SRX防火墻Turst內(nèi)私網(wǎng)訪問到映射公網(wǎng)地址配置小技巧

1、Trust內(nèi)私網(wǎng)到公網(wǎng)訪問需求一、測試目的四川移動音樂基地是移動的8大基地之一，全國新歌有98%的首發(fā)在四川，在線歌曲點(diǎn)擊量86%來自四川，2006年帶動全網(wǎng)收入超50億元，2007年突破100億元，2008年則達(dá)到180億元。2009年突破220億元，四川移動音樂中心內(nèi)部有大量的服務(wù)器，處于Juniper SRX3600下面，防火墻trust里面的都是私網(wǎng)地址，公網(wǎng)Untrust訪問私網(wǎng)的trust是通過地址映射來訪問的，在trust內(nèi)部的服務(wù)器有相互訪問的需求，但是相互訪問的時候，不是訪問私有地址（程序開發(fā)的問題，服務(wù)器之間互訪就是公布的公網(wǎng)地址能夠訪問），而是訪問公網(wǎng)地址，缺省情況下，不

2、能實現(xiàn)這個功能，需要做一些額外的配置才能實現(xiàn)。二、測試拓?fù)浔緦嶒炛饕獪y試Juniper SRX3600防火墻對同一安全區(qū)域下StaticNAT和DestinationNAT的支持情況，拓?fù)鋱D如下；三、實驗要求 Untrust區(qū)域PC通過訪問防火墻虛擬映射為Trust區(qū)域服務(wù)器1即；通過訪問虛擬映射為Trust區(qū)域服務(wù)器2即 DMZ區(qū)域PC通過訪問防火墻虛擬映射為Trust區(qū)域服務(wù)器1即；通過訪問虛擬映射為Trust區(qū)域服務(wù)器2即 Trust區(qū)域內(nèi)SER1通過防火墻虛擬映射為Trust區(qū)域服務(wù)器2即；SER2通過訪問防火墻虛擬映射為Trust區(qū)域服務(wù)器1即； Trust區(qū)域兩臺SER均能正常訪問

3、Untrust區(qū)域資源和DMZ區(qū)域資源；四、配置腳本：（STATIC NAT）接口：Untrust區(qū)域 Static NAT映射：set security nat static rule-set s-untrust-trust from zone untrustDMZ區(qū)域 Static NAT映射：set security nat static rule-set dmz-s-dmz-trust from zone dmzTrust區(qū)域 Static NAT映射；set security nat static rule-set s-trust-trust from zone trustuntru

4、st區(qū)域-trust區(qū)域策略：set security policies from-zone untrust to-zone trust policy 10 match source-address anyset security policies from-zone untrust to-zone trust policy 10 match destination-address anyset security policies from-zone untrust to-zone trust policy 10 match application anyset security polici

5、es from-zone untrust to-zone trust policy 10 then permituntrust區(qū)域-DMZ區(qū)域策略：set security policies from-zone untrust to-zone dmz policy 10 match source-address anyset security policies from-zone untrust to-zone dmz policy 10 match destination-address anyset security policies from-zone untrust to-zone d

6、mz policy 10 match application anyset security policies from-zone untrust to-zone dmz policy 10 then permitdmz區(qū)域-trust區(qū)域策略set security policies from-zone dmz to-zone trust policy 10 match source-address anyset security policies from-zone dmz to-zone trust policy 10 match destination-address anyset s

7、ecurity policies from-zone dmz to-zone trust policy 10 match application anyset security policies from-zone dmz to-zone trust policy 10 then permittrust區(qū)域-dmz區(qū)域策略set security policies from-zone trust to-zone dmz policy 10 match source-address anyset security policies from-zone trust to-zone dmz poli

8、cy 10 match destination-address anyset security policies from-zone trust to-zone dmz policy 10 match application anyset security policies from-zone trust to-zone dmz policy 10 then permittrust區(qū)域-trust區(qū)域策略set security policies from-zone trust to-zone trust policy Trust-to-Trust match source-address a

9、nyset security policies from-zone trust to-zone trust policy Trust-to-Trust match destination-address anyset security policies from-zone trust to-zone trust policy Trust-to-Trust match application anyset security policies from-zone trust to-zone trust policy Trust-to-Trust then permit五、配置腳本：（Destina

10、tion NAT）set security nat source rule-set 1 from zone trustset security nat source rule-set 1 to zone untrustset security nat source rule-set 1 rule rule1 then source-nat pool 333set security nat source rule-set 888 from zone trustset security nat source rule-set 888 to zone trustset security nat so

11、urce rule-set 888 rule rule888 then source-nat pool 888set security nat destination rule-set 1 from zone untrustset security nat destination rule-set 1 rule 111 then destination-nat pool 111set security nat destination rule-set 1 rule 112 then destination-nat pool 112set security nat destination rul

12、e-set 101 from zone trustset security nat destination rule-set 101 rule 211 then destination-nat pool 111set security nat destination rule-set 101 rule 212 then destination-nat pool 112set security nat destination rule-set 301 from zone dmzset security nat destination rule-set 301 rule 311 then dest

13、ination-nat pool 111set security nat destination rule-set 301 rule 312 then destination-nat pool 112set security nat static rule-set s-untrust-trust from zone untrustset security nat static rule-set dmz-s-dmz-trust from zone dmzset security nat static rule-set s-trust-trust from zone trustset securi

14、ty policies from-zone trust to-zone trust policy Trust-to-Trust match source-address anyset security policies from-zone trust to-zone trust policy Trust-to-Trust match destination-address anyset security policies from-zone trust to-zone trust policy Trust-to-Trust match application anyset security p

15、olicies from-zone trust to-zone trust policy Trust-to-Trust then permitset security policies from-zone untrust to-zone trust policy 10 match source-address anyset security policies from-zone untrust to-zone trust policy 10 match destination-address anyset security policies from-zone untrust to-zone

16、trust policy 10 match application anyset security policies from-zone untrust to-zone trust policy 10 then permitset security policies from-zone untrust to-zone dmz policy 10 match source-address anyset security policies from-zone untrust to-zone dmz policy 10 match destination-address anyset securit

17、y policies from-zone untrust to-zone dmz policy 10 match application anyset security policies from-zone untrust to-zone dmz policy 10 then permitset security policies from-zone dmz to-zone trust policy 10 match source-address anyset security policies from-zone dmz to-zone trust policy 10 match desti

18、nation-address anyset security policies from-zone dmz to-zone trust policy 10 match application anyset security policies from-zone dmz to-zone trust policy 10 then permitset security policies from-zone trust to-zone dmz policy 10 match source-address anyset security policies from-zone trust to-zone dmz policy 10 match destination-address anyset security policies from-zone trust to-zone dmz policy 10 match application anyset security po