【正文】 y ike policy ikepolicy2 mode mainset security ike policy ikepolicy2 proposalset standardset security ike policy ikepolicy2 presharedkey asciitext $9$3ahfnCuOBESyKu0LxdVY2set security ike gateway ikegate ikepolicy ikepolicy1set security ike gateway ikegate address 30 / 34set security ike gateway ikegate externalinterface ge0/0/set security ike gateway ikegate2 ikepolicy ikepolicy2set security ike gateway ikegate2 address set security ike gateway ikegate2 externalinterface ge0/0/set security ipsec policy vpnpolicy1 proposalset standardset security ipsec policy vpnpolicy2 proposalset standardset security ipsec vpn ikevpn bindinterface set security ipsec vpn ikevpn ike gateway ikegateset security ipsec vpn ikevpn ike ipsecpolicy vpnpolicy1set security ipsec vpn ikevpn2 ike gateway ikegate2set security ipsec vpn ikevpn2 ike ipsecpolicy vpnpolicy24) 配置源 NATset security nat source pool pool_100_0_0_10 address set security nat source addresspersistentset security nat source ruleset trusttountrust from zone trustset security nat source ruleset trusttountrust to zone untrustset security nat source ruleset trusttountrust rule natoff match sourceaddress set security nat source ruleset trusttountrust rule natoff match destinationaddress set security nat source ruleset trusttountrust rule natoff then sourcenat offset security nat source ruleset trusttountrust rule interfacenat match sourceaddress set security nat source ruleset trusttountrust rule interfacenat then sourcenat interfaceset security nat source ruleset trusttountrust rule dipnat match sourceaddress set security nat source ruleset trusttountrust rule dipnat then sourcenat pool pool_100_0_0_105) 配置目的 NAT：set security nat destination pool pool_10_0_0_5 address set security nat destination pool pool_10_0_0_5 address port 80set security nat destination ruleset dnatfromuntrust from zone untrustset security nat destination ruleset dnatfromuntrust rule dnat10_0_0_5 match destinationaddress set security nat destination ruleset dnatfromuntrust rule dnat10_0_0_5 match destinationport 8080set security nat destination ruleset dnatfromuntrust rule dnat10_0_0_5 then destinationnat pool pool_10_0_0_56) 配置靜態(tài) NATset security nat static ruleset untrustmip from zone untrustset security nat static ruleset untrustmip rule MIPto10_0_0_6 match destinationaddress set security nat static ruleset untrustmip rule MIPto10_0_0_6 then staticnat prefix 7) 配置 ARP 代理set security nat proxyarp interface ge0/0/ address 31 / 34set security nat proxyarp interface ge0/0/ address 8) 配置防火墻策略set security zones securityzone trust addressbook address pc_10_0_0_0 set security zones securityzone trust addressbook address local set security zones securityzone trust addressbook address localloopback set security zones securityzone trust addressbook address pc_10_0_0_5 set security zones securityzone trust addressbook address pc_10_0_0_6 set security zones securityzone trust addressbook addressset dnatpc address pc_10_0_0_5set security zones securityzone trust addressbook addressset dnatpc address pc_10_0_0_6set security zones securityzone trust hostinboundtraffic systemservices set security zones securityzone trust hostinboundtraffic systemservices telset security zones securityzone trust hostinboundtraffic systemservices sshset security zones securityzone trust hostinboundtraffic systemservices set security zones securityzone trust hostinboundtraffic systemservices pingset security zones securityzone trust interfaces ge0/0/set security zones securityzone trust interfaces ge0/0/set security zones securityzone trust interfaces set security zones securityzone untrust addressbook address pc10_1_1_15 set security zones securityzone untrust addressbook address remoteloopback set security zones securityzone untrust hostinboundtraffic systemservices telset security zones securityzone untrust hostinboundtraffic systemservices pingset security zones securityzone untrust hostinboundtraffic systemservices ikeset security zones securityzone untrust interfaces ge0/0/set security zones securityzone untrust interfaces ge0/0/set security zones securityzone vpn addressbook address remote set security zones securityzone vpn hostinboundtraffic systemservices pingset security zones securityzone vpn hostinboundtraffic protocols ospfset security zones securityzone vpn interfaces set security policies fromzone trust tozone untrust policy trusttountrustvpn match sourceaddress localloopbackset security policies fromzone trust tozone untrust policy trusttountrustvpn match sourceaddress pc_10_0_0_5set security policies fromzone trust tozone untrust policy trusttountrustvpn match destinationaddress remoteloopbackset security policies fromzone trust tozone untrust policy trusttountrustvpn match destinationaddress pc10_1_1_15set security policies fromzone trust tozone untrust policy trusttountrustvpn match application anyset security policies fromzone trust tozone untrust policy trusttountrustvpn then permit tunnel ipsecvpn ikevpn2set security policies fromzone trust tozone untrust policy trusttountrustvpn then permit tunnel pairpolicy untrusttotrustvpnset security policies fromzone trust tozone untrust policy trusttoftp match sourceaddress 32 / 34pc_10_0_0_0set security policies fromzone trust tozone untrust policy trusttoftp match destinationaddress anyset security policies fromzone trust tozone untrust policy trusttoftp match application ftp2021set security policies fromzone trust tozone untrust policy trusttoftp then permitset security policies fromzone tr