In my example this now results in all interfaces being put in Untrust and the statically assigned interfaces has the highest preference. You can still use PBR policies to force some traffic the way you want and you even have automatic failover if an interface goes down (completely down, i.e. disconnected). On ScreenOS 5 there is a problem with VIPS on multiple Untrust interfaces.

Make sure your windows firewall is disabled as well for testing purposes. If that changes things than you can add rules in the windows firewall for the ports above.

I have the windows firewall just disabled as I trust my home network and NAT blocks any access to the PC from the Internet except for the ports you forward. But never do a full DMZ to a windows PC!

If not, then you have a problem.
1) You could put the interface back in trust-vr and find some way to make your statically set gateway a higher priority. I didn’t found out how to to do it, and someone on the juniper forum said you just can’t. But you never know.

2) If the above fails (likely) then the only option i see is to buy a cheap router or put your ADSL modem in router mode (if it can do that). Next you can choose, either give your router a LAN IP inside your current LAN-Trust subnet. In your PBR on trust-vr you then just set next-hop lan-ip-new-router.
Or create a new private subnet and connect that statically to your ISP2-vr and ISP2 zone set interface. Follow my example above to route traffic out trough the chosen interface.

On both these approaches the router will do NAT and you do not need to do it on the Netscreen for this traffic. In the last approach you will need policies allowing traffic from trust to ISP2, but this last approach will also allow bandwidth shaping, while intra-zone (Trust-Trust) traffic won’t. Another note is that the last approach makes sure users never put the router-lan-ip as std. gateway instead of the Netscreen.

Hope this helps !
Regards Stan

Thanks for this explanation, i have almost the same situation, but my problem is that the second ISP link is an ADSL PPoE which means you got the IP address from the ISP automatically, in that case i won’t be able to define the IP address of the gateway as i don’t know it and it is been changed every time you reset the line, do you have any idea how can i follow the same steps you added but use the Interface as a gate way instead of the IP?!!
Thanks.
Best Regards,
Yasser