Juniper SSG5 And Public IPs
Dec 19, 2007
we have this Juniper SSG5 firewall, our very first Juniper and wanted to use it.
While I am able to use it in NAT mode, I have been unsuccessful to use it in route mode.
We have Public IPs from the same segment and I wanted to use it with the firewall but it appears that I can't assign IPs for each port if the IP is from the same segment.
Does it mean that we can't use it other than in NAT mode?
What we want to accomplish is to have one of IPs to act as gateway and filter or route in/out traffic to/from our other IPs.
View 0 Replies
ADVERTISEMENT
Oct 5, 2009
I need to protect about 80 servers from certain attacks some of them are being victim of. Altogether, these servers use about 200Mbps being almost all of them webservers. The last time, one of them was a victim of a DDoS attack which made all the rest get some packet loss (because this attack was consuming all the bandwidth we had available).
I was looking at Juniper solutions, however I get a bit confused with all the products they have to offer. First, I was looking at IDP series, but they seem a bit pricey and I believe I don´t need all those IDP functions those devices are capable of. NetScreen is also too expensive for me. I´m looking at a budget of 10.000$ aprox.
I found SRX series and after taking a look at SRX240 and SRX650 specs [url] those firewall numbers seem very nice and perfect for my problem. Would this be a wise choice? This device would act also as the main router for our racks. Please let me know if there are other recommendations that fit the specified budget (10K).
View 14 Replies
View Related
May 9, 2008
Can anyone give any real world numbers as to what each model of the Juniper-J series router is capable of? How much do these routers cost, and where is the best place to get them from?
View 14 Replies
View Related
Apr 17, 2008
Does anyone have any experience running Juniper SSG-550 firewalls in a high-traffic hosting environment?
I run network operations for a hosting provider in Australia. We currently have two J4350s running as border routers, and we are looking at putting two Juniper SSG-550s behind the border routers to do stateful firewalling / NAT.
We'll be using active/active NSRP on the SSGs for load balancing and failover.
My concern is that these devices may not be able to handle our traffic load. They have a hard-set limit of 256,000 "concurrent sessions" which may not be enough for us in peak times. Almost all of our traffic is HTTP though, so I would imagine sessions would timeout quite quickly?
View 5 Replies
View Related
Dec 26, 2007
In one of our racks, we now just have two Procurve (J4900B) switches, and run software firewalls on our CentOS servers. We are now looking towards a hardware firewall to ease managment and reduce load on our servers.
One of our suppliers reccomends the SSG140 from Juniper, and it seems to cover our needs. The SSG320 however seems to have more features, like layer3 routing. Could this device replace our Procurve switches, and act as a firewall/switch?
Anyone familiar with these devices and have some input on what to choose? How does the anti-ddos and bruteforce attack functions work out, do they hold up? Anyone tested the Deep Inpspection Signature module? Is it worth having for a ISP/Webhost?
View 6 Replies
View Related
Nov 10, 2007
any experience and feedback on Juniper J-series routers?
View 4 Replies
View Related
Oct 11, 2009
I've been reading and searching on here as much as I can to try to help me in making a decision, unfortunately when I think I know what to do, I read something else and get confused again.
We are in the process of moving networks within our datacenter and will have 2 drops coming into our half-cabinet. We have about 7 servers in there, some for our own use and some for clients. In all cases, we manage the servers and are the only ones with root access (no need for VLANs for the purpose of protecting IPs etc).
We currently have a single drop and use an HP procurve 2524 layer2 switch that has been in there for over 6 years and never had a single hiccup. We also don't push much traffic at all though. Under 5mbps combined.
My question though is this: moving to the new network we will have 2 drops that are set up as HSRP on their end (upstream of me, I don't have to worry about having two switches). In order to use the dual feeds, we will need a Layer3 switch. One feed will be active, the other is not, both are connected to the switch via a VLAN and provide a gateway for VLAN2 to use. I have never used a layer3 switch, though I'm not *too* concerned since I don't expect we'll be doing anything too complex. My understanding is that one VLAN (VLAN1) will be set up with an IP address assigned to each drop and that VLAN1 will create a gateway for VLAN2. The second VLAN (VLAN2) will be all our "inside" client IPs that will then route through VLAN1.
I was briefly checking out the cisco 3750, but I think it's overkill...? I don't want to spend too much money, since I don't think we need any complex setups, at the same time, I don't want to waste money by buying something that won't work efficiently down the road.
My immediate short-list is now an HP procurve 2610, an HP procurve 3500 J9470A (not the YL), and a Cisco 3560 24-TS.
