juniper防火墙 安装手册 1（Juniper Firewall installation manual 1）.doc

juniper防火墙 安装手册 1（Juniper Firewall installation manual 1） 2, Juniper firewall three deployment patterns and basic configuration In the actual deployment process of Juniper firewall, there are three main modes to choose from. The three modes are: NAT model based on three layers of TCP/IP protocol; Routing mode based on three layers of TCP/IP protocol; Transparent mode based on two layer protocol. 2.1, NAT mode When the Juniper firewall entrance interface (network port) in a NAT mode, leading to the Untrust area (outside the network firewall or network) two component IP data packet header in the conversion: the source IP address and source port. The firewall uses the IP address of the Untrust (external network or public network) interface to replace the source IP address of the originating host, and replaces the source port number with any port number generated by the firewall. The environmental features of NAT mode applications: The number of registered IP addresses (public network IP addresses) is insufficient; The internal network uses a large number of non registered IP addresses (private network IP addresses) that require legal access to Internet; In the internal network, there is a server that needs explicit service. 2.2, Route- routing mode When the Juniper firewall interface is configured as a routing mode, the source address and port number of the IP packet header remain unchanged when the firewall forwards the information stream in different security intervals (such as Trust/Utrust/DMZ). Unlike NAT mode, when firewall interfaces are in routing mode, there is no need to establish mapping IP (MIP) and virtual IP (VIP) addresses in order to allow inbound data streams to reach a host; Unlike transparent mode, all interfaces are in different subnets when the firewall interface is in the routing mode. The environmental features of routing mode applications: Register IP (public network IP address) the quantity is more; The number of non registered IP addresses (pri