Juniper SRX策略路由总结
2017-04-07 12:42
106 查看
1、路由实例路由实例是路由表、接口和路由协议参数的集合。通过设置接口及路由协议各种参数可以形成路由实例的路由表。每个路由实例都有自己的实例名称,并且各自维护一张独立的路由表。全局路由其实也是一个路由实例,其实例名称为inet.0。
2、普通静态策略路由(只做策略,不作NAT转换)
设置包括如下步骤:
1)设置应用接口子接口,定义为服务区域的入接口/出接口
2)定义路由实例,实例类型为forwarding,实例路由表
3)定义过滤器firewall filter
4)定义接口路由组rib-group;
5)将接口路由组导入到全局路由表及路由实例的路由表中;
6)在内网接口应用过滤器filter
3、做NAT的静态策略路由(既做策略又做NAT转换)
注意:
1)该情况下需要试用virtual-router类型的路由实例
2)每个virtual-router维护一张独立的路由表
配置实例拓扑图
达到目的:
默认内网主机上网走CNC 2M链路访问公网,指定的PC走CNC 50M链路访问外网
实现思路:
默认内网所有主机通过全局路由表inet.0走CNC 2M链路出局访问公网,部分指定的PC通过Juniper SRX的FBF路由策略走路由实例的路由表出局访问公网
设置步骤如下:
1)定义服务区域zone
配置示例:
set security zones security-zone lt host-inbound-traffic system-services all
set security zones security-zone lt host-inbound-traffic protocols all
2)设置应用接口子接口,定义为服务区域的入接口/出接口
配置示例:
set security zones security-zone lt interfaces ge-0/0/2.0 host-inbound-traffic system-services all
set security zones security-zone lt interfaces ge-0/0/2.0 host-inbound-traffic protocols all
3)定义路由实例,路由实例数量可根据接入的ISP线路数量来定义。实例类型为virtual-router,VR的虚拟接口,VR的路由表
配置示例:
set routing-instances CNC50M instance-type virtual-router
set routing-instances CNC50M interface ge-0/0/2.0
set routing-instances CNC50M routing-options static route 0.0.0.0/0 next-hop XX.XX.XX.XX ##指向ISP提供的公网网关
4)定义NAT的相关映射rule-set、rule,策略policy、address-book、application等
√Source NAT的rule-set 配置示例:
set security nat source rule-set CNC50M-snat-internet from zone trust
set security nat source rule-set CNC50M-snat-internet to zone lt
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside match source-address 0.0.0.0/0
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside match destination-address 0.0.0.0/0
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside then source-nat interface
√ 策略policy 配置示例:
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match source-address CBGZ-out-norestrict
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match destination-address any
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match application any
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then permit
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then log session-init
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then log session-close
5)定义过滤器filter
配置示例:
set firewall family inet filter filter-1 term LAN_term from destination-address 172.16.0.0/16
set firewall family inet filter filter-1 term LAN_term from destination-address 172.20.0.0/16
set firewall family inet filter filter-1 term LAN_term from destination-address 192.168.0.0/16
set firewall family inet filter filter-1 term LAN_term then accept ##允许内网PC互访,不作以上配置将会导致网关为此防火墙内网接口的PC无法访问内网其他PC。
##指定的PC从CNC 50M链路出局访问公网
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.29.25/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.29.251/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.166/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.137/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.139/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.138/32
set firewall family inet filter filter-1 term CNC50M_term then routing-instance CNC50M
set firewall family inet filter filter-1 term default then accept ##对于filter的其他数据,采取默认动作accept(接受)
6)定义接口路由组
配置示例:
set routing-options interface-routes rib-group inet INSIDE
7)将接口路由组导入到全局路由表及实例的路由表中
配置示例:
set routing-options rib-groups INSIDE import-rib inet.0
set routing-options rib-groups INSIDE import-rib CNC50M.inet.0
set routing-options rib-groups INSIDE import-rib default.inet.0
8)在内网接口应用相应的过滤器filter
set interfaces ge-0/0/0 unit 0 family inet filter input filter-1
4、普通静态策略路由与NAT转换的策略路由之间的区别
路由实例类型不同:
普通静态策略路由类型:forwarding
NAT转换的策略路由类型:virtual-router
参考链接:http://www.docin.com/p-598358767.html
2、普通静态策略路由(只做策略,不作NAT转换)
设置包括如下步骤:
1)设置应用接口子接口,定义为服务区域的入接口/出接口
2)定义路由实例,实例类型为forwarding,实例路由表
3)定义过滤器firewall filter
4)定义接口路由组rib-group;
5)将接口路由组导入到全局路由表及路由实例的路由表中;
