juniper srx防火墙-nat实际现网配置实例.docxVIP

SRX NAT SRX的NAT配置与ScreenOS显著不同，为保证系统的灵活性，SRX把NAT配置从安全策略里剥离出来，单独成为一个层次：即在SRX JUNOS中安全策略只负责控制业务数据的转发与否，NAT策略只控制业务数据的源地址和端口的翻译规则，两者各自独立。 SRX的NAT配置分为源地址翻译(source NAT), 目标地址翻译(destination NAT)和静态地址翻译(static NAT)三种，其配置语法都类似，只是nat rule必须被放到rule-set里使用，任意两个zone或任意两个网络逻辑接口之间只允许有一个rule-set。 值得注意的是SRX不会自动为NAT规则生成proxy-arp配置，因此如果NAT地址翻译之后的地址跟出向接口地址不同但在同一网络内时，必须手工配置相应接口proxy-arp以代理相关IP地址的ARP查询回应，否则下一条设备会由于不能通过ARP得到NAT地址的MAC地址而不能构造完整的二层以太网帧头导致通信失败。 配置：set security nat source rule-set src-nat from zone trustset security nat source rule-set src-nat to zone untrustset security nat source rule-set src-nat rule src-1 match source-address 192.168.1.0/24set security nat source rule-set src-nat rule src-1 then source-nat interfaceset security nat destination pool 10-26-105-172-p1812 address 10.26.105.172/32set security nat destination pool 10-26-105-172-p1812 address port 1812set security nat destination rule-set dst-nat from zone ggsnset security nat destination rule-set dst-nat rule 30 match destination-address 10.0.0.173/32set security nat destination rule-set dst-nat rule 30 match destination-port 1645set security nat destination rule-set dst-nat rule 30 then destination-nat pool 10-26-105-172-p1812set security nat destination rule-set dst-nat rule 40 match destination-address 10.0.0.173/32set security nat static rule-set static from zone cmnetset security nat static rule-set static rule static-10 match destination-address 211.137.59.27/32set security nat static rule-set static rule static-10 then static-nat prefix 10.26.105.170/32set security nat proxy-arp interface reth2.0 address 211.137.59.27/32set security nat proxy-arp interface reth0.0 address 10.0.0.173/32或 HYPERLINK mailto:lab@srx210 lab@srx210# show security??? nat {??????? source {??????????? rule-set src {??????????????? from zone trust;??????????????? to zone cmnet;??????????????? rule src-10 {??????????????????? match {??????????????????????? source-address 0.0.0.0/0;??????????????????? }?