【正文】 nation pool 1026105172p1812 address set security nat destination pool 1026105172p1812 address port 1812set security nat destination ruleset dstnat from zone ggsnset security nat destination ruleset dstnat rule 30 match destinationaddress set security nat destination ruleset dstnat rule 30 match destinationport 1645set security nat destination ruleset dstnat rule 30 then destinationnat pool 1026105172p1812set security nat destination ruleset dstnat rule 40 match destinationaddress set security nat static ruleset static from zone cmset security nat static ruleset static rule static10 match destinationaddress set security nat static ruleset static rule static10 then staticnat prefix set security nat proxyarp interface fe0/0/ address set security nat proxyarp interface fe0/0/ address SRX 一個典型配置此配置包括以下內(nèi)容：定義登錄的用戶名、密碼及 idle 時間；配置 Static NAT/SrcNAT/DstNAT；配置 ALG、 Application；配置 Base route VPN/Base policy VPN/OSPF；做 flow 的 debug 跟蹤29 / 341) 配置主機名、服務(wù)及登錄用戶名密碼：set system hostname srx1set system rootauthentication plaintextpasswordset system login class super idletimeout 20set system login class super permissions allset system login user lab uid 101set system login user lab class superset system login user lab authentication plaintextpasswordset system services sshset system services telset system services webmanagement interface allset system services webmanagement systemgeneratedcertificateset system services webmanagement interface all2) 配置接口 IP 及路由：set interfaces ge0/0/0 unit 0 family i address set interfaces ge0/0/2 unit 0 family i address set interfaces ge0/0/8 unit 0 family i address set interfaces ge0/0/9 unit 0 family i address set interfaces lo0 unit 0 family i address set interfaces st0 unit 0 family i address set routingoptions static route set routingoptions static route set routingoptions static route set routingoptions routerid set protocols ospf export direct_routeset protocols ospf area interface interfacetype p2pset protocols ospf area interface authentication md5 1 key $9$set policyoptions policystatement direct_route from protocol directset policyoptions policystatement direct_route then acceptset policyoptions policystatement static_route from protocol staticset policyoptions policystatement static_route then accept3) 配置 Ipsec VPN：routebase 及 policybase VPNset security ike policy ikepolicy1 mode mainset security ike policy ikepolicy1 proposalset standardset security ike policy ikepolicy1 presharedkey asciitext $9$.mT36/t0OR3nylMWx7set security ike policy ikepolicy2 mode mainset security ike policy ikepolicy2 proposalset standardset security ike policy ikepolicy2 presharedkey asciitext $9$3ahfnCuOBESyKu0LxdVY2set security ike gateway ikegate ikepolicy ikepolicy1set security ike gateway ikegate address 30 / 34set security ike gateway ikegate externalinterface ge0/0/set security ike gateway ikegate2 ikepolicy ikepolicy2set security ike gateway ikegate2 address set security ike gateway ikegate2 externalinterface ge0/0/set security ipsec policy vpnpolicy1 proposalset standardset security ipsec policy vpnpolicy2 proposalset standardset security ipsec vpn ikevpn bindinterface set security ipsec vpn ikevpn ike gateway ikegateset security ipsec vpn ikevpn ike ipsecpolicy vpnpolicy1set security ipsec vpn ikevpn2 ike gateway ikegate2set security ipsec vpn ikevpn2 ike ipsecpolicy vpnpolicy24) 配置源 NATset security nat source pool pool_100_0_0_10 address set security nat source addresspersistentset security nat source ruleset trusttountrust from zone trustset security nat source ruleset trusttountrust to zone untrustset security nat source ruleset trusttountrust rule natoff match sourceaddress set security nat source ruleset trusttountrust rule natoff match destinationaddress set security nat source ruleset trusttountrust rule natoff then sourcenat offset security nat source ruleset trusttountrust rule interfacenat match sourceaddress set security nat source ruleset trusttountrust rule interfacenat then sourcenat interfaceset security nat source ruleset trusttountrust rule dipnat match sourceaddress set security nat source ruleset trusttountrust rule dipnat then sourcenat pool pool_100_0_0_105) 配置目的 NAT：set security nat destination pool pool_10_0_0_5 address set security nat destination pool pool_10_0_0_5 address port 80set security nat destination ruleset dnatfromuntrust from zone untrustset security nat destination ruleset dnatfromuntrust rule dnat10_0_0_5 match destinationaddress set security nat destination ruleset dnatfromuntrust rule dnat10_0_0_5 match destinationport 8080set security nat destination ruleset dnatfromuntrust rule dnat10_0_0_5 then destinationnat pool pool_10_0_0_56) 配置靜態(tài) NATset security nat static ruleset untrustmip from zone untrustset security nat static ruleset untrustmip rule MIPto10_0_0_6 match destinationaddress set security nat static ruleset untrustmip rule MIPto10_0_0_6 then staticnat prefix 7) 配置 ARP 代理set security nat proxyarp interface ge0/0/ address 31 / 34set security nat proxyarp interface ge0/0/ address 8) 配置防火墻策略set security zones securityzone trust addressbook address pc_10_0_0_0 set security zones securityzone trust addressbook address local set security zones securityzone trust addressbook address localloopback set security zones securityzone trust addressbook address pc_10_0_0_5 set security zones securityzone trust addressbook address pc_10_0_0_6 set security zones securityzone trust addressbook addressset dnatpc address pc_10_0_0_5set security zones securityzone trust addressbook add