Of course, then someone mentioned Juniper (whom I have zero experience with either) and hence the title to my thread... I'm thoroughly confused. I was looking at the EX3200-24T.
Ok, so if I have to boil this down to some simple requirements/thoughts... here goes:
1. I only need 24 ports for now.
2. I use SNMP currently to monitor usage for clients (and overall)
3. I like HPs and have used them for layer2, I like their lifetime warranty and software availability
4. I don't have direct experience with Cisco at all.
5. Aside from routing from one VLAN (provider side) to another VLAN (my side), I don't think I need any other special features (hence the hp 2610 being ok I think, since it offers "lite layer3")
6. Some people say HP is great for layer2 but not for layer3? Now I dont' know what to think.
7. Currently use about 2mbps and might jump to 3 or 4mbps, but don't have major needs. I'd like for this switch to be able to last me a while though... so maybe 20~40mbps+? (but still not the hundreds of mbps that others here push
8. If possible, I'd LIKE to limit some servers to 1mbps or 2mbps on a per-port basis... but this is not a hard requirement. (I think this takes the 2610 out).
Budget: I like the $500 price tag of the 2610, but can spend the $1500~$2000 for the HP 3500, Cisco 3560, or Juniper. I would just rather not, if the price/features are not justifiable.
Hopefully I've provided enough information for someone to offer their insight? I think a few strategic key points or questions from someone with more experience might be what I need to help me bust through the "too many choices" fog and end up with the best switch for my situation...
View 14 Replies
View Related
Nov 10, 2007
I am tried of not finding a good documentation on now to configure netscreen-25 firewall.
This is the current setup;
Ethernet Drop -> Netscreen (connected via straight RJ-45)
NetScreen -> Switch (Connected via cross-over cable)
This is the what I want to be able to do...
I am assigned a 76.36.57.32/27 subnet
Netmask 255.255.255.224
Gateway 76.36.57.33
1) Make Netscreen accessible via IP 76.36.57.34 for remote management.
2) I dont want netscreen to assign IPs for my wired devices because I've already set all their IPs and those are the ones I want to use.
Now, I did read the manual [url] and went to Network -> Interfaces -> Ethernet 1 Trust *edit* and in the "IP address" box I typed 76.36.57.34 and netmask "/27".
In the "Manage IP" box, I typed 76.36.57.39/27 according to the manual.
After doing all that, I cant access any of my "wired" devices behind firewall and neither can I access the firewall itself with the IP I assigned.
View 6 Replies
View Related
May 3, 2009
We are searching a firewall for our small colocation.
We have chosen the Juniper SSG 520/550 or a Cisco ASA 5520 (eventually the 5540).
We want primaly filter ddos attacks on our webservers (bot-network, attacking a domain, port 80) and syn flood attacks (port 80).
Do you have real experience with the Juniper or Cisco devices?
Can we integrate such device in the fellowing network design:
(where to put the firewall ?)
- Uplink 1gbit datacenter -> our HP Procurve gigabit switch
- HP Procurve switch -> Servers
We are using /30 as eth0 "bridged", and /29 /28 /27 "routed" over eth0.
I would prefer a "live analysis" of our traffic. Is that possible?
View 12 Replies
View Related
Oct 23, 2007
I've been looking at these two Firewalls for a quite some time and I am not sure which one I should go with. Price is not a factor since both are around the same price range.
The firewall is going to be in between my DROP and LAYER3 Switch.
So...FastE -> Firewall -> Layer3
As you can see, I dont want any fancy VLAN stuff or anything like that since my switch can take care of all that. I just want a firewall which is easy to configure and manage and has DDoS protection built-in.
If you have any other hardware based firewalls in the price range of ASA 5505 and Netscreen 5GT then I would want to hear about those as well.
View 14 Replies
View Related
Nov 25, 2008
I have a SSG-320M I manage, and would like to know if I can block traffic to our web servers based on the user agent hitting us? I know user agents that keep using more and more IP addresses to crawl us, one already taking up some 30 or 40 addresses under my policies and its a pain to identify these by hand and keep updating the firewall every few days to add new IP addresses for them. Is there somewhere I can add part of the user agent I do not want to ever see again? Right now I do this by having a policy at the top saying "BadBotsGroup" is denied. But I want to deny anyone with a user agent "OneUserAgent" or "SecondUserAgent"
It seems so important and simple, but I do not see anything about being able to do this. Thanks for help and pointers. Right now we have special code at the top of our sites that blocks these bots, but I would much rather do it in one location at the firewall.
