment
set zone "NEWDMZ" screen icmp-large
set zone "NEWDMZ" screen syn-fin
set zone "NEWDMZ" screen fin-no-ack
set zone "NEWDMZ" screen limit-session source-ip-based
set zone "NEWDMZ" screen syn-ack-ack-proxy
set zone "NEWDMZ" screen block-frag
set zone "NEWDMZ" screen limit-session destination-ip-based
set zone "NEWDMZ" screen component-block zip
set zone "NEWDMZ" screen component-block jar
set zone "NEWDMZ" screen component-block exe
set zone "NEWDMZ" screen component-block activex
set zone "NEWDMZ" screen icmp-id
set zone "NEWDMZ" screen ip-spoofing drop-no-rpf-route
set interface "ethernet0/0" zone "Untrust"
set interface "ethernet0/1" zone "DMZ"
set interface "ethernet0/1.2" tag 11 zone "DMZ"
set interface "ethernet0/5" zone "Trust"
set interface "ethernet0/6" zone "NEWDMZ"
set interface "ethernet0/6.2" tag 14 zone "NEWDMZ"
set interface "bgroup1" zone "Trust"
set interface "tunnel.1" zone "Trust"
set interface bgroup0 port ethernet0/2
unset interface vlan1 ip
set interface ethernet0/0 ip x.x.x.x/21
set interface ethernet0/0 route
set interface ethernet0/1 ip 10.2.2.1/16
set interface ethernet0/1 nat
set interface ethernet0/1.2 ip 10.1.1.1/16
set interface ethernet0/1.2 nat
set interface ethernet0/5 ip 172.16.1.1/24
set interface ethernet0/5 nat
set interface ethernet0/6 ip 10.3.3.1/16
set interface ethernet0/6 route
set interface ethernet0/6.2 ip 10.4.4.1/16
set interface ethernet0/6.2 nat
set interface bgroup0 ip 192.168.0.1/24
set interface bgroup0 nat
set interface tunnel.1 ip unnumbered interface ethernet0/5
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/1 manage-ip 10.2.2.2
set interface ethernet0/1.2 manage-ip 10.1.1.2
set interface ethernet0/6 manage-ip 10.3.3.2
set interface ethernet0/6.2 manage-ip 10.4.4.2
unset interface ethernet0/0 ip manageable
unset interface ethernet0/1 ip manageable
set interface ethernet0/1.2 ip manageable
unset interface ethernet0/5 ip manageable
unset interface ethernet0/6 ip manageable
set interface ethernet0/6.2 ip manageable
set interface bgroup0 ip manageable
unset interface bgroup1 ip manageable
unset interface ethernet0/1 manage ping
unset interface ethernet0/5 manage ping
unset interface ethernet0/5 manage ssh
unset interface ethernet0/5 manage telnet
unset interface ethernet0/5 manage snmp
unset interface ethernet0/5 manage ssl
unset interface ethernet0/5 manage web
set interface ethernet0/6.2 manage ping
unset interface bgroup0 manage ssh
unset interface bgroup1 manage ping
unset interface bgroup1 manage ssh
unset interface bgroup1 manage telnet
unset interface bgroup1 manage snmp
unset interface bgroup1 manage ssl
unset interface bgroup1 manage web
set interface ethernet0/0 monitor track-ip ip
set interface ethernet0/0 monitor track-ip threshold 255
unset interface ethernet0/0 monitor track-ip dynamic
set interface ethernet0/0 vip untrust 2255 "FREENAS" 10.1.1.203
set interface ethernet0/0 vip untrust 443 "HTTPS" 10.1.1.200
set interface ethernet0/0 vip untrust 80 "MTS.NET" 10.1.1.208
set interface ethernet0/0 vip untrust 9445 "PBX" 10.4.4.202
set interface ethernet0/0 dhcp client enable
set interface bgroup1 dhcp client enable
unset interface ethernet0/0 dhcp client settings update-dhcpserver
unset interface bgroup1 dhcp client settings update-dhcpserver
set interface ethernet0/1.2 dhcp server service
set interface ethernet0/5 dhcp server service
set interface ethernet0/6.2 dhcp server service
set interface bgroup0 dhcp server service
set interface ethernet0/1.2 dhcp server enable
set interface ethernet0/5 dhcp server enable
set interface ethernet0/6.2 dhcp server enable
set interface bgroup0 dhcp server auto
set interface ethernet0/1.2 dhcp server option lease 60
set interface ethernet0/1.2 dhcp server option gateway 10.1.1.1
set interface ethernet0/1.2 dhcp server option netmask 255.255.0.0
set interface ethernet0/1.2 dhcp server option dns1 10.1.1.1
set interface ethernet0/1.2 dhcp server option dns2 8.8.8.8
set interface ethernet0/1.2 dhcp server option dns3 4.2.2.2
set interface ethernet0/5 dhcp server option lease 1440
set interface ethernet0/5 dhcp server option gateway 172.16.1.1
set interface ethernet0/5 dhcp server option netmask 255.255.255.0
set interface ethernet0/5 dhcp server option dns1 8.8.8.8
set interface ethernet0/6.2 dhcp server option lease 60
set interface ethernet0/6.2 dhcp server option gateway 10.4.4.1
set interface ethernet0/6.2 dhcp server option netmask 255.255.0.0
set interface ethernet0/6.2 dhcp server option dns1 8.8.8.8
set interface bgroup0 dhcp server option lease 1200
set interface bgroup0 dhcp server option gateway 192.168.0.1
set interface bgroup0 dhcp server option netmask 255.255.255.0
