juniper srx 240 cluster 内网服务器端口发布到外网配置实例

原创

ITint 2018-12-24 16:50:40 博主文章分类：网络安全 ©著作权

©著作权归作者所有：来自51CTO博客作者ITint的原创作品，请联系作者获取转载授权，否则将追究法律责任

======================================================================================================================== -----------------------------------------内网地址端口发布到外网步骤----------------------------------------------------- set security address-book global address IMMQI_PRIVATE 172.22.201.20/32

步骤一：创建 NAT pool set security nat destination pool DP_TRUST_IMMQI_10089 address 172.22.201.20/32 set security nat destination pool DP_TRUST_IMMQI_10089 address port 10089

步骤二：创建 NAT Rule set security nat destination rule-set DNAT_FROM_ISP1 rule ISP1_TCP10089_TO_IMMQI_10089 match destination-address-name WAN3001_241 -----119.145.16.241 set security nat destination rule-set DNAT_FROM_ISP1 rule ISP1_TCP10089_TO_IMMQI_10089 match destination-port 10089 set security nat destination rule-set DNAT_FROM_ISP1 rule ISP1_TCP10089_TO_IMMQI_10089 then destination-nat pool DP_TRUST_IMMQI_10089

步骤三：创建放行端口及协议类型 set applications application tcp-10089 protocol tcp set applications application tcp-10089 destination-port 10089 set applications application tcp-10090 protocol tcp set applications application tcp-10090 destination-port 10090

步骤四：创建区域策略，并具体匹配源地址和目标地址端口 set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 match source-address any set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 match destination-address IMMQI_PRIVATE set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 match application tcp-80 set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 match application tcp-9998 set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 match application tcp-10089 set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 then permit set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 then log session-init set security policies from-zone ISP1 to-zone trust policy P_IMMQI_80_9998 then log session-close

步骤五：如果新建协议，则需要调整策略优先级 insert security policies from-zone Design to-zone trust policy RM-201_84-Cost-Lectra before policy DENY ----新增加策略需要检查是否需要修改策略优先级

set security address-book global address QI_PRIVATE 172.22.201.19/32

正式环境

set security nat destination pool DP_TRUST_IQCSAP_10090 address 172.22.201.19/32 set security nat destination pool DP_TRUST_IQCSAP_10090 address port 10089

ISP1电信线路

set security nat destination rule-set DNAT_FROM_ISP1 rule ISP1_TO_TRUST_IQCSAP_10090 match destination-address-name WAN3001_241 set security nat destination rule-set DNAT_FROM_ISP1 rule ISP1_TO_TRUST_IQCSAP_10090 match destination-port 10090 set security nat destination rule-set DNAT_FROM_ISP1 rule ISP1_TO_TRUST_IQCSAP_10090 then destination-nat pool DP_TRUST_IQCSAP_10090

set security policies from-zone ISP1 to-zone trust policy P_IQCSAP_10090 match source-address any set security policies from-zone ISP1 to-zone trust policy P_IQCSAP_10090 match destination-address QI_PRIVATE set security policies from-zone ISP1 to-zone trust policy P_IQCSAP_10090 match application tcp-10089 set security policies from-zone ISP1 to-zone trust policy P_IQCSAP_10090 then permit set security policies from-zone ISP1 to-zone trust policy P_IQCSAP_10090 then log session-init set security policies from-zone ISP1 to-zone trust policy P_IQCSAP_10090 then log session-close set security policies from-zone ISP1 to-zone trust policy P_IQCSAP_10090 then count

ISP6 联通线路

set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_TRUST_IQCSAP_10090 match destination-address-name WAN3006_165 set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_TRUST_IQCSAP_10090 match destination-port 10090 set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_TRUST_IQCSAP_10090 then destination-nat pool DP_TRUST_IQCSAP_10090

set security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 match source-address any set security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 match destination-address QI_PRIVATE set security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 match application tcp-10089 set security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 then permit set security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 then log session-init set security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 then log session-close set security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 then count

insert security policies from-zone ISP6 to-zone trust policy P_IQCSAP_10090 before policy DENY

验证

{primary:node0} owenli@cfw01a.cn1> show security flow session nat destination-port 10090
node0:

Session ID: 124271, Policy name: P_IQCSAP_10090/276, State: Backup, Timeout: 14396, Valid In: 113.X.X.199/57104 --> X.X.X.165/10090;tcp, If: reth15.3006, Pkts: 0, Bytes: 0 Out: 172.22.201.19/10089 --> 113.X.X.199/57104;tcp, If: reth3.500, Pkts: 0, Bytes: 0 Total sessions: 1

node1:

Session ID: 140801, Policy name: P_IQCSAP_10090/276, State: Active, Timeout: 1796, Valid In: 113.X.X.199/57104 --> X.X.X.165/10090;tcp, If: reth15.3006, Pkts: 2, Bytes: 92 Out: 172.22.201.19/10089 --> 113.X.X.199/57104;tcp, If: reth3.500, Pkts: 1, Bytes: 52 Total sessions: 1