View 3 Replies
View Related
Aug 23, 2009
Looking to upgrade to a new switch and have the following in mind. Budget is around 1-2k. We're pushing 500mbps upstream so i want to make sure that the unit can handle that well. Lots of full speed traffic between servers too.
No fancy features required, and the only need is port trunking, which all of these have.
I look at the specs for latency and pps, but I'm not sure if you can trust these figures.
Anyone have experience with the following.
HP Procurve 2910al-24
$1430
latency <2.9us
131 Mpps
176 Gbps
Bonus: 10Gb capability with expansion module
Extreme Networks Summit x350
$1300
latency < ?
65 Mpps
88 Gbps
Bonus: 10Gb capability with expansion module
Juniper Juniper EX3200-24T
$1800
latency < ?
65 Mpps
88Gbps
Bonus: 10Gb capability with expansion module
Bonus: 8 ports are POE
Netgear GS724AT
$350
latency <3us
??? Mpps
48Gbps
View 9 Replies
View Related
Nov 5, 2007
to build a new 10GE network and have received offers from Juniper and Cisco distributors.
Juniper seems to be a bit more expensive. It was our first choice at the beginning untill we saw many big ISP's using cisco 6509 with SUP720-3BXL for routing.
Is there anyone with experience on both products? How about support for both of these?
View 14 Replies
View Related
Jan 23, 2008
I heard the other day from a very reliable source that this is a fact and they expect it to happen sooner rather than later. Since they seem to set the bar anyway seems it was only a matter of time. Anyone else aware of this or am I the only one? Searched the forum before I posted and nothing came up. Seems like a significant development to me...
View 14 Replies
View Related
Jan 21, 2008
Im planning on using WAMPserver2 on our web server to host our website. Now, as far as I can tell, WAMPserver2 was mostly created to allow you to do work locally. Is there any known problem with using this software on a web server publically?
View 3 Replies
View Related
Aug 6, 2008
You are hosting your web site on a local server and you have the DNS pointing to the LOCAL (read: not public) IP on your LAN which means only you and those on your LOCAL network can access the site.
192.168.1.8 is a LOCAL (PRIVATE) IP.
View 1 Replies
View Related
Nov 4, 2007
I'm on a reseller cPanel WHM account with shell access, and this public FTP for uploading maps for a game.
How do I ban FTP users by their IP? (.htaccess wouldn't do the trick)
How do I regulate priviledges/permissions of FTP users?
How do I control (like configuring how the indexing is displayed, for example) /public_html/somedirectory/ through /public_html/.htaccess?
How do I disallow certain filetypes from existing in /public_html/somedirectory/* or to be uploaded?
How do I disallow apache from rendering any html, php, cgi, java, perl, etc files in /public_html/somedirectory/*?
So, if you had a public FTP (not the "anonymous FTP" cPanel can create, but a regular and single user account shared by everyone), how would you protect your free map hosting service from abuse? What protections would you setup? Etc.
View 2 Replies
View Related
Aug 8, 2008
we are looking for a provider that provides public ip vlans' with dedicated server purchases,
so far,,
we have found few companies that offer this at no extra charge or minimal extra charge
1) softlayer (best choice)
2) singlehop
3) nocster/burst.net (not a good provider for business hosting / not reliable / no phone support)
does anyone know of any other dedicated server providers that offer public ip vlans for no extra charge or minimal extra charge?
View 0 Replies
View Related
Feb 21, 2008
When I try to login SSH using SecureCRT Software, following error it show.
A public key file has not been specified for the session. would you like to specify one now.
I am using CPanel.
View 1 Replies
View Related
Jan 24, 2007
we have a server with customers
now there are any customer that must can 'include' form php a class that we must put out of customer path...
a customer must can include a class that is out of /home/public_html/customerlogin/*
how is possible to make this?
View 0 Replies
View Related
May 1, 2007
Due to an emergency with our colo space, we are missing a switch.
As a very temporary measure, would it be possible to put both our public traffic and private traffic (10.0.0.0/8) on the same switch without a VLAN?
Essentially we'd be connecting both the trusted and external side of our (natting) firewall to the same switch, along with our servers (which have private IP's).
What are the security risks of this?
View 4 Replies
View Related
Oct 19, 2014
I am looking to migrate from dedicated box with windows server 2012 R2 and plesk 12 over to amazon ec2.
so setup a test server on ec2.
Plesk only shows the private IP, how do I add the public IP ?
Is it even possible ?
View 2 Replies
View Related
Jun 18, 2008
I regret to bring this to a public forum but having seen that solarvps has a presence here I am hoping that a resolve to this issue can be found, and any public opinions are welcomed.
