Juniper防火墙NAT

《Juniper防火墙NAT》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、JuniperSRX防火墙配置1.源PAT-NAT应用langhuashijieInXian应用在公网只有一个公有地址或者私有地址，而对LAN端进行上互联网的情况PAC形式。主要配置命令://蓝字引用互联网51CTO相关内容,仅限引用,在此说明配置策略，让Inside能正常访问Outside！！editsecuritypoliciesfrom-zoneInside1to-zoneOutsidepolicyPermit-ALLsetmatchsource-addressanysetmatchdestinat

2、ion-addressanysetmatchapplicationanysetthenpermitsetthenlogsession-initsession-close配置Logeditsystemsyslogfilenat-logsetanyanysetmatchRT_FLOW_SESSION配置NAT：editsecuritynatsourcerule-setNAT-Policy//rule-set一系列NAT的集合setfromzoneInside1settozoneOutsideeditruleI

3、nside1-Outside-Interface-NAT//rulesetmatchsource-address10.1.1.0/24setmatchdesnation-address202.100.1.0/24//可选配置，上网就不需要了setthensource-natinterfacecommit//提交并应用！showsecurityflowsessionshowlognat-log//查看NAT转换项！！showsecuritynatsourceruleall//查看NAT转换类型..配置如下:

4、system{host-nameLangHuaShiJieSrx;//设定SRX名称.域名.ROOT密码domain-namerwb.com;time-zoneAsia/Shanghai;root-authentication{encrypted-password"$1$uufFaEZU$9oL2eU.JcXinZMJ0zxBEK/";##SECRET-DATA}login{//配置一定权限用户userlanghuashijie{full-nameRenwenbinlanghuashijie;uid200

5、0;classsuper-user;authentication{encrypted-password"$1$2fH7.aUI$Eti93B.QmW6qcxnFIHGtB1";##SECRET-DATA}}}services{//开户服务SetsystemserviceftpsshtelnetwebmanagementfromeG0/0/0ftp;ssh;telnet{connection-limit5;}web-management{http{interfacege-0/0/0.0;}}}syslog{

6、user*{anyemergency;}filemessages{anyany;authorizationinfo;}fileinteractive-commands{interactive-commandsany;}filenat-log{//syslognat文件配置anyany;matchRT_Flow_session;}}license{autoupdate{urlhttps://ae1.juniper.net/junos/key_retrieval;}}}interfaces{ge-0/0/0{

7、unit0{familyinet{address192.168.0.1/24;}}}ge-0/0/1{unit0{familyinet{address192.168.1.222/24;}}}ge-0/0/2{unit0{familyinet{address172.16.0.1/24;}}}}routing-options{static{route0.0.0.0/0next-hop192.168.1.1;//默认路由配置}}security{screen{ids-optionuntrust-screen{i

8、cmp{ping-death;}ip{source-route-option;tear-drop;}tcp{syn-flood{alarm-threshold1024;attack-threshold200;source-threshold1024;destination-threshold2048;queue-size2000;##Warning:'queue-size'isdeprecatedtimeout20;}land