6)在内网接口应用过滤器filter
3、做NAT的静态策略路由(既做策略又做NAT转换)
注意:
1)该情况下需要试用virtual-router类型的路由实例
2)每个virtual-router维护一张独立的路由表
配置实例拓扑图
达到目的:
默认内网主机上网走CNC 2M链路访问公网,指定的PC走CNC 50M链路访问外网
实现思路:
默认内网所有主机通过全局路由表inet.0走CNC 2M链路出局访问公网,部分指定的PC通过Juniper SRX的FBF路由策略走路由实例的路由表出局访问公网
设置步骤如下:
1)定义服务区域zone
配置示例:
set security zones security-zone lt host-inbound-traffic system-services all
set security zones security-zone lt host-inbound-traffic protocols all
2)设置应用接口子接口,定义为服务区域的入接口/出接口
配置示例:
set security zones security-zone lt interfaces ge-0/0/2.0 host-inbound-traffic system-services all
set security zones security-zone lt interfaces ge-0/0/2.0 host-inbound-traffic protocols all
3)定义路由实例,路由实例数量可根据接入的ISP线路数量来定义。实例类型为virtual-router,VR的虚拟接口,VR的路由表
配置示例:
set routing-instances CNC50M instance-type virtual-router
set routing-instances CNC50M interface ge-0/0/2.0
set routing-instances CNC50M routing-options static route 0.0.0.0/0 next-hop XX.XX.XX.XX ##指向ISP提供的公网网关
4)定义NAT的相关映射rule-set、rule,策略policy、address-book、application等
√Source NAT的rule-set 配置示例:
set security nat source rule-set CNC50M-snat-internet from zone trust
set security nat source rule-set CNC50M-snat-internet to zone lt
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside match source-address 0.0.0.0/0
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside match destination-address 0.0.0.0/0
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside then source-nat interface
√ 策略policy 配置示例:
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match source-address CBGZ-out-norestrict
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match destination-address any
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match application any
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then permit
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then log session-init
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then log session-close
5)定义过滤器filter
配置示例:
set firewall family inet filter filter-1 term LAN_term from destination-address 172.16.0.0/16
set firewall family inet filter filter-1 term LAN_term from destination-address 172.20.0.0/16
set firewall family inet filter filter-1 term LAN_term from destination-address 192.168.0.0/16
set firewall family inet filter filter-1 term LAN_term then accept ##允许内网PC互访,不作以上配置将会导致网关为此防火墙内网接口的PC无法访问内网其他PC。
##指定的PC从CNC 50M链路出局访问公网
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.29.25/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.29.251/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.166/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.137/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.139/32
set firewall family inet filter filter-1 term CNC50M_term from source-address 172.16.28.138/32
set firewall family inet filter filter-1 term CNC50M_term then routing-instance CNC50M
set firewall family inet filter filter-1 term default then accept ##对于filter的其他数据,采取默认动作accept(接受)
6)定义接口路由组
配置示例:
set routing-options interface-routes rib-group inet INSIDE
7)将接口路由组导入到全局路由表及实例的路由表中
配置示例:
set routing-options rib-groups INSIDE import-rib inet.0
set routing-options rib-groups INSIDE import-rib CNC50M.inet.0
set routing-options rib-groups INSIDE import-rib default.inet.0
8)在内网接口应用相应的过滤器filter
set interfaces ge-0/0/0 unit 0 family inet filter input filter-1
4、普通静态策略路由与NAT转换的策略路由之间的区别
路由实例类型不同:
普通静态策略路由类型:forwarding
NAT转换的策略路由类型:virtual-router
参考链接:http://www.docin.com/p-598358767.html
相关文章推荐
- JAVA与C++::关于JNI中文字符串操作问题总结
- SCI软件使用方法总结-定位测量篇
- XP方法学习总结及对小组开发的思考
- JDBC与字符集总结
- VC常见入门问题总结(一)
- GeoTiff探索成果总结
- 侯捷专栏:长吁一口气(三年大陆经验总结)
- 程序设计和调试中的几点总结
- MASM宏使用总结
- JIURL PE 格式学习总结(一)-- PE文件概述
- 一年工作的总结
- JIURL PE 格式学习总结(二)-- PE文件中的输出函数
- JIURL PE 格式学习总结(三)-- PE文件中的输入函数
- JIURL PE 格式学习总结(四)-- PE文件中的资源
- 总结:在一个工程中添加别的工程的中已创建好的对话框资源。(或是。。。)
- .NET环境下水晶报表使用总结
- 精彩总结:★加密网页破解大法★
- duwamish7的一些代码分析总结
- 没头没尾--项目开发笔记:项目问题的阶段性总结,下一步…………
- DW属性设置的总结