Juniper SRX 防火墙透明模式配置手册.docx

: .
JuniperSRX防火墙配置手册
上海神州数码有限公司
系统网络技术部
Juniper
or{ge-0/0/10weight255;ge-0/0/8weight255;ge-8/0/8weight255;ge-8/0/10weight255;ge-0/0/0weight255;ge-8/0/0weight255;}}redundancy-group1{node0priority100;node1priority1;interface・monitor{ge-0/0/8weight255;
ge-8/0/8weight255;ge-0/0/10weight255;ge-8/0/10weight255;ge-O/O/Oweight255;ge-8/0/0weight255;}}
}}##设置相关的物理接口与相应的logical接口reth关联interfaces{
ge-0/0/0{gigether-options{redundant-pa「entreth2;}
}
ge-0/0/8{gigether-options{no-auto-negotiation;redundant-pa「entrethO;}
}ge-0/0/10{gigether-options{no-auto-negotiation;redundant-pa「entrethl;}
}
ge-8/0/0{gigether-options{redundant-parentreth2;}
}
ge-8/0/8{gigether-options{no-auto-negotiation;redundant-parentrethO;}
}
ge-8/0/10{gigether-options{redundant-parentrethl;
}##设置两台防火墙互联的接口
fabO{fabric-options{member-interfaces{ge-0/0/7;}}
}
fabl{fabric-options{member-interfaces{ge-8/0/7;}}
}
irb{unit220{disable;familyinet{&;}}
}
Io0{unit0{familyinet{;}}
}##设置reth接口为trunk接口，所允许的vlan号
rethO{vlan-tagging;redundant-ether-options{redundancy・group1;}unit0{familybridge{interface-modetrunk;
vlan-id-list1-4094;
}
rethl{vlan-tagging;redundant-ether-options{redundancy・group1;}unit0{familybridge{interface-modetrunk;vlan-id-list1-4094;}}
}
reth2{vlan-tagging;redundant-ether-options{redundancy・group1;}unit0{familybridge{interface-modetrunk;vlan-id-list1-4094;}}
}}设置安全区域和策略
##设置防火墙的安全区域，其中12开头的代表两层，并把相关的reth接口同安全区域关联security{
zones{functional-zonemanagement;security-zone12-trust{host-inbound-traffic{system-services{all;}protocols{all;
}interfaces{;}}security-zone12-untrust{interfaces{;}}security-zonetrust;security-zone12-dmz{host-inbound-traffic{system-services{all;}protocols{all;}}interfaces{;}}
}##设置防火墙的策略，目前各安全区域之间是全开放policies{from-zone12-trustto-zone12-untrust{policytrust-untrust{match{source-addressany;destination-addressany