Juniper srx防火墙NAT配置

一、基础操作说明：

1、  设备恢复出厂化

root# load factory-default

root# set system root-authentication plain-text-password

root# commit

root> request system reboot

2、  基本配置

2.1 配置主机名

root# set system host-name SRX1400

2.2设置时区

root@SRX1400# set system time-zone Asia/Shanghai

2.3设置时间

root@SRX1400# run set date 201508011549.21

2.4设置dns

root@SRX1400# set system name-server 202.l06.0.20

2.5设置接口IP

root@SRX1400# set interfaces ge-0/0/0 unit 0 family inet address 10.0.0.10/24

2.6设置默认路由

root@SRX1400# set routing-options static route 0.0.0.0/0  next-hop 10.0.0.254

2.7创建登陆用户

root@SRX1400# set system login user admin class super-user authentication plain-text-password

2.8创建安全Zone

root@SRX1400# set security zones security-zone untrust

2.9接口加入zone

root@SRX1400# set security zones security-zone untrust interfaces  ge-0/0/0.0

2.10业务口放行icmp

root@SRX1400# set security zones security-zone untrust interfaces  ge-0/0/0.0  host-inbound-traffic system-services ping

说明：默认情况下，除管理口外的业务口是无法ping通的，需要放行icmp。

二、juniper srx nat

1、NAT的类型

1.1 source nat :interface

1.2 source nat :pool

1.3 destination nat

1.4 static nat

2、配置实例

2.1 基于接口的source nat

root@SRX1400# set security nat source rule-set 1 from zone trust

root@SRX1400# set security nat source rule-set 1 to zone untrust

root@SRX1400# set security nat source rule-set 1 rule rule1 match source-address 0.0.0.0/0 destination-address 0.0.0.0/0

root@SRX1400# set security nat source rule-set 1 rule rule1 then source-nat interface

默认police

policy default-permit {

match {

source-address any;

destination-address any;

application any;

}

then {

permit;

}

}

2.2基于地址池的source nat

root@SRX1400# set security nat source pool isp address 10.0.0.20 to 10.0.30

root@SRX1400# set security nat source rule-set 1 from zone trust

root@SRX1400# set security nat source rule-set 1 to zone untrust

root@SRX1400# set security nat source rule-set 1 rule rule1 match source-address 0.0.0.0/0 destination-address 0.0.0.0/0

root@SRX1400# set security nat source rule-set 1 rule rule1 then source-nat pool isp

root@SRX1400# set security nat proxy-arp interface ge-0/0/0 address 10.0.0.20 to 10.0.0.30

2.3 destination nat 配置

root@SRX1400# set security nat destination pool dst-nat-pool-1 address 172.16.1.1/32

root@SRX1400# set security nat destination pool dst-nat-pool-1 address port 80

root@SRX1400# set security nat destination rule-set rs1 from zone untrust

root@SRX1400# set security nat destination rule-set rs1 rule 1 match destination-address 10.0.0.100/32

root@SRX1400# set security nat destination pool dst-nat-pool-1 address port 80

root@SRX1400# set security nat proxy-arp interface ge-0/0/0.0 address 10.0.0.100/32

root@SRX1400# set security address-book global address web 172.16.1.1/32

root@SRX1400# set security nat destination rule-set rs1 rule 1 then destination-nat pool dst-nat-pool-1

root@SRX1400# set security policies from-zone untrust to-zone trust policy web match source-address any

root@SRX1400# set security policies from-zone untrust to-zone trust policy web match destination-address web  match application any

root@SRX1400# set security policies from-zone untrust to-zone trust policy

root@SRX1400# set security policies from-zone untrust to-zone trust policy web then permit

root@SRX1400# insert security policies from-zone untrust to-zone trust policy web before policy default-deny

2.4 static nat配置

root@SRX1400# set security nat static rule-set rs1 from zone untrust

root@SRX1400# set security nat static rule-set rs1 rule r1 match destination-address 10.0.0.100/32

root@SRX1400# set security nat static rule-set rs1 rule r1 then static-nat prefix 172.16.1.1/32

root@SRX1400# set security nat proxy-arp interface ge-0/0/0.0 address 10.0.0.100/32

root@SRX1400# set security address-book global address web 172.16.1.1/32

root@SRX1400# set security policies from-zone untrust to-zone untrust web match source-address any destination-address web application any

root@SRX1400# set security policies from-zone untrust to-zone trust policy web then permit

root@SRX1400# insert security policies from-zone untrust to-zone trust web before policy default-deny