【正文】 destinationnat pool server6配置zone及將接口加到zone中，將ge0/0/ zone，將ge0/0/ zoneset security zones securityzone trust hostinboundtraffic systemservices allset security zones securityzone trust hostinboundtraffic protocols allset security zones securityzone trust interfaces ge0/0/set security zones securityzone untrust hostinboundtraffic systemservices allset security zones securityzone untrust hostinboundtraffic protocols allset security zones securityzone untrust interfaces ge0/0/配置icmp、tftp應(yīng)用允許從trust訪問(wèn)untrustset security policies fromzone trust tozone untrust policy policyapptest match sourceaddress anyset security policies fromzone trust tozone untrust policy policyapptest match destinationaddress anyset security policies fromzone trust tozone untrust policy policyapptest match application apptestset security policies fromzone trust tozone untrust policy policyapptest then permitset security policies fromzone trust tozone untrust policy policyapptest then log sessioninitset applications application protocol tcpset applications application destinationport set applications applicationset apptest application set applications applicationset apptest application junosicmpallset applications applicationset apptest application junostftp配置允許untrust zone訪問(wèn)trust 、set security zones securityzone trust addressbook address dnatpc1 set security zones securityzone trust addressbook address dnatpc2 set security zones securityzone trust addressbook addressset dnatpc address dnatpc1set security zones securityzone trust addressbook addressset dnatpc address dnatpc2set security policies fromzone untrust tozone trust policy permitdnat match sourceaddress anyset security policies fromzone untrust tozone trust policy permitdnat match destinationaddress dnatpcset security policies fromzone untrust tozone trust policy permitdnat match application anyset security policies fromzone untrust tozone trust policy permitdnat then permitset security policies fromzone untrust tozone trust policy permitdnat then log sessioninit 測(cè)試表格測(cè)試號(hào)Test4設(shè)備名稱Juniper SRX防火墻：SRX240H1設(shè)備軟件版本測(cè)試項(xiàng)目設(shè)備基于rule的目的NAT測(cè)試測(cè)試目的驗(yàn)證設(shè)備的防火墻基于rule的目的NAT功能測(cè)試配置見(jiàn)本節(jié)的設(shè)備配置部分測(cè)試步驟： 按配置步驟進(jìn)行配置 配置2臺(tái)測(cè)試PC在防火墻內(nèi)網(wǎng)側(cè)，1臺(tái)測(cè)試PC在防火墻外網(wǎng)側(cè)，分別配置地址為：、6/ 在外網(wǎng)PC：（ping）、TCP（）、UDP（tftp）、如正常則表示untrust zone的pc能通過(guò)NAT正常訪問(wèn)通過(guò)NAT對(duì)外提供服務(wù)的服務(wù)器。具體的測(cè)試需求：n 在SRX防火墻上對(duì)PC－。通過(guò)網(wǎng)絡(luò)PC的業(yè)務(wù)模擬功能進(jìn)行測(cè)試。 測(cè)試拓?fù)鋱D 設(shè)備配置 配置接口地址set interfaces ge0/0/0 unit 0 description toLANtrustset interfaces ge0/0/0 unit 0 family inet address set interfaces ge0/0/8 unit 0 description toWANuntrustset interfaces ge0/0/8 unit 0 family inet address 配置zone及將接口加到zone中，將ge0/0/ zone，將ge0/0/ zoneset security zones securityzone trust hostinboundtraffic systemservices allset security zones securityzone trust hostinboundtraffic protocols allset security zones securityzone trust interfaces ge0/0/set security zones securityzone untrust hostinboundtraffic systemservices allset security zones securityzone untrust hostinboundtraffic protocols allset security zones securityzone untrust interfaces ge0/0/配置策略，允許trust和untrust之間互相通信，并且打開log記錄set security policies fromzone trust tozone untrust policy defaultpermit match sourceaddress anyset security policies fromzone trust tozone untrust policy defaultpermit match destinationaddress anyset security policies fromzone trust tozone untrust policy defaultpermit match application anyset security policies fromzone trust tozone untrust policy defaultpermit then permitset security policies fromzone trust tozone untrust policy defaultpermit then log sessioninitset security policies fromzone untrust tozone trust policy defaultpermit match sourceaddress anyset security policies fromzone untrust tozone trust policy defaultpermit match destinationaddress anyset security policies fromzone untrust tozone trust policy defaultpermit match application anyset security policies fromzone untrust tozone trust policy defaultpermit then permitset security policies fromzone untrust tozone trust policy defaultpermit then log sessioninit 測(cè)試表格測(cè)試號(hào)Test2設(shè)備名稱Juniper SRX防火墻：SRX240H1設(shè)備軟件版本測(cè)試項(xiàng)目設(shè)備可路由測(cè)試測(cè)試目的驗(yàn)證設(shè)備可路由傳輸功能測(cè)試配置見(jiàn)本節(jié)的設(shè)備配置部分測(cè)試步驟： 按配置步驟進(jìn)行配置 配置2臺(tái)測(cè)試PC在防火墻兩端，分別配置地址為： 在PC：， server查看訪問(wèn)的源地址是否為：，如正常則表示trust zone的pc能通過(guò)路由正常訪問(wèn)另一個(gè)untrust zone。 測(cè)試拓?fù)鋱D 設(shè)備配置 配置管理用戶：set system login user lab uid 2000set system login user lab class superuserset system login user lab authentication plaintextpassword 配置系統(tǒng)管理服務(wù)：（ssh、telnet、）set system services sshset system services telnetset system services webmanagement interface ge0/0/（可以進(jìn)行的管理接口）set system services webmanagement interface allset system services webmanagement systemgeneratedcertificateset system services webmanagement interface all 配置接口地址set interfaces ge0/0/0 unit 0 family inet address set interfaces ge0/0/8 unit 0 family inet address 配置zone或接口是否可以管理防火墻設(shè)備：A、配置zone trust可以管理防火墻：set security zones securityzone trust hostinboundtraffic systemservices allset security zones securityzone trust interfaces ge0/0/B、配置zone untrust可以管理防火墻，但其中的ge0/0/，其他的不允許：set security zones securityzone untrust hostinboundtraffic systemservices allset security zones securityzone untrust interfaces ge0/0/ hostinboundtraffic systemservices set security zones securityzone untrust interfaces ge0/0/ hostinboundtraffic systemservices ssh 測(cè)試表格測(cè)試號(hào)Test1設(shè)備名稱Juniper SRX防火墻：SRX240H1設(shè)備軟件版本測(cè)試項(xiàng)目設(shè)備可管理測(cè)試測(cè)試目的驗(yàn)證設(shè)備可管理功能測(cè)試配置見(jiàn)本節(jié)的設(shè)備配置部分測(cè)試步驟： 按配置步驟進(jìn)行配置 配置2臺(tái)測(cè)試PC在防火墻兩端，分別配置地址為： 在PC：、telnet、方式登錄防火墻的接口地址：，并以用戶lab登錄，如正常則表示防火墻的可管理功能正常 在PC：、telnet、方式登錄防火墻的接口地址：，并以用戶lab登錄，由于該接口在untrust zone，并且該接口只允許ssh及管理，所