Problem of PA-220 behind another router

[jeremylo]

Got a PA-220 to test.

Want to setup something like below:

Internet <-> Juniper SSG-140 (GW:192.168.1.1) <-> PA-220 <-> user's device (172.16.1.0/24)

1. The SSG-140 can reach internet

2. The PA-220 external port (192.168.1.100) can reach internet too

3. The PA-220 internal (172.16.1.0/24) cannot reach internet

4. The PA-220 internal (172.16.1.0/24) cannot ping the devices in 192.168.1.0/24

Anyone know what configuration can make the subnet 172.16.1.0/24 reach internet and the device in 192.168.1.0/24 ?

[reaper · Accepted solution]

You should either add a route on the SSG-140 to route 172.16.1.0/24 to 192.168.1.100, or you'll need to enable NAT on the PA-220

that will most likely solve your issue

[jeremylo]

Thanks reaper.

1 x NAT policy + 1 x Security policy did the trick