junipersrx防火墙nat和vpn配置

《junipersrx防火墙nat和vpn配置》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、SRXNAT和Policy执行先后顺序为：目的地址转换－目的地址路由查找－执行策略检查－源地址转换。需注意：Policy中源地址应是转换前的源地址，而目的地址应是转换后的目的地址，即Policy中的源和目的地址应是两端的真实IP地址。Static为双向NAT，其他类型均为单向NAT。1.1InterfacebasedNATNAT：setsecuritynatsourcerule-set1fromzonetrustsetsecuritynatsourcerule-set1tozoneuntrustsetsecuritynatsourcerule-set1rulerule1match

2、source-address0.0.0.0/0destination-address0.0.0.0/0setsecuritynatsourcerule-set1rulerule1thensource-natinterfacePolicy:setsecuritypoliciesfrom-zonetrustto-zoneuntrustpolicy1matchsource-address10.1.2.2setsecuritypoliciesfrom-zonetrustto-zoneuntrustpolicy1matchdestination-addressanysetsecurityp

3、oliciesfrom-zonetrustto-zoneuntrustpolicy1matchapplicationanysetsecuritypoliciesfrom-zonetrustto-zoneuntrustpolicy1thenpermit上述配置定义Policy策略，允许Trustzone10.1.2.2地址访问Untrust方向任何地址，根据前面的NAT配置，SRX在建立session时自动执行接口源地址转换。1.2PoolbasedSourceNAT　　　　NAT：setsecuritynatsourcepoolpool-1address100.1.1.10to1

4、00.1.1.20setsecuritynatsourcerule-set1fromzonetrustsetsecuritynatsourcerule-set1tozoneuntrustsetsecuritynatsourcerule-set1rulerule1matchsource-address0.0.0.0/0destination-address0.0.0.0/0setsecuritynatsourcerule-set1rulerule1thensource-natpoolpool-1setsecuritynatproxy-arpinterfacege-0/0/2addr

5、ess100.1.1.10to100.1.1.20上述配置表示从trust到untrust访问时提供源地址转换，源地址池为pool1(100.1.1.10-100.1.1.20)，同时ge-0/0/2接口为此poolIP提供ARP代理。需要注意的是：定义Pool时不需要与Zone及接口进行关联。配置proxy-arp目的是让返回包能够送达SRX，如果Pool与出接口IP不在同一子网，则对端设备需要配置指向100.1.1.1的Pool地址路由。Policy：setsecuritypoliciesfrom-zonetrustto-zoneuntrustpolicy1matchsour

6、ce-address10.1.1.2setsecuritypoliciesfrom-zonetrustto-zoneuntrustpolicy1matchdestination-addressanysetsecuritypoliciesfrom-zonetrustto-zoneuntrustpolicy1matchapplicationanysetsecuritypoliciesfrom-zonetrustto-zoneuntrustpolicy1thenpermit定义Policy策略允许Trustzone10.1.2.2访问Untrust任何地址，根据前面的NAT配置，SRX

7、在建立session时自动执行源地址转换。1.3PoolbasedestinationNAT第3页共3页NAT：setsecuritynatdestinationpool111address192.168.1.100/32setsecuritynatdestinationrule-set1fromzoneuntrustsetsecuritynatdestinationrule-set1rule111matchsource-address0.0.0.0/0setsecurityna