Juniper防火墙NAT.doc
文本预览下载声明
Juniper SRX 防火墙配置
1.源 PAT-NAT 应用 langhuashijie In Xian
应用在公网只有一个公有地址或者私有地址，而对 LAN 端进行上互联网的情况 PAC 形式。
主要配置命令:
//蓝字引用互联网 51CTO 相关内容,仅限引用,在此说明
配置策略，让 Inside 能正常访问 Outside！！
edit security policies from-zone Inside1 to-zone Outside policy Permit-ALL
set match source-address any
set match destination-address any
set match application any
set then permit
set then log session-init session-close
配置 Log
edit system syslog file nat-log
set any any
set match RT_FLOW_SESSION
配置 NAT：
edit security nat source rule-set NAT-Policy //rule-set 一系列 NAT 的集合
set from zone Inside1
set to zone Outside
edit rule Inside1-Outside-Interface-NAT //rule
set match source-address /24
set match desnation-address /24 //可选配置，上网就不需要了
set then source-nat interface
commit //提交并应用！
show security flow session
show log nat-log //查看 NAT 转换项！！
show security nat source rule all //查看 NAT 转换类型.. 配置如下:
system {
host-name LangHuaShiJieSrx; //设定 SRX 名称.域名.ROOT 密码
domain-name ;
time-zone Asia/Shanghai;
root-authentication {
encrypted-password $1$uufFaEZU$9oL2eU.JcXinZMJ0zxBEK/; ## SECRET-DATA
}
login { //配置一定权限用户
user langhuashijie {
full-name Renwenbinlanghuashijie;
uid 2000;
class super-user;
authentication {
encrypted-password $1$2fH7.aUI$Eti93B.QmW6qcxnFIHGtB1; ##
SECRET-DATA
}
}
}
services { //开户服务 Set system service ftp ssh telnet webmanagement frome G0/0/0
ftp;
ssh;
telnet {
connection-limit 5;
}
web-management {
http {
interface ge-0/0/0.0;
}
} }
}
}
syntax error.
root@LangHuaShiJieSrx# run show security flow session
Session ID: 1067, Policy name: default-permit/5, Timeout: 22, Valid
In: 00/1078 -- 39/80;tcp, If: ge-0/0/0.0, Pkts: 13, Bytes: 909
Out: 39/80 -- 22/7810;tcp, If: ge-0/0/1.0, Pkts: 10, Bytes: 10887
Session ID: 1072, Policy name: default-permit/5, Timeout: 22, Valid
In: 00/1083 -- 39/80;tcp, If: ge-0/0/0.0, Pkts: 14, Bytes: 956
Out: 39/80 -- 22/30780;tcp, If: ge-0/0/1.0, Pkts: 12, Bytes: 10973
Session ID: 1087, Policy name: default-permit/5, Timeout: 26, Valid
In: 00/1096 -- 43/80;tcp, If: ge-0/0
显示全部