1

Given a ScreenOS 6.3.0 firewall with this configuration:

unset flow reverse-route clear-text
set interface "ethernet0/0" zone "Trust" 
set interface ethernet0/0 ip 192.168.1.1/24 
set interface ethernet0/2 ip 10.0.0.1/24 
set interface ethernet0/2 mip 10.9.9.10 host 192.168.1.10 netmask 255.255.255.255 vr trust-vr
set interface ethernet0/2 mip 10.8.8.10 host 192.168.1.10 netmask 255.255.255.255 vr trust-vr
set route 0.0.0.0/0 interface ethernet0/2 gateway 10.0.0.254

... (and assuming appropriate policies) is there a way to control which MIP the firewall selects for outbound connections initiated by 192.168.1.10? (presumably because I want the upstream 10.0.0.254 to do different things with the packet depending on what its source IP is).

Update: OK, my scenario is this: I have two ISP uplinks, each giving me a different IP space. Each ISP will only route the IP space they have assigned me.

So in order for the server to be reachable by both ISPs, I need two MIPs for the same server, one on each interface. Inbound traffic will work fine with the 'unset flow reverse-route clear-text' option in use.

But for outbound (think an email server sending a message) I need a way to select an appropriate MIP depending on which outbound link I want the system to use, and I want this to be resiliant so that if the link the firewall prefers goes down overnight I don't have to manually flip something to keep the mail flowing.

Basically I'm trying to avoid having to buy a link-balancer appliance (or two since I'll need a cluster).

Is there a way to do this?

David Mackintosh
  • 14,223
  • 6
  • 46
  • 77

1 Answers1

1

Assuming you want to have active control over both outbound links at the same time (ie system A uses IP A and goes out uplink A, System B uses IP B and goes out uplink B) the answer is no, you can't. You need a link balancer.

If you don't care which link outbound traffic uses, you can set up two MIPs (one for each ISP link) and set ip-tracking routes and the firewall will pick the "best" one (ie it will use one and then stop using it when it fails). You can bias the selection with route ordering and metrics.

But the bottom line is that to have control, you need a link balancer.

If you have support, call the JTAC.

David Mackintosh
  • 14,223
  • 6
  • 46
  • 77