NetScreen放开FTP服务(双向NAT).docxVIP

FTP双向地址转换实验名称：FTP双向地址转换目的：测试NetScreen系统对FTP服务的两种模式做双向NAT，隐藏真实IP地址。拓扑环境：拓扑说明：用防火墙的eth0、eth3接口分别两台笔记本，一台充当服务器，一台充当客户端；在防火墙上创建Untrust、Trust两个zone，并将eth0放入Trust，eth3放入Untrust；分别为防火墙eth0和eth3接口设置地址00/24、00/24，分别为服务器和客户端设置地址0/24,0/24，网关指向各自所连防火墙接口地址；在防火墙上设置eth0和eth3上分别设置虚地址/24、/24用作地址转换。地址表：方向TrustUntrust源目的源目的T-U00U-T00过程说明：通过控制口登陆防火墙；对防火墙进行如下配置：初始化接口（为eth0、eth3配地址、将接口模式修改为route模式，开放ping、telnet等服务）；创建Untrust、Trust两个zone，并分别将eth3、eth0放入Untrust、Trust；定义地址0/24、0/24、/24、/24；定义dip（dip-5:/24,dip-6:/24），注意需关闭端口转换；定义服务（ping、ftp）；创建策略；添加路由，将/24和/24的路由分别指向各自所在防火墙接口，/24和/24与设备直连，无需添加路由；在服务器上搭建FTP应用；在客户端进行访问测试，观察结果。实验结果：成功验证了双向NAT转换具体配置：ns204- get configTotal Config size 4071:set clock timezone 0setvrouter trust-vr sharablesetvrouter untrust-vrexitsetvrouter trust-vrunset auto-route-exportexitset service tcp3389 protocol tcpsrc-port 0-65535 dst-port 3389-3389 setauth-server Local id 0setauth-server Local server-name Localsetauth default auth server Localsetauth radius accounting port 1646set admin name netscreenset admin password nKVUM2rwMUzPcrkG5sWIHdCtqkAibnset admin auth timeout 10set admin auth server Localset admin format dosset zone Trust vrouter trust-vrset zone Untrust vrouter trust-vrset zone DMZ vrouter trust-vrset zone VLAN vrouter trust-vrset zone Untrust-Tun vrouter trust-vrset zone Trust tcp-rstset zone Untrust block unset zone Untrust tcp-rstset zone MGT block set zone DMZ tcp-rstset zone VLAN block unset zone VLAN tcp-rstset zone Untrust screen tear-dropset zone Untrust screen syn-floodset zone Untrust screen ping-deathset zone Untrust screen ip-filter-srcset zone Untrust screen landset zone V1-Untrust screen tear-dropset zone V1-Untrust screen syn-floodset zone V1-Untrust screen ping-deathset zone V1-Untrust screen ip-filter-srcset zone V1-Untrust screen landset interface ethernet1 zone Trustset interface ethernet2 zone DMZset interface ethernet3 zone Untrustunset interface vlan1 ipset interface ethernet1 ip 00/24set interface ethernet1 routeset interface ethernet3