Bluetrait (Program)
                IBM N2200 8363

Sat, 23 Dec 2006 10:38 PM

Setting up the Secondary IP option on a netscreen with a PPPoE connection.

Michael Dale
The following howto will show you how to setup an extra subnet connected to a Netscreen.

Background Info:
  1. Static IP address ( on ethernet3
  2. /30 Subnet (
  3. Internal Network on ethernet1
  4. Netscreen 5GT running ScreenOS 5.4.0r2 in Dual Untrust mode
  5. PPPoE connection
  6. Router address on
Adding an extra subnet gives us the option to run servers on separate IP addresses and bypass the Netscreen's limitation of range port forwarding.

Now what I've done for our connection is attach the extra subnet to our trust interface, the plan being that both the internal network ( and the new subnet ( can talk to each other.

Another issue is that that the network needs to have a nat'ed connection, while the new subnet needs to be routed. All this is possible on the same interface with a few policy changes.

So Lets start. Please note that process will break your internet connection until all steps have been done.

1) Make sure that your external WAN interface is set to Route mode. This will break your current nat until we fix the policies.
This option can be found in:
Network > Interfaces > ethernet3 (name may be different) -> Edit
WAN Route Mode

2) Now go to your internal LAN interface and check that it too is in route mode and that "Block Intra-Subnet Traffic" is off (allowing the internal interface to pass traffic back out the same interface (i.e. ->
Network > Interfaces > ethernet1 (name may be different) -> Edit
LAN Route Mode

3) Add your Subnet on the internal interface
Network > Interfaces > ethernet1 (name may be different) -> Edit -> Secondary IP
Adding Second Subnet

4) Now we'll setup a policy so that any traffic from gets nat'ed out of our static IP address
Policies -> From Trust to Untrust. The source address will be your internal network, destination address will be ANY and so will the service. Nat Policy

5) Click advanced and check "Source Translation", then click okay.
Source Translation

6) Now we'll setup a policy so that our new subnet can talk to the world.
In Policies -> From Trust to Untrust create a basic subnet any rule (of course you can restrict things if you'd like). You don't need "Source Translation" on this one.
Subnet to ANY

7) Now to create a rule to allow traffic in to our new subnet
In Policies -> From Untrust to Trust create a basic any subnet rule (of course you can restrict things if you'd like). You don't need "Source Translation" on this one.
ANY to subnet

8) The last step is to allow traffic from the new subnet to talk to the internal network (this is an optional step).
In Policies -> From Trust to Trust. Source address being your new subnet and destination address is your local network.
Subnet to LOCAL network

Somethings I've noticed with this setup.
  1. You can still use VIPs on your main static ip address (, so that gives you another IP to play with.
  2. The internal netscreen interface works on the network address for the /30 (i.e. giving us two ip addresses that we can use for servers instead of just one.



HTML allowed: <a href="" title="" rel=""></a> <b></b> <blockquote cite=""></blockquote> <em></em> <i></i> <strike></strike> <strong></strong> <li></li> <ol></ol> <ul></ul>
ie: <b>bold</b>

Your comment may need to be reviewed before it is published.



Email (not shown)

WWW (optional)

Allow contact form email

Remember details