Basic Netscreen Commands

Basic NETSCREEN Firewall Commands
If you are new to managing the Netscreen Firewall, then these commands will help you in managing the Netscreen Firewall from the Command Line Interface.

NETSCREEN
Note:Always remember to use the TAB when you are not sure the syntax of the command for a Netscreen Firewall. When you press TAB on your keyboard, it would give you what the next options are, and you can chose from the same. TAB is your best friend.

Step 1: define networks & network groups
***********************************************

Set address trust int-10.1.1.0_24 10.1.1.0/24

Set address untrust ext-192.168.15.15 192.168.15.15/32

Set group address untrust Remote

Set group address untrust Remote add ext-192.168.15.15

Step 2: define services & service groups
**********************************************

Set service tcp_445 protocol tcp src-port 1024-65535 dst-port 445-445 timeout 120
Set service tcp_3399 protocol tcp src-port 1024-65535 dst-port 3390-3390 timeout 120

Set group service outsrvgroup1

Set group service outsrvgroup1 add http

Set group service outsrvgroup1 add https

Step 3: Define policies
*************************

set policy from trust to untrust int-10.1.1.0_24 any outsrvgrp1 permit log count

Note: policies are applied from zone to zone.

Step 4: define NAT
**********************

NAPT is on by default.

Step 5: define one to one NAT (MIP)
*****************************************

Set interface untrust MIP 192.168.1.15 host 10.1.1.15 netmask 255.255.255.255

Set group service insrvgroup1

Set group service insrvgroup1 add http

Set group service insrvgroup1 add https

Set policy from untrust to trust any MIP(192.168.1.15) insrvgroup1 permit log count

Set policy move 59 before 4

(Move the new policy is before the default deny policy)

Step 6: define port forwarding (VIP)
*****************************************

Set interface untrust VIP 192.168.1.55 443 https 10.1.1.55

Set policy from untrust to trust any VIP::1 https permit log count

Step 6: define routes
************************

Set route 10.1.1.0/24 gateway 192.168.1.254