set interface bgroup0 dhcp server option dns1 65.32.1.65
set interface bgroup0 dhcp server option dns2 8.8.8.8
set interface bgroup0 dhcp server option dns3 4.2.2.2
set interface ethernet0/1.2 dhcp server ip 10.1.1.200 to 10.1.1.210
set interface ethernet0/5 dhcp server ip 172.16.1.2 to 172.16.1.4
set interface ethernet0/6.2 dhcp server ip 10.4.4.200 to 10.4.4.210
set interface bgroup0 dhcp server ip 192.168.0.2 to 192.168.0.15
set interface ethernet0/1.2 dhcp server config next-server-ip
unset interface ethernet0/5 dhcp server config next-server-ip
unset interface ethernet0/6.2 dhcp server config next-server-ip
unset interface bgroup0 dhcp server config next-server-ip
set interface "serial0/0" modem settings "USR" init "AT&F"
set interface "serial0/0" modem settings "USR" active
set interface "serial0/0" modem speed 115200
set interface "serial0/0" modem retry 3
set interface "serial0/0" modem interval 10
set interface "serial0/0" modem idle-time 10
set interface ethernet0/5 route-deny
set pak-poll p1queue pak-threshold 96
set pak-poll p2queue pak-threshold 32
set flow tcp-mss
unset flow no-tcp-seq-check
set flow tcp-syn-check
set hostname AMORX
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set dns host dns1 62.32.1.63 src-interface ethernet0/0
set dns host dns2 4.2.2.2 src-interface ethernet0/0
set dns host dns3 8.8.8.8 src-interface ethernet0/0
set dns host schedule 06:28 interval 4
set dns host name Freenas 10.1.1.203
set dns host name OTRS 10.1.1.200
set dns host name mtsnet 10.1.1.208
set dns host name pbx 10.4.4.202
set address "DMZ" "FNAS" 10.1.1.203 255.255.0.0
set address "DMZ" "MTSNET" 10.1.1.208 255.255.0.0
set address "DMZ" "OTRS" 10.1.1.200 255.255.0.0
set address "NEWDMZ" "PBX" 10.4.4.202 255.255.0.0 "PBX"
set user "jcufdfggdfasdfrtas" uid 2
set user "jcuafffrtsdfas" ike-id fqdn "jcuartas" share-limit 1
set user "jcffuaffffrtsdfas" type  ike
set user "jcufffaffrtsdfas" "enable"
set user "vpnclient_ph1id" uid 1
set user "vpnclient_ph1id" ike-id fqdn "amorx.mooo.com" share-limit 2
set user "vpnclient_ph1id" type  ike
set user "vpnclient_ph1id" "enable"
set ike gateway "Gateway for Any" dialup "jcjjjjjjjrtas" Aggr outgoing-interface "eth                                                                             ernet0/0" preshare "4cR1VScJNlR2UffffQs4NYCuHjjjjjj5MC4Fn9ig3E5g==" sec-level standard
set ike gateway "Gateway for Any" nat-traversal udp-checksum
set ike gateway "Gateway for Any" nat-traversal keepalive-frequency 5
set ike respond-bad-spi 1
unset ike ikeid-enumeration
unset ike dos-protection
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set vpn "VPN for Any" gateway "Gateway for Any" replay tunnel idletime 0 sec-lev                                                                             el standard
set vpn "VPN for Any" id 1 bind interface tunnel.1
set traffic-shaping dscp-class-selector
set url protocol websense
exit
set policy id 19 from "Untrust" to "Trust"  "Any" "Any" "TCP-ANY" permit log count
set policy id 19
exit
set policy id 18 from "Untrust" to "DMZ"  "Any" "VIP(ethernet0/0)" "FREENAS" nat   src dst ip 10.1.1.203 port 2255 permit log count
set policy id 18
exit
set policy id 17 from "Trust" to "NEWDMZ"  "Any" "PBX" "HTTP" nat src permit log       count
set policy id 17
exit
set policy id 16 from "Trust" to "DMZ"  "Any" "OTRS" "HTTPS" nat src permit log        count
set policy id 16
exit
set policy id 15 from "Trust" to "DMZ"  "Any" "MTSNET" "MTS.NET" nat src permit       log count
set policy id 15
exit
set policy id 14 from "Trust" to "DMZ"  "Any" "FNAS" "HTTP" nat src permit log c ount
set policy id 14 application "HTTP"
set policy id 14
exit
set policy id 13 from "Trust" to "DMZ"  "Any" "FNAS" "FREENAS" nat src permit log count
set policy id 13
exit
set policy id 1 from "Trust" to "Untrust"  "Any" "Any" "ANY" permit log traffic   priority 0
set policy id 1
exit
set policy id 11 from "DMZ" to "Untrust"  "Any" "Any" "ANY" nat src permit log
set policy id 11
exit
set policy id 12 from "NEWDMZ" to "Untrust"  "Any" "Any" "ANY" nat src permit lo  g
set policy id 12
exit
set firewall log-self
set nsmgmt bulkcli reboot-timeout 60
set ssh version v2
set config lock timeout 5
set ssl port 4434
set ntp server "0.0.0.0"
set ntp server backup1 "0.0.0.0"
set ntp server backup2 "0.0.0.0"
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset add-default-route
set route 10.1.1.1/32 interface ethernet0/6.2 gateway 10.1.1.1 preference 20 per manent tag 11
set route 192.168.0.100/24 vrouter "untrust-vr" preference 20 metric 1
set route 10.1.1.203/0 vrouter "untrust-vr" preference 20 metric 1
exit
set vrouter "VMVR"
exit
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit
set vrouter "VMVR"
exit

