一、基础操作说明：
为东港等地区用户提供了全套网页设计制作服务，及东港网站建设行业解决方案。主营业务为成都网站设计、网站制作、东港网站设计，以传统方式定制建设网站，并提供域名空间备案等一条龙服务，秉承以专业、用心的态度为用户提供真诚的服务。我们深信只要达到每一位用户的要求，就会得到认可，从而选择与我们长期合作。这样，我们也可以走得更远！
1、 设备恢复出厂化
root# load factory-default
root# set system root-authentication plain-text-password
root# commit
root> request system reboot
2、 基本配置
2.1 配置主机名
root# set system host-name SRX1400
2.2设置时区
root@SRX1400# set system time-zoneAsia/Shanghai
2.3设置时间
root@SRX1400# run set date 201508011549.21
2.4设置dns
root@SRX1400# set system name-server202.l06.0.20
2.5设置接口IP
root@SRX1400# set interfaces ge-0/0/0 unit0 family inet address 10.0.0.10/24
2.6设置默认路由
root@SRX1400# set routing-options staticroute 0.0.0.0/0 next-hop 10.0.0.254
2.7创建登陆用户
root@SRX1400# set system login user adminclass super-user authentication plain-text-password
2.8创建安全Zone
root@SRX1400# set security zonessecurity-zone untrust
2.9接口加入zone
root@SRX1400# set security zones security-zoneuntrust interfaces ge-0/0/0.0
2.10业务口放行icmp
root@SRX1400#set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ping
说明：默认情况下，除管理口外的业务口是无法ping通的，需要放行icmp。
二、juniper srx nat
1、NAT的类型
1.1 source nat :interface
1.2 source nat :pool
1.3 destination nat
1.4 static nat
2、配置实例
2.1 基于接口的source nat
root@SRX1400# set security nat sourcerule-set 1 from zone trust
root@SRX1400# set security nat sourcerule-set 1 to zone untrust
root@SRX1400# set security nat sourcerule-set 1 rule rule1 match source-address 0.0.0.0/0 destination-address 0.0.0.0/0
root@SRX1400# set security nat sourcerule-set 1 rule rule1 then source-nat interface
默认police
policy default-permit {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
2.2基于地址池的source nat
root@SRX1400# set security nat source poolisp address 10.0.0.20 to 10.0.30
root@SRX1400# set security nat sourcerule-set 1 from zone trust
root@SRX1400# set security nat sourcerule-set 1 to zone untrust
root@SRX1400# set security nat sourcerule-set 1 rule rule1 match source-address 0.0.0.0/0 destination-address 0.0.0.0/0
root@SRX1400# set security nat sourcerule-set 1 rule rule1 then source-nat pool isp
root@SRX1400# set security nat proxy-arpinterface ge-0/0/0 address 10.0.0.20 to 10.0.0.30
2.3 destination nat 配置
root@SRX1400# set security nat destinationpool dst-nat-pool-1 address 172.16.1.1/32
root@SRX1400# set security nat destinationpool dst-nat-pool-1 address port 80
root@SRX1400# set security nat destinationrule-set rs1 from zone untrust
root@SRX1400# set security nat destinationrule-set rs1 rule 1 match destination-address 10.0.0.100/32
root@SRX1400# set security nat destinationpool dst-nat-pool-1 address port 80
root@SRX1400# set security nat proxy-arpinterface ge-0/0/0.0 address 10.0.0.100/32
root@SRX1400# set security address-bookglobal address web 172.16.1.1/32
root@SRX1400# set security nat destinationrule-set rs1 rule 1 then destination-nat pool dst-nat-pool-1
root@SRX1400# set security policiesfrom-zone untrust to-zone trust policy web match source-address any
root@SRX1400# set security policiesfrom-zone untrust to-zone trust policy web match destination-address web match application any
root@SRX1400# set security policiesfrom-zone untrust to-zone trust policy
root@SRX1400# set security policiesfrom-zone untrust to-zone trust policy web then permit
root@SRX1400# insert security policiesfrom-zone untrust to-zone trust policy web before policy default-deny
2.4 static nat配置
root@SRX1400# set security nat staticrule-set rs1 from zone untrust
root@SRX1400# set security nat staticrule-set rs1 rule r1 match destination-address 10.0.0.100/32
root@SRX1400# set security nat staticrule-set rs1 rule r1 then static-nat prefix 172.16.1.1/32
root@SRX1400# set security nat proxy-arpinterface ge-0/0/0.0 address 10.0.0.100/32
root@SRX1400# set security address-bookglobal address web 172.16.1.1/32
root@SRX1400# set security policiesfrom-zone untrust to-zone untrust web match source-address any destination-addressweb application any
root@SRX1400# set security policiesfrom-zone untrust to-zone trust policy web then permit
root@SRX1400# insert security policiesfrom-zone untrust to-zone trust web before policy default-deny
另外有需要云服务器可以了解下创新互联scvps.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。
当前文章：Junipersrx防火墙NAT配置-创新互联
网站URL：
http://cdkjz.cn/article/cojsdj.html
