SSG5 Port forwarding issue



  • Hi,

    I set up a VIP service in my SSG5 but for some reason it’s not working.

    • I have one public IP address
    • Two VIP services: One for port 8111 and one 3000.
    • Both are using the same interface IP address

    Attached are my firewall configs

    unset key protection enable
    set clock timezone -5
    set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00
    set vrouter trust-vr sharable
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    unset auto-route-export
    exit
    set service "TeamCity" protocol tcp src-port 0-65535 dst-port 8111-8111 
    set service "ESP" protocol udp src-port 0-65535 dst-port 4500-4500 
    set service "ESP" + udp src-port 0-65535 dst-port 4242-4242 
    set service "Tracker" protocol tcp src-port 0-65535 dst-port 3000-3000 
    unset alg sip enable
    unset alg mgcp enable
    unset alg sccp enable
    unset alg sunrpc enable
    unset alg msrpc enable
    unset alg xing enable
    unset alg tftp enable
    unset alg talk enable
    unset alg sql enable
    unset alg rtsp enable
    unset alg rsh enable
    unset alg real enable
    unset alg appleichat enable
    unset alg appleichat re-assembly enable
    unset alg dns enable
    unset alg http enable
    unset alg h323 enable
    unset alg sctp enable
    set auth-server "Local" id 0
    set auth-server "Local" server-name "Local"
    set auth default auth server "Local"
    set auth radius accounting port 1646
    set admin name "netscreen"
    set admin user "hcadmin" role security
    set admin port 8443
    set admin access attempts 10
    set admin ssh port 8022
    set admin http redirect
    set admin auth web timeout 15
    set admin auth dial-in timeout 3
    set admin auth server "Local"
    set admin auth banner telnet login "Intent Media Firewall / Gateway"
    set admin auth banner console login "Intent Media Firewall / Gateway"
    set admin privilege read-write
    set admin format dos
    set zone "Trust" vrouter "trust-vr"
    set zone "Untrust" vrouter "trust-vr"
    set zone "DMZ" vrouter "trust-vr"
    set zone "VLAN" vrouter "trust-vr"
    set zone "Untrust-Tun" vrouter "trust-vr"
    set zone "Trust" tcp-rst 
    set zone "Untrust" block 
    unset zone "Untrust" tcp-rst 
    set zone "MGT" block 
    unset zone "V1-Trust" tcp-rst 
    unset zone "V1-Untrust" tcp-rst 
    set zone "DMZ" tcp-rst 
    unset zone "V1-DMZ" tcp-rst 
    unset zone "VLAN" tcp-rst 
    set zone "Untrust" screen tear-drop
    set zone "Untrust" screen syn-flood
    set zone "Untrust" screen ping-death
    set zone "Untrust" screen ip-filter-src
    set zone "Untrust" screen land
    set zone "V1-Untrust" screen tear-drop
    set zone "V1-Untrust" screen syn-flood
    set zone "V1-Untrust" screen ping-death
    set zone "V1-Untrust" screen ip-filter-src
    set zone "V1-Untrust" screen land
    set interface ethernet0/0 phy full 100mb
    set interface ethernet0/6 phy full 100mb
    set interface "ethernet0/0" zone "Untrust"
    set interface "ethernet0/1" zone "DMZ"
    set interface "bgroup0" zone "Trust"
    set interface bgroup0 port ethernet0/2
    set interface bgroup0 port ethernet0/3
    set interface bgroup0 port ethernet0/4
    set interface bgroup0 port ethernet0/5
    set interface bgroup0 port ethernet0/6
    unset interface vlan1 ip
    set interface ethernet0/0 ip 38.104.247.x/30
    set interface ethernet0/0 route
    set interface bgroup0 ip 192.168.0.1/21
    set interface bgroup0 nat
    set interface bgroup0 proxy dns
    unset interface vlan1 bypass-others-ipsec
    unset interface vlan1 bypass-non-ip
    set interface ethernet0/0 ip manageable
    set interface bgroup0 ip manageable
    set interface ethernet0/0 manage ping
    set interface ethernet0/0 manage ssh
    set interface ethernet0/0 manage telnet
    set interface ethernet0/0 manage ssl
    set interface ethernet0/0 manage web
    set interface ethernet0/0 vip interface-ip 8111 "TeamCity" 192.168.0.84
    set interface ethernet0/0 vip interface-ip 3000 "Tracker" 192.168.6.130
    set interface bgroup0 dhcp server service
    set interface bgroup0 dhcp server enable
    set interface bgroup0 dhcp server option lease 120 
    set interface bgroup0 dhcp server option domainname corp.intentmedia.com 
    set interface bgroup0 dhcp server option dns1 192.168.0.1 
    set interface bgroup0 dhcp server option custom 66 string "192.168.0.203"
    set interface bgroup0 dhcp server ip 192.168.0.2 to 192.168.0.255 
    set interface bgroup0 dhcp server config next-server-ip option66
    set interface "ethernet0/0" mip 38.125.35.xxx host 192.168.0.3 netmask 255.255.255.255 vr "trust-vr"
    set interface "serial0/0" modem settings "USR" init "AT&F"
