【正文】 destinationnat pool server6配置zone及將接口加到zone中，將ge0/0/ zone，將ge0/0/ zoneset security zones securityzone trust hostinboundtraffic systemservices allset security zones securityzone trust hostinboundtraffic protocols allset security zones securityzone trust interfaces ge0/0/set security zones securityzone untrust hostinboundtraffic systemservices allset security zones securityzone untrust hostinboundtraffic protocols allset security zones securityzone untrust interfaces ge0/0/配置icmp、tftp應(yīng)用允許從trust訪問untrustset security policies fromzone trust tozone untrust policy policyapptest match sourceaddress anyset security policies fromzone trust tozone untrust policy policyapptest match destinationaddress anyset security policies fromzone trust tozone untrust policy policyapptest match application apptestset security policies fromzone trust tozone untrust policy policyapptest then permitset security policies fromzone trust tozone untrust policy policyapptest then log sessioninitset applications application protocol tcpset applications application destinationport set applications applicationset apptest application set applications applicationset apptest application junosicmpallset applications applicationset apptest application junostftp配置允許untrust zone訪問trust 、set security zones securityzone trust addressbook address dnatpc1 set security zones securityzone trust addressbook address dnatpc2 set security zones securityzone trust addressbook addressset dnatpc address dnatpc1set security zones securityzone trust addressbook addressset dnatpc address dnatpc2set security policies fromzone untrust tozone trust policy permitdnat match sourceaddress anyset security policies fromzone untrust tozone trust policy permitdnat match destinationaddress dnatpcset security policies fromzone untrust tozone trust policy permitdnat match application anyset security policies fromzone untrust tozone trust policy permitdnat then permitset security policies fromzone untrust tozone trust policy permitdnat then log sessioninit 測試表格測試號Test4設(shè)備名稱Juniper SRX防火墻：SRX240H1設(shè)備軟件版本測試項目設(shè)備基于rule的目的NAT測試測試目的驗證設(shè)備的防火墻基于rule的目的NAT功能測試配置見本節(jié)的設(shè)備配置部分測試步驟： 按配置步驟進(jìn)行配置 配置2臺測試PC在防火墻內(nèi)網(wǎng)側(cè)，1臺測試PC在防火墻外網(wǎng)側(cè)，分別配置地址為：、6/ 在外網(wǎng)PC：（ping）、TCP（）、UDP（tftp）、如正常則表示untrust zone的pc能通過NAT正常訪問通過NAT對外提供服務(wù)的服務(wù)器。具體的測試需求：n 在SRX防火墻上對PC－。通過網(wǎng)絡(luò)PC的業(yè)務(wù)模擬功能進(jìn)行測試。 測試拓?fù)鋱D 設(shè)備配置 配置接口地址set interfaces ge0/0/0 unit 0 description toLANtrustset interfaces ge0/0/0 unit 0 family inet address set interfaces ge0/0/8 unit 0 description toWANuntrustset interfaces ge0/0/8 unit 0 family inet address 配置zone及將接口加到zone中，將ge0/0/ zone，將ge0/0/ zoneset security zones securityzone trust hostinboundtraffic systemservices allset security zones securityzone trust hostinboundtraffic protocols allset security zones securityzone trust interfaces ge0/0/set security zones securityzone untrust hostinboundtraffic systemservices allset security zones securityzone untrust hostinboundtraffic protocols allset security zones securityzone untrust interfaces ge0/0/配置策略，允許trust和untrust之間互相通信，并且打開log記錄set security policies fromzone trust tozone untrust policy defaultpermit match sourceaddress anyset security policies fromzone trust tozone untrust policy defaultpermit match destinationaddress anyset security policies fromzone trust tozone untrust policy defaultpermit match application anyset security policies fromzone trust tozone untrust policy defaultpermit then permitset security policies fromzone trust tozone untrust policy defaultpermit then log sessioninitset security policies fromzone untrust tozone trust policy defaultpermit match sourceaddress anyset security policies fromzone untrust tozone trust policy defaultpermit match destinationaddress anyset security policies fromzone untrust tozone trust policy defaultpermit match application anyset security policies fromzone untrust tozone trust policy defaultpermit then permitset security policies fromzone untrust tozone trust policy defaultpermit then log sessioninit 測試表格測試號Test2設(shè)備名稱Juniper SRX防火墻：SRX240H1設(shè)備軟件版本測試項目設(shè)備可路由測試測試目的驗證設(shè)備可路由傳輸功能測試配置見本節(jié)的設(shè)備配置部分測試步驟： 按配置步驟進(jìn)行配置 配置2臺測試PC在防火墻兩端，分別配置地址為： 在PC：， server查看訪問的源地址是否為：，如正常則表示trust zone的pc能通過路由正常訪問另一個untrust zone。 測試拓?fù)鋱D 設(shè)備配置 配置管理用戶：set system login user lab uid 2000set system login user lab class superuserset system login user lab authentication plaintextpassword 配置系統(tǒng)管理服務(wù)：（ssh、telnet、）set system services sshset system services telnetset system services webmanagement interface ge0/0/（可以進(jìn)行的管理接口）set system services webmanagement interface allset system services webmanagement systemgeneratedcertificateset system services webmanagement interface all 配置接口地址set interfaces ge0/0/0 unit 0 family inet address set interfaces ge0/0/8 unit 0 family inet address 配置zone或接口是否可以管理防火墻設(shè)備：A、配置zone trust可以管理防火墻：set security zones securityzone trust hostinboundtraffic systemservices allset security zones securityzone trust interfaces ge0/0/B、配置zone untrust可以管理防火墻，但其中的ge0/0/，其他的不允許：set security zones securityzone untrust hostinboundtraffic systemservices allset security zones securityzone untrust interfaces ge0/0/ hostinboundtraffic systemservices set security zones securityzone untrust interfaces ge0/0/ hostinboundtraffic systemservices ssh 測試表格測試號Test1設(shè)備名稱Juniper SRX防火墻：SRX240H1設(shè)備軟件版本測試項目設(shè)備可管理測試測試目的驗證設(shè)備可管理功能測試配置見本節(jié)的設(shè)備配置部分測試步驟： 按配置步驟進(jìn)行配置 配置2臺測試PC在防火墻兩端，分別配置地址為： 在PC：、telnet、方式登錄防火墻的接口地址：，并以用戶lab登錄，如正常則表示防火墻的可管理功能正常 在PC：、telnet、方式登錄防火墻的接口地址：，并以用戶lab登錄，由于該接口在untrust zone，并且該接口只允許ssh及管理，所