Description

How Do I Create a Rule With a Mapped IP (MIP) in NSM?  Refer to KB10953 [juniper.net] if NSM is version 2007.3r1.

Symptoms


Solution

To create a rule using a MIP in NSM 2004, perform the steps below:

NOTE:  If the NSM version is 2007.3r1, then refer to this article instead:  KB10953 - How Do I Create a Rule With a MIP in NSM 2007.3r1 [juniper.net]



alt Connect to NetScreen Security Manager. For more information, go to Connecting to the NetScreen Security Manager [juniper.net] .

alt From the Device Manager , click to select FW/VPN Devices .

Image of step two and three

alt Right-click the device, and select Edit .

alt Expand Network , and then click Interface .

Image of step four and five

alt Right-click untrust (or the interface bound to the untrust interface where the VIP will reside), and click Edit .

alt To add the MIP to the device, expand NAT , and then click to select MIP .

Image of step six and seven

alt Under MIP , click + .

alt From the MIP window, configure using the following settings:

  • Mapped IP : 1.1.1.1
  • Netmask : 32
  • Host IP : 172.16.75.55
  • Host Virtual Router Name : trust-vr

Image of step eight and nine

alt Click OK .

alt From the Interface window, click OK .

Image of step ten


alt From the Device window, click OK .

Image of step eleven


alt Expand Object Manager , expand NAT Objects , and then click Global MIP .

Image of step twelve


alt Under Global MIP , click + .

Image of step thirteen


alt From the New Global MIP text box, enter Web Server .

Image of step fourteen and fifteen

alt Click + .

alt From the HardSecClient - MIP window, configure the following settings:

  • Device : HardSecClient
  • Interface : untrust
  • mip : 1.1.1.1

Image of step sixteen and seventeen

alt Click OK .

alt From the New Global MIP window, click OK .

Image of step eightteen


alt Expand Policy Manager , and then click HSClient_1 .

Image of step nineteen


alt In the From Zone drop down list, select untrust , and in the To Zone drop down list, select trust .

Image of step twenty and twenty-one

alt Click + , and then click Add Rule .

alt In the new rule, under Destination , right-click any , and then click Add Address .

Image of step twenty-two


alt From the Select Destination Addresses window, expand globalmip , and then click to select Web Server .

Image of step twenty-three and twenty-four

alt Click OK .

alt From Action , right-click deny , and then click Permit .

Image of step twenty-five


alt From Device Manager, click FW/VPN Devices .

Image of step twenty-six and twenty-seven


alt Right-click HardSecClient , and then click Update Device .

alt From the Save Changes window, click Yes .

Image of step twenty-eight

Former Article Id

ns10379