Using a DIP Pool
Using a DIP Pool
Solution:
This article applies to ScreenOS 5.0 and higher. A Dynamic IP (DIP) pool is a range of IP addresses which the NetScreen device can use when performing network address translation (NAT). There are three kinds of interfaces that you can link to, Dynamic IP (DIP) pools, physical interfaces and sub interfaces for network and VPN traffic, and tunnel interfaces for VPN tunnels only.
DIP pools can be used in the following applications:
- Many-to-many address translations. This can be used in VPN networks where connected sites have overlapping IP subnets. To allow them to be connected without IP address conflicts, IP addresses need to be translated either before the traffic is sent into the VPN tunnel or after it is decrypted at the other gateway. DIPs are used in either case to translate one subnet to another to allow overlapping networks to communicate.
- One-to-many address translations. This is often used when policy-based NAT is utilized. Policy-based NAT only translates traffic that meets the policy, allowing other traffic to be routed through the firewall. This allows for mixed networks of public and private IP addresses. This DIP application is very similar to NAT, except that it is done on a policy basis instead of by interface.
To configure a DIP pool on your NetScreen, perform the following steps:
Open the WebUI. For more information on accessing the WebUI, select your product from the list below:
From the NetScreen options menu, click Network, and then click Interfaces.
From the Interface screen, choose the interface you would like to modify, and click Edit. For this example, we chose to edit the ethernet3 interface.
From the Interface screen, click to select DIP.
Click New.
Enter an ID. For this example, we have used an ID of 5.
From IP Address Range, enter a Start and an End IP address. The Start and End IP addresses will need to be in the same subnet as the interface you are editing. For this example, we have used a Start IP address of 10.20.1.50, and an End IP address of 10.20.1.100.
Click to select Port Translation.
Click OK. Troubleshooting
