概述
需求为PC直连srx防火墙，配置互联IP，并允许PC访问untrust区域，能够访问互联网
本例中防火墙新增地址 10.1.1.1/30
PC配置IP：10.1.1.2/30 gateway：10.1.1.1
说明
用户视图：root@srx>
配置视图：root@srx#
配置视图：root@srx# run show config run 表示在用户视图下执行命令
root@srx# show #查看当前的配置，注意这里是已配置上的，但不一定生效
root@srx# run show config #查看当前已生效的配置
root@srx> show config #查看当前已生效的配置
配置步骤
- 检查现有的端口IP
root@srx> show interfaces terse
找一个不冲突的IP - 查看路由表
找到IP后，再查看路由表是否有去到这个网段的路由，没有则为正常，如果有就不应使用这个地址
root@srx> show route - 配置接口IP和区域
set interfaces ge-0/0/2 unit 0 family inet address 10.1.1.1/30
set security zones security-zone trust interfaces ge-0/0/2#为方便配置，将该接口添加进已有的区域，本例为trust区域 - 验证是否配置源NAT
root@srx# run show security nat source summary #查看现有的源NAT策略
Total port number usage for port translation pool: 0
Maximum port number for port translation pool: 67108864
Total pools: 0
Total rules: 7
Rule name Rule set From To Action
1 trust-to-untrust trust untrust interface
root@srx# run show security nat source rule 1
source NAT rule: 1 Rule-set: trust-to-untrust
Rule-Id : 1
Rule position : 1
From zone : trust
To zone : untrust
Match
Source addresses : 0.0.0.0 - 255.255.255.255 #源地址已匹配any
Destination addresses : 0.0.0.0 - 255.255.255.255
Destination port : 0 - 0
Action : interface
Persistent NAT type : N/A
Persistent NAT mapping type : address-port-mapping
Inactivity timeout : 0
Max session number : 0
Translation hits : 111
- 验证安全策略是否放行trust->untrust
root@srx# run show security policies from-zone trust to-zone untrust
From zone: trust, To zone: untrust
Policy: ABC, State: enabled, Index: 18, Scope Policy: 0, Sequence number: 1
Source addresses: OFFICE_Set #仅放行了OFFICE_Set 这个address book的地址段
Destination addresses: any
Applications: any
Action: permit
Policy: 1, State: enabled, Index: 6, Scope Policy: 0, Sequence number: 2
Source addresses: any
Destination addresses: any
Applications: any
Action: deny
需要新增address-book
root@srx# set security zones security-zone trust address-book address test_add 10.1.1.2
新增策略
set security policies from-zone trust to-zone untrust policy 2 match source-address test_add
set security policies from-zone trust to-zone untrust policy 2 match destination-address any
set security policies from-zone trust to-zone untrust policy 2 match application any
set security policies from-zone trust to-zone untrust policy 2 then permit
查看策略的配置顺序
root@srx# show security policies from-zone trust to-zone untrust | display set
set security policies from-zone trust to-zone untrust policy 1 match source-address any
set security policies from-zone trust to-zone untrust policy 1 match destination-address any
set security policies from-zone trust to-zone untrust policy 1 match application any
set security policies from-zone trust to-zone untrust policy 1 then deny
set security policies from-zone trust to-zone untrust policy 2 match source-address test_add
set security policies from-zone trust to-zone untrust policy 2 match destination-address any
set security policies from-zone trust to-zone untrust policy 2 match application any
set security policies from-zone trust to-zone untrust policy 2 then permit
如上所示，可以看到新增的policy2在下边，这样会先匹配到policy 1，被deny掉
所以需要改变策略的顺序，用如下命令
insert security policies from-zone trust to-zone untrust policy 2 before policy 1
- 提交配置
root@srx# commit
