以下命令留着自己用 都是从yeslab现任明教教主那看的。。。
恢复系统默认配置
load factory-default
升级os
request system software add validate reboot ftp://1.1.1.1/jinstall-10.0r4.7-export-signed
重启系统
run request system reboot
查看借口状态
run show interfaces terse
进入shell
run start shell
使用管道符匹配特定关键字
>show interfaces detail | match fe-0/0/0
帮组信息
>help reference security policy-security
搜索命令
>help apropos security
#help apropos security
传统set配置
set interfaces fe-0/0/0.1 family inet address 1.1.1.1/24
show interfaces fe-0/0/0.1 family inet
address 1.1.1.1/24
edit配置：
edit interfaces fe-0/0/0.1 family inet
set address 1.1.1.2/24
层次切换
edit interfaces fe-0/0/0
up
查看set格式的配置
show | display set
查看代交与当前配置差别
show | compare
查看恢复配置
rollback ？
清楚未被提交的配置
clear system commit
为接口fe-0/0/0.0配置ip地址
edit interfaces fe-0/0/0.0
set family inet address 202.100.1.10/24
为接口fe-0/0/0.0放入outside zone
edit security zones security-zone outside
set interfaces fe-0/0/0.0
commit
run ping 202.100.1.10
把接口fe-0/0/1.0放入vlan3
edit interfaces fe-0/0/1.0
set ethernet-switching vlan members 3
为vlan3的svi接口vlan.3配置接口地址
edit interfaces vlan.3
set family inet address 202.100.2.10、24
把vlan.3放入outside zone
edit security zones security-zone outside
set interfaces vlan.3
查看统计利用率
show system processes extensive
重启系统进程
restart chassis-control gracefully
修改密码
set system root-authentication plain-text-password
配置静态路由
edit routing-options static
set route 202.100.100.0/24 next-hop 202.100.1.1
查看路由表
show route
配置默认路由
edit routing-options static
set static route 0/0 next-hop 202.100.1.1
配置security policy放行inside1到outside的所有流量
edit security policies from-zone inside1 to-zone outside
edit policy permit-all
set match source-address any
set match destination-address any
set match application any
set then permit
exit
commit
配置outside区域address-book
edit security zones security-zone outside
set address-book address sp1-router 202.100.1.1/32
set address-book address sp2-router 202.100.2.1/32
在security policy调用address-book
edit security policies from-zone inside1 to-zone outside
delete policy permit-all
edit policy permit-all-use-address-book
set match source-address inside1-network
set match destination-address sp-routers
set match application any
set then permit
applications配置
edit applications application tcp-3032
set protocol tcp destination-port 3032
配置applications application-set
edit applications application-set yeslab-app-set
set application tcp-3032
securitypolicy调用application
edit security policies from-zone inside1 to-zone outside
delete policy permit-all-use-address-book
edit policy permit-inside1-to-outside
set match source-address inside1-network
set match destination-address sp-routers
set match application yeslab-app-set
set then permit
查看策略
show security policies
show security policies detail
show security policies from-zone inside1 to-zone outside
查看flow session
show flow session