Having been a customer with solarvps since 2006 without any cause for concerns it does not make me happy with some recent issues I have had with them. So I have had a vps server hosted with them since 2006. Sometime in February when attempting to login to my VPS I got an error, I left it as this happens sometimes, it happened for 4 days in a row so I thought this is a little strange logged in to my control panel, to see no VPS server was listed under the account. There was no invoice generated either. Ok this is strange but I just assumed it had been terminated, no invoice came through and that particular server was a backup server so I sought hosting elsewhere.
4 months pass I get an email from solarvps stating my account is overdue with charges applied. I contact them back straight away asking what they are billing me for I have explained the situation time and again to them, I have asked the questions why the server disappeared from my account, why I wasn’t able to access the vps remotely and why no invoices got generated at the time to which I have had no response, I have asked more than 5 times now. The only response I keep getting form them is threats if I do not pay to hand over to a collection agency and the possibility of legal action. To which I have replied each time that I will contest any such action and seek legal advice myself.
Granted I should probably have contacted them at the time but really they are at fault more than I am for not asking them what has happened, I truly believe I am not in the wrong here but nobody within solarvps is prepared is looking at the facts of what has happened here.
Well anyway I hope bringing this to a public forum will bring a resolve and maybe some answers. I am getting no response from anybody within solarvps and would be happy to take this away from the public if they are willing.
I am not unfair nor does it make sense that a customer for so long would just decide not to pay you one month and kick up a fuss over such a small amount of money but the fact that I am not in the wrong with this matter, I am not prepared to pay them no matter how much bullying tactics they wish to adopt in trying to make me.
View 14 Replies
View Related
May 19, 2009
I would like to know there is any.
View 14 Replies
View Related
May 10, 2007
Currently we are running a very successful site for extreme sports. We have just spent 6 months on development of our new site which we will launch in a fortnight. This will free up some of my time to look at other areas and avenues to attract members.
Personally I would love to run a hotmail style service on our website, and believe this would help with the growth of our online community.
Just interested in advice from others on areas to be aware and alert when running a service like this?
I am also trying to make the decision between SocketMail or Atmail. If anyone has opinions on these, or an alternative solution i'm all for that advice too.
Basically at this point I am wanting to get as much advice together as possible, then look to making an informed decision to go ahead or not.
Currently we operate off a dedicated server and i realise this may have to become two servers in the near future with such a service. It is fully managed by myself, and a 3rd party individual I hire to maintain the server on a monthly basis.
View 2 Replies
View Related
Mar 12, 2007
How do you guys deny run of perl/bash scripts from /tmp, /var/tmp, /dev/shm? I've tried to build simple shell wrapper, but that's not a compromise if you run for example spamassassin on the same server (it needs direct io to/from perl binary). I'm looking intro some kind of binary wrapper or patch that will deny running perl scripts from public folders (also the same for shell scripts will be great). Any ideas or solutions?
If anyone interested in primitive shell wrapper code:
Code:
#!/bin/sh
ARGS=`echo $@ | grep -v "/tmp/"`
if [ "$ARGS" != "" ]; then
/usr/bin/perl.orig $ARGS;
fi
View 4 Replies
View Related
Aug 8, 2007
I often need to access my sites from public places, which are behind firewalls, don't have access to hard disk and any Windows tool (just plain internet access).
Problem: firewall, closed ports: 8082 (cPanel), 2078 (SSL; I don't know, if I'll need this), 2077 and maybe others.
Which hosting features I need? to be able to
1. access cpanel, when port 8082 is closed (I was using cpanelproxy.net until now with success).
2. for uploading files from other websites directly to my website (without prior downloading on a PC hard disc) - I've herad SSH should work, but what exact SSH I need - any experience someone? Any other solution? I was trying WEb Disc feature in cPanel11 but it needs port 2078 or 2077 open...
View 3 Replies
View Related
Aug 15, 2007
I was worry about which is more seucre to login to the server
disabling the direct login and using the public key (ssh-dss) with 2084 bit length ?
or use the direct login?
and if the public key is more secure , should we use passphrase when generating the key? or no?
View 11 Replies
View Related
Apr 25, 2009
I work alot on the road and need a way to securely connect
at public WiFi hotspots all over.....
I am considering getting the VPN service from StrongVPN.com
View 14 Replies
View Related
Jul 7, 2009
if it is possible to setup a page like this with their public reports feature?
[url]
I tried looking for Pingdom forums, but they seem to be offline.
View 1 Replies
View Related