SRX防火墙简单配置命令

《SRX防火墙简单配置命令》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、目录1基本操作11.1恢复出厂配置11.2删除SRX默认配置21.3保存冗余配置21.4服务21.5设置设备名21.5配置本地超级用户21.6配置时间21.7设备重启/关闭31.8安全域zone配置31.9分配接口到相应安全域zone31.10允许trustzone接受telnet/ssh管理流量31.11允许trustzone接受ospf/bgp路由信令31.12定义Screen的ips-options模板test31.13在zone上引用Screen的ips-options模板test32地址映射42.1NAT42.2VIP42.3MIP43Troubleshooting53.1抓包53

2、.2端口镜像51基本操作1.1恢复出厂配置loadfactory-defaultsetsystemroot-authenticationplain-text-passwordcommitrequestsystemreboot1.1删除SRX默认配置root#deleteThiswilldeletetheentireconfigurationDeleteeverythingunderthislevel?[yes,no](no)y1.2保存冗余配置requestsystemconfigurationrescuesave1.3服务setsystemservicestelnetsetsystemse

3、rvicesweb-managementhttpsetsystemservicesweb-managementsessionsession-limit3/*/限制同时HTTP方式登录同时会话数为31.4设置设备名setsystemhost-nameSRX650011.11.21.31.41.5配置本地超级用户setsystemloginuserlabclasssuper-usersetsystemloginuserlabauthenticationplain-text-password22.12.22.32.42.52.6配置时间setsystemtime-zoneAsia/Chongqin

4、grunsetdate201103141721.00/*/设置设备时间为2011-03-1417点21分00秒setsystemntpboot-server202.192.67.191setsystemntpserver202.192.67.191prefer/*/设置NTP服务，指定服务器IP为202.192.67.1911.1设备重启/关闭requestsystemrebootrequestsystempower-off1.2安全域zone配置setsecurityzonessecurity-zonetrustsetsecurityzonessecurity-zoneuntrust1.3

5、分配接口到相应安全域zonesetsecurityzonessecurity-zonetrustinterfacesge-0/0/0.0setsecurityzonessecurity-zoneuntrustinterfacesge-0/0/1.01.4允许trustzone接受telnet/ssh管理流量setsecurityzonessecurity-zonetrusthost-inbound-trafficsystem-servicessshsetsecurityzonessecurity-zonetrusthost-inbound-trafficsystem-servicesteln

6、et1.5允许trustzone接受ospf/bgp路由信令setsecurityzonessecurity-zonetrusthost-inbound-trafficprotocolsospfsetsecurityzonessecurity-zonetrusthost-inbound-trafficprotocolsbgp1.6定义Screen的ips-options模板testsetsecurityscreenids-optiontesticmpfragmentsetsecurityscreenids-optiontesticmpfloodsetsecurityscreenids-opt

7、iontesttcpport-scansetsecurityscreenids-optiontesttcpsyn-floodsetsecurityscreenids-optiontesttcplandsetsecurityscreenids-optiontesttcpwinnukesetsecurityscreenids-optiontestudpflood1.1在zone上引用Screen的ips-opti