Hi,

 

Policy for the VIP (id 18) does not seem to right.
Can you try the following instead:

 

set policy Untrust to DMZ Any VIP(ethernet0/0) FREENAS nat   src permit

 

Thanks.

Hardeep

Please review and clean up your static routes. Note: the tag statement in a static route does NOT refer to a VLAN tag. Also, a route to a.d.b.d/0 is automatically a default route (the route gets installed as 0.0.0.0/0.

As far as access from outside is concerned, have you contacted your ISP? It is common for cable operators to block ports, unless you upgrade your account. And even then, they may still limit what passes through.

Nikolay ,

 

When all the servers were located in the trust zone (bggroup) the VIP`s were workng fine even port :80

but when i put a set of servers on sub IF 1.2 and the other set on sub IF 6.2 the VIP servers could not be contacted.

 

Unless my ISP blocked them during my setup change , then Im forced to think its my ssg5 , also because i cannot ping 10.1.1.X & 10.4.4.x networks from the FW CLI .

 

thanks fro the replies

I see. Well, that's good news then!

 

In that case, it's likely a policy / routing / interface / zone issue. See other thread(s).

Hi,

 

You can try the debug on the firewall to check whats happening.

 

 

- Hardeep

Sahota,

 

what would the command be for that?

 

thanks!

Hi,

 

I had mentioned it in my earlier post.

Here it is again:

 

A debug can be tried to look for the packet handling.

1. set ff dst-ip <vip-ip> dst-port <port-no>
2. undebug all
3. clear db
4. debug flow basic
5. initiate traffic to VIP
6. undebug all
7. get db st


Thanks.
Hardeep