I have devices connected to a DMZ which has a subnet that was carved out of a /28 public static IP block with a /29 subnet. I created a static nat with proxy arp and corresponding policies to pass traffic between zones. When reviewing the DMZ interface i can see input and output packets traversing the DMZ interface. I was also able to see transactions on some of the rules applied to the static nat.
I still was not able to telnet any ports on the Public IP addresses that associate with this configuration from an external source. The untrusted interface when setting up a firewall filter didn't show any packets traversing its interface when attempting these connections from an external source. I also didn't see any activity from the outside showing up in the session flow.
DMZ Interface:
1 of static NAT Rules showing translation hits:
Untrust (fe-0/0/0.0) and DMZ (fe-0/0/1.0) Interfaces:
interfaces {
fe-0/0/0 {
unit 0 {
family inet {
filter {
input icmp-filter2;
}
address X.X.X.217/29;
}
}
}
fe-0/0/1 {
unit 0 {
family inet {
address X.X.X.209/29;
}
}
}
Global Address Book:
security {
address-book {
global {
address SFB_Edge_Access X.X.X.210/32;
address SFB_WebConf X.X.X.211/32;
address SFB_AV X.X.X.212/32;
address Intelepeer_Med X.X.X.213/32;
address LAN2 192.168.23.0/24;
address LAN 192.168.69.0/24;
address RP 10.1.15.12/32;
address EXCH 192.168.23.7/32;
Static NAT:
static {
rule-set static-nat-untrust {
from interface fe-0/0/0.0;
rule rule-1 {
match {
destination-address X.X.X.210/32;
}
then {
static-nat {
prefix {
X.X.X.210/32;
}
}
}
}
rule rule-2 {
match {
destination-address X.X.X.211/32;
}
then {
static-nat {
prefix {
X.X.X.211/32;
}
}
}
}
rule rule-3 {
match {
destination-address X.X.X.212/32;
}
then {
static-nat {
prefix {
X.X.X.212/32;
}
}
}
}
rule rule-4 {
match {
destination-address X.X.X.213/32;
}
then {
static-nat {
prefix {
X.X.X.213/32;
}
}
}
}
rule rule-6 {
match {
destination-address X.X.X.219/32;
}
then {
static-nat {
prefix {
10.1.15.12/32;
}
}
}
}
rule rule-5 {
match {
destination-address X.X.X.218/32;
}
then {
static-nat {
prefix {
192.168.23.7/32;
}
}
}
}
}
}
proxy-arp {
interface fe-0/0/0.0 {
address {
X.X.X.210/32 to X.X.X.214/32;
}
}
}
}
Policies:
from-zone Public-DMZ to-zone untrust {
policy 3 {
match {
source-address [ SFB_Edge_Access SFB_WebConf SFB_AV Intelepeer_Med ];
destination-address any;
application any;
}
then {
permit;
log {
session-init;
}
}
}
}
from-zone untrust to-zone Public-DMZ {
policy 4 {
match {
source-address any;
destination-address [ SFB_Edge_Access SFB_WebConf SFB_AV Intelepeer_Med ];
application any;
}
then {
permit;
log {
session-init;
}
}
}
}
Zones:
security-zone untrust {
screen untrust-screen;
interfaces {
fe-0/0/0.0;
}
}
security-zone Public-DMZ {
interfaces {
fe-0/0/1.0 {
host-inbound-traffic {
system-services {
ping;
}
}
}
}
}
If it helps to send the config, please let me know and i can send the entire config.