    set interface "serial0/0" modem settings "USR" active
    set interface "serial0/0" modem speed 115200
    set interface "serial0/0" modem retry 3
    set interface "serial0/0" modem interval 10
    set interface "serial0/0" modem idle-time 10
    set flow tcp-mss
    unset flow no-tcp-seq-check
    set flow tcp-syn-check
    unset flow tcp-syn-bit-check
    set flow reverse-route clear-text prefer
    set flow reverse-route tunnel always
    set domain corp.intentmedia.com
    set hostname gw1
    set pki authority default scep mode "auto"
    set pki x509 default cert-path partial
    set dns host dns1 66.28.0.45
    set dns host dns2 66.28.0.61
    set dns host dns3 8.8.8.8
    set dns host schedule 06:28
    set dns host name nas1.corp.intentmedia.com 192.168.0.22 
    set dns host name voice.corp.intentmedia.com 192.168.0.203 
    set dns host name finance1.corp.intentmedia.com 192.168.0.26 
    set dns host name gw1.corp.intentmedia.com 192.168.0.1 
    set dns host name door.corp.intentmedia.com 192.168.0.201 
    set dns host name dell-790-1.corp.intentmedia.com 192.168.0.119 
    set dns host name dell-990-6.corp.intentmedia.com 192.168.0.163 
    set dns host name dell-990-8.corp.intentmedia.com 192.168.0.160 
    set dns host name dell-990-1.corp.intentmedia.com 192.168.0.161 
    set dns host name dell-990-7.corp.intentmedia.com 192.168.0.103 
    set dns host name dell-790-2.corp.intentmedia.com 192.168.0.109 
    set dns host name dell-990-4.corp.intentmedia.com 192.168.0.69 
    set dns host name dell-990-5.corp.intentmedia.com 192.168.0.49 
    set dns host name dell-990-2.corp.intentmedia.com 192.168.0.145 
    set dns host name dell-990-3.corp.intentmedia.com 192.168.0.131 
    set dns host name GArnold_iMac27.corp.intentmedia.com 192.168.0.73 
    set dns host name localhost.internal.intentmedia.net 127.0.0.1 
    set dns host name corp1.corp.intentmedia.com 192.168.0.92 
    set dns host name code.internal.intentmedia.net 192.168.0.84 
    set dns host name trackertracker.internal.intentmedia.net 192.168.6.130 
    set dns proxy
    set dns proxy enable
    set dns server-select domain * outgoing-interface ethernet0/0 primary-server 8.8.8.8 secondary-server 8.8.4.4
    set address "Trust" "192.168.2.0/24" 192.168.2.0 255.255.255.0
    set crypto-policy
    exit
    set ike respond-bad-spi 1
    set ike ikev2 ike-sa-soft-lifetime 60
    unset ike ikeid-enumeration
    unset ike dos-protection
    unset ipsec access-session enable
    set ipsec access-session maximum 5000
    set ipsec access-session upper-threshold 0
    set ipsec access-session lower-threshold 0
    set ipsec access-session dead-p2-sa-timeout 0
    unset ipsec access-session log-error
    unset ipsec access-session info-exch-connected
    unset ipsec access-session use-error-log
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    exit
    unset alg ftp enable
    set url protocol websense
    exit
    set policy id 5 name "teamcity" from "Untrust" to "Trust"  "Any" "VIP(ethernet0/0)" "TeamCity" permit log 
    set policy id 5
    set log session-init
    exit
    set policy id 1 name "default outbound" from "Trust" to "Untrust"  "Any" "Any" "ANY" permit log 
    set policy id 1
    set log session-init
    exit
    set policy id 4 name "VPN" from "Untrust" to "Trust"  "Any" "MIP(38.125.35.xxx)" "ESP" permit log 
    set policy id 4
    set service "HTTPS"
    set log session-init
    exit
    set policy id 6 name "Tracker" from "Untrust" to "Trust"  "Any" "VIP(ethernet0/0)" "Tracker" permit log 
    set policy id 6
    set log session-init
    exit
    set log module system level emergency destination console
    set log module system level alert destination console
    set log module system level critical destination console
    set log module system level error destination console
    set log module system level warning destination console
    set log module system level debugging destination console
    set nsmgmt bulkcli reboot-timeout 60
    set ssh version v2
    set ssh enable
    set config lock timeout 5
    unset license-key auto-update
    set telnet client enable
    set ntp server "0.pool.ntp.org"
    set ntp server backup1 "1.pool.ntp.org"
    set ntp server backup2 "2.pool.ntp.org"
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    unset add-default-route
    set route 0.0.0.0/0 interface ethernet0/0 gateway 38.104.247.x permanent description "default to cogent"
    exit
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    exit
    

    I can reach the VIP service for 8111 externally and locally but I can’t reach the VIP service for port 3000 externally.

    What am I doing wrong? Any suggestions or help would be appreciated.

    Thanks.


 

30
Online

38.4k
Users

12.7k
Topics

44.5k
Posts