Juniper _SRX_VPN_专题.docxVIP

Juniper SRX系列VPN专题一 GRE VPN1实验拓扑2实验需求 Internet路由器只有直连路由(配置略)； SRX防火墙除了直连路由外还有一条去往互联网的默认路由； /24能访问/24网段；ZONE trust访问ZONE untrust的所有服务；ZONE untrust只能访问ZONE trust的远程桌面和icmp；3实验配置SRX-220A:set interfaces gr-0/0/0 unit 0 tunnel source set interfaces gr-0/0/0 unit 0 tunnel destination set interfaces gr-0/0/0 unit 0 family inetset interfaces ge-0/0/3 unit 0 family inet address /24set interfaces ge-0/0/4 unit 0 family inet address /24set routing-options static route /24 next-hop gr-0/0/0.0set routing-options static route /0 next-hop set security zones security-zone trust interfaces ge-0/0/3.0set security zones security-zone untrust interfaces ge-0/0/4.0set security zones security-zone untrust interfaces gr-0/0/0.0set security zones security-zone trust host-inbound-traffic system-services allset security zones security-zone trust host-inbound-traffic protocols allset security zones security-zone untrust host-inbound-traffic system-services allset security zones security-zone untrust host-inbound-traffic protocols allset security zones security-zone untrust interfaces gr-0/0/0.0 host-inbound-traffic system-services allset security zones security-zone untrust interfaces gr-0/0/0.0 host-inbound-traffic protocols allset applications application tcp_3389 protocol tcpset applications application tcp_3389 destination-port 3389set security policies from-zone untrust to-zone trust policy untrust-permit-all match source-address anyset security policies from-zone untrust to-zone trust policy untrust-permit-all match destination-address anyset security policies from-zone untrust to-zone trust policy untrust-permit-all match application tcp_3389 junos-icmp-allset security policies from-zone untrust to-zone trust policy untrust-permit-all then permitset security policies from-zone trust to-zone untrust policy permit-all match source-address anyset security policies from-zone trust to-zone untrust policy permit-all match destination-address anyset security policies from-zone trust to-zon