【文章內容簡介】 es fromzone trust tozone untrust policy 1 match destinationaddress anyset security policies fromzone trust tozone untrust policy 1 match application anyset security policies fromzone trust tozone untrust policy 1 then permit上述配置定義Policy策略，允許Trust zone ，根據前面的NAT配置，SRX在建立session時自動執(zhí)行接口源地址轉換。 Pool based Source NAT基于地址池的源地址轉換圖片僅供參考,下列配置參考實驗拓撲　NAT配置：set security nat source pool pool1 address to set security nat source ruleset 1 from zone trustset security nat source ruleset 1 to zone untrustset security nat source ruleset 1 rule rule1 match sourceaddress set security nat source ruleset 1 rule rule1 then sourcenat pool pool1set security nat proxyarp interface ge0/0/0 address to 上述配置表示從trust方向（any）到untrust方向(any)訪問時提供源地址轉換，源地址池為pool1()，同時fe0/0/0接口為此pool IP提供ARP代理。需要注意的是：定義Pool時不需要與Zone及接口進行關聯(lián)。配置proxyarp目的是讓返回包能夠送達SRX，如果Pool與出接口IP不在同一子網，則對端設備需要配置指向fe0/0/0接口的Pool地址路由。Policy：set security policies fromzone trust tozone untrust policy 1 match sourceaddress pc1set security policies fromzone trust tozone untrust policy 1 match destinationaddress anyset security policies fromzone trust tozone untrust policy 1 match application anyset security policies fromzone trust tozone untrust policy 1 then permit上述配置定義Policy策略，允許Trust zone ，根據前面的NAT配置，SRX在建立session時自動執(zhí)行源地址轉換。 Pool base destination NAT基于地址池的目標地址轉換圖片僅供參考,下列配置參考實驗拓撲NAT配置：set security nat destination pool 111 address set security nat destination ruleset 1 from zone untrustset security nat destination ruleset 1 rule 111 match sourceaddress set security nat destination ruleset 1 rule 111 match destinationaddress set security nat destination ruleset 1 rule 111 then destinationnat pool 111，注意：定義的Dst Pool是內網真實IP地址，而不是映射前的公網地址。這點和SrcNAT Pool有所區(qū)別。Policy：set security policies fromzone trust tozone untrust policy 1 match sourceaddress anyset security policies fromzone trust tozone untrust policy 1 match destinationaddress PC1set security policies fromzone trust tozone untrust policy 1 match application anyset security policies fromzone trust tozone untrust policy 1 then permit上述配置定義Policy策略，允許Untrust方向任何地址訪問Trust方向PC1：，根據前面的NAT配置。ScreenOS VIP功能對應的SRX Dstnat配置：set security nat destination pool 222 address set security nat destination ruleset 1 from zone untrustset security nat destination ruleset 1 rule 111 match sourceaddress set security nat destination ruleset 1 rule 111 match destinationaddress set security nat destination ruleset 1 rule 111 match destinationport 8080set security nat destination ruleset 1 rule 111 then destinationnat pool 222上述NAT配置定義：，功能與ScreenOS VIP端口映射一致。 Pool base Static NAT基于地址池的靜態(tài)地址轉換圖片僅供參考,下列配置參考實驗拓撲NAT：set security nat static ruleset staticnat from zone untrustset security nat static ruleset staticnat rule rule1 match destinationaddress set security nat static ruleset staticnat rule rule1 then staticnat prefix Policy:set security policies fromzone trust tozone untrust policy 1 match sourceaddress anyset security policies fromzone trust tozone untrust policy 1 match destinationaddress pc1set security policies fromzone trust tozone untrust policy 1 match application anyset security policies fromzone trust tozone untrust policy 1 then permitStatic NAT概念與ScreenOS MIP一致，屬于靜態(tài)雙向一對一NAT，，并且優(yōu)先級比其他類型NAT高。 IPSEC VPNSRX IPSEC VPN支持SitetoSite VPN 和基于NSremote的撥號VPN以及基于IPSEC的動態(tài)VPN，訪問方式通過WEB界面進行，和ScreenOS一樣，sitetosite VPN也支持路由模式和Policy模式，在配置方面也和ScreenOS基本一致。SRX中的加密/驗證算法在命名上和ScreenOS存在一些區(qū)別，配置過程中建議選擇ike和ipsec的proposal為 standard模式，standard中包含SRX支持的全部加密/驗證算法，只要對端設備支持其中任何一種即可。SRX中通道接口使用st0接口，對應ScreenOS中的tunnel虛擬接口。本次將列舉如下配置案例： 基于策略的LAN TO LAN IPSEC VPN 基于路由的LAN TO LAN IPSEC VPN 基于REMOTE VPN客戶端撥號VPN 基于IPSEC動態(tài)VPN通過WEB界面注意在REMOTE VPN客戶端撥號VPN中我們將列舉JUNIPER REMOTE VPN客戶端和第三方ShrewSoft VPN Client,另外基于IPSEC動態(tài)VPN是通過WEB界面訪問,初次登陸系統(tǒng)自動或人工下載一個JAVA客戶端。 基于路由的LAN TO LAN IPSEC VPNSRX配置：下面是圖中左側SRX基于路由方式Sitetosite VPN配置：set interfaces st0 unit 0 family inet address set security zones securityzone untrust interfaces set routingoptions static route 定義st0 tunnel接口地址/Zone及通過VPN通道到對端網絡路由set security ike policy ABC mode mainset security ike policy ABC proposalset standardset security ike policy ABC presharedkey asciitext juniper定義IKE Phase1 policy參數(shù)，main mode，standard proposal及預共享密鑰方式set security ike gateway gw1 ikepolicy ABCset security ike gateway gw1 address set security ike gateway gw1 externalinterface fe0/0/定義IKE gaeway參數(shù)，預共享密鑰認證，出接口fe0/0/2（位于dmz zone）set security ipsec policy AAA proposalset standardset security ipsec vpn vpn1 bindinterface set security ipsec vpn vpn1 ike gateway gw1set security ipsec vpn vpn1 ike ipsecpolicy AAAset security ipsec vpn vpn1 establishtunnels immediately定義ipsec Phase 2 VPN參數(shù)：standard proposal、調用Phase 1 gw1 ike網關。set security policies fromzone untrust tozone trust policy vpnpolicy match sourceaddress anyset security policies fromzone untrust tozone trust policy vpnpolicy match destinationaddress anyset security policies fromzone untrust tozone trust policy vpnpolicy match application anyset security policies fromzone untrust tozone trust policy vpnpolicy then permitset security policies fromzone trust tozone untrust policy vpnpolicy match sourceaddress anyset security policies fromzone trust tozone untrust policy vpnpolicy match destinationaddress anyset security policies fromzone trust tozone untrust policy vpnpolicy match application anyset security policies fromzone trust tozone untrust policy vpnpolicy then permit兩端設備策略開啟雙向policy以允許VPN流量通過SSG配置參考：set ike gateway abc address Main outgoinginterface ethernet0/1 preshare juniper seclevel standardset vpn gw1 gateway abc noreplay tunnel idletime 0 seclevel standardset vpn gw1 monitorset vpn gw1 id 0x1 bind inter