3juniper防火墻地址翻譯學(xué)習(xí)

技術(shù)博客 、at-Dst、DIP、MIP、網(wǎng) 客 Copyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客

-based

e8:

Copyright?2007JuniperNetworks, Proprietaryand

網(wǎng) 整理 技術(shù)博客 DynamicIPA

B

E8primary:E8secondary:E8extended:

AspecifiedIPorrangeofIPaddressesusedforaddressDefinedonoutboundDIPrangemustbeinthesamesubnetrangeasTheinterfaceprimaryIPTheinterfacesecondaryIPTheinterfaceextendedIP?7tr,.dby onfidentialts 網(wǎng) 整理 技術(shù)博客 A

E8:B

???????? E

FTP

Web

DIPw/DIPw/

IP

Copyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 CreateDIP(ifused)1aPorttranslationon1bPorttranslationoff1cAddressshifting

E8:

ECopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 Step1:CreateDIP–PrivatePublicPublicPublicCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 Step1:CreateDIP-setinterface<name>dip<4-255><start_address>ns208>setinterfacee8dipForextendedaddresssetinterface<name>extip<address>/<mask>dip<4-255>address>[<endns208>setinterfacee8extip/24dip4Noportsetinterface<name>dip<4-255><start_address>[<end_address>]ns208>setinterfacee8dip54fix-Addresssetinterface<name>dip<4-255>shift-from<priv-<start_address>ns208>setinterfacee8dip5shift-fromCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 Step2:Copyright?2007JuniperNetworks, Proprietary

from<zone>to<zone><SA><DA><service>natsrc[dipidWithoutns208>fromPrivatetoExternalanyanyanynatsrcWithns208>fromPrivatetoExternalanyanyanynatsrcdip5網(wǎng) 整理 技術(shù)博客 VerifyingDIPgetDipDipDip4Port-xlateddipsticknessCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 VerifyingNAT-src-Copyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 VerifyingNAT-src-ns208-> idid1,namenone,fromzonePrivatetozoneactionPermit,status"enabled"src"Any",dst"Any",serv"ANY"Policieson tunnel:natsrcdip-id4,serv_timeout0 flag00,sessionbackup:trafficshap OFF,urlfilteringOFF,schedulern/a,servflag00logno,logcount0,alertno,counterno(0)rate(min/sec)0/0totaloctets2220,counter(session/packet/octet)0/0/0priority7,diffservmarkingOfftadapter:stateOFF,gbw/mbw0/-1NoAuthenticationNoUser,UserGrouporGroupexpressionns208->getalloc2/max128000,allocfailedid142/s**,vsys 1,time10(20):0/1024<-/512,1,0010db21c041,vlan0,tun0,vsdid143/s**,vsys 1,timeCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 MappedIP

=

One-to-onestaticmap NoportMIPsaredefinedonthe“public”MIPscanbedefinedinANYCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 MIPConfigurationDefineMIPon“public” to“invoke”=

Copyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 Step1:Definesetsetint<name>mip<publicIP>hostns208>setinte8mip5hostCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 Step2:Configure from<zone>to<zone><SA>MIP(<addr>)<service>Copyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 VerifyingMIPOperation-toMIPfromexternalfrominternalhosttoexternalPacketegressistheinterfacewheretheMIPisCopyright?2007JuniperNetworks, Proprietary

ns208->ns208->getalloc225/max128000,allocfailedid292/s**,vsys 2,time10(01):/1728->5/1024,1,0010db21c041,vlan0,vsd0,vsdns208->getalloc2/max128000,allocfailed0id38/s**,vsys0,flag 1,time網(wǎng) 整理 技術(shù)博客 VirtualIP-AB

FTP

Web ofIPMapsindividualportstodifferentinternalIPCanonlybeusedoninterfaceinUntrustVIPaddressmustbeinsamesubnetasinterfaceCopyright?2007JuniperNetworks, Proprietary

VIPVIP 網(wǎng) 整理 技術(shù)博客 VIPConfigurationDefineVIPoninterfaceinUntrust “invoking”A

BFTP

CWebCopyright?2007JuniperNetworks, Proprietary

VIPVIP 網(wǎng) 整理 技術(shù)博客 Step1:Definesetint<name>vip<publicIP><port><service>netftphttpCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 Step2: from<zone>to<zone><SA>VIP(<addr>)<service>ns208> fromuntrusttoprivateanyVIP(00)anyCopyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 VerifyingVIPNetwork>Interface>Edit>VIP/VIPns208->Virtual

Port 80 21 Copyright?2007JuniperNetworks, Proprietary

網(wǎng) 整理 技術(shù)博客 VerifyingVIPCopyright?2007JuniperNetworks, Proprietary

ns208->ns208->getalloc2/max128000,allocfailed0id38/s**,vsys0,flag 1,time11(01):/1262->00/8