O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

2.3. Use the Dedicated MGT Interface to Manage the Firewall

Problem

The firewall must be connected to a dedicated sideband, or out-of-band management network, via the onboard management interface (applicable only to platforms with a dedicated MGT port).

Solution

Configure all user traffic security zones to be in the untrust-vr:

	isg1000-> set zone trust vr untrust-vr
	isg1000->set zone untrust vr untrust-vr

Configure IP addressing on the interfaces:

	isg1000-> set interface e1/1 route
	isg1000-> set interface e1/1 zone trust
	isg1000-> set interface e1/1 ip 10.251.7.99/29
	isg1000-> set interface e1/2 zone untrust
	isg1000-> set interface e1/2 ip 10.10.10.254/24
	isg1000->set interface mgt ip 10.20.20.1/28

Configure routing in the trust-vr for the MGT interface:

	isg1000-> set vr trust route 0.0.0.0/0 interface mgt gateway
	   10.20.20.14

Configure routing in the untrust-vr for user traffic:

	isg1000-> set vr untrust route 0.0.0.0/0 interface e1/2 gateway
	   64.2.31.249
	isg1000->set vr untrust route 10.100.0.0/16 interface e3 gateway
	   10.100.1.1

Discussion

The issue at hand is how to configure the firewall to use the onboard MGT interface connected to a dedicated sideband or out-of-band management network. Another way to solve this problem is to ensure that every management host that the firewall will ever need to communicate with is on the same local IP network subnet as the MGT interface IP. If this is the case, and no routes need to be added, specific or default, for the MGT interface to communicate with ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required