junipersrx100防火墙配置

Junipersrx100防火墙配置指导

#

一、初始化安装

1.1设备登录

Juniper SRX系列防火墙。开机之后，第一次必须通过console 口（通用超级终端缺省配置）连接SRX ,输入root 用户名登陆，密码为空，进入到SRX设备之后可以开始加载基线配置。

特别注意：SRX低端系列防火墙，在第一次登陆时，执行命令“show configuration”你会发现系统本身已经具备一些配置内容（包括DNS名称、DHCP服务器等），建议删除这些配置，重新配置。Delete 删除

设备开机请直接通过console 连接到防火墙设备

Login ：root

Password ：/***初始化第一次登陆的时候，密码为空**/

Root% cli /**进入操作模式**/

Root>

Root> configure /** 进入配置模式**/

Root# delete /***配置模式执行命令“delete”全局删除所有的系统缺省配置***/

1.2 系统基线配置

Set system host-name name

/***配置设备名称“name”***/

Set system time-zone Asia/Chongqing

/***配置系统时区***/

Set system root-authentication plain-text-password 输入命令，回车

New password: 第一次输入新密码，

Retype new password 重新确认新密码

/***配置系统缺省根账号密码，不允许修改根账号名称“root”***/

注意：root帐号不能用于telnet，但是可以用于web和ssh管理登录到设备

S et system login user topsci class super-user authentication plain-text-password New password 输入密码

Retype new password 确认密码

/***创建一个系统本地账号“name“，

set system services ssh

set system services telnet

set system services web-management http interface all

set systhm services web-management http port 81 interface all

set system services web-management https system-generated-certificate

set system services web-management https interface all

/***全局开启系统管理服务，ssh\telnet\http\https***/

set interfacesge-0/0/2unit 0 family inet address 10.10.10.1/24

set security zones security-zone trustinterfaces ge-0/0/2.0host-inbound-traffic system-services all

set security zones security-zone trustinterfacesge-0/0/2.0host-inbound-traffic protocols all

/***定义内网接口同时定义安全区域并将接口加入到安全区域，接口的选择根据实际需求安排***/

★至此系统的基线配置完成，你可以通过PC机连接到防火墙的ge-0/0/2端口配置同网段的IP地址，使用WEB界面或者telnet\SSH方式登录到防火墙，实施生产配置和进一步完善基线配置，比如配置NTP服务器、SYSLOG服务器、SNMP服务器、安全策略、路由协议、地址转换、UTM等功能。

二、应用场景——生产配置实施步骤

2.1 打开浏览器，输入http://Ip地址，输入用户名和密码，点击login进入到WEB管理。

2.2 配置接口IP 地址

首先点击WEB 界面顶端菜单栏的”Configure”按钮，然后点击并展开左边菜单栏的”interface”按钮，

接下来点击ports ，按钮，页面将展示系统在线的所有端口。

然后我们可以开始查看并配置相应的物理接口IP 地址，在本应用场景中，我们将需要在WEB 界面配置

fe-0/0/0/端口(连接公网)和ge-0/0/2端口由于属于内网接口，ge-0/0/2在之前基线配置中已经完成，因此

WEB 界面不再重新说明如何配置，配置方法与接下来的端口配置一致。

在此选择一个你想要配置的物理接口，点击右上角的”ADD”按钮下拉，然后再点击“logical

interface”。

当点击”logicalinterface”之后，系统会自动跳出一个对话框，让你配置接口IP地址、接口描述等信息。

必须填写一个unit数字，比如0(建议)，这个

unit是一个物理接口中逻辑接口的标识，没有

特殊的意义，但是必须要配置。在描述信息中

可以根据实际情况进行填写，一般建议取一个

比较有意义易识别的简单拼音或英语。在

ZONE此处可以暂时不选择，因为后面会配置。

VLAN ID也不需要配置，因为是三层接口，而

并非VLAN接口，接下来就是需要配置一个通

信IP地址和子网掩码。最后点击OK按钮，代

表此接口配置结束，仅仅是结束并不是生效，

后面我们需要根据步骤和系统右上角

的”Actions”按钮会出现闪烁，提醒我们需

要对刚刚完成的配置进行提交和保存，如下图，

我们需要点击右上角的”Actions”按钮下

拉，然后点击commmit按钮，提交和保存配

置，如果配置校验检查失败，将会有告警提醒用户。

三、配置安全区域

首先点击WEB界面顶端菜单栏的”Configure”按钮，然后点击并展开左边菜单栏的”security”按钮，接下来点击zone/screens，按钮，页面将展示已经存在的安全功能区域，如下图配置

四、配置路由协议

首先点击WEB界面顶端菜单栏的”Configure”按钮，然后点击并展开左边菜单栏的”routing”按钮，接下来点击static routing，按钮，开始添加静态路由，点击右上角的ADD按钮，系统将自动弹出一个对话框完成静态路由的添加(本次配置缺省路由到公网)，点击add按钮添加下一跳网关地址，完成静态路由的添加配置，最后点击右上角的actions按钮下拉commit并点击，完成静态路由配置的提交和保存。

五、配置NAT地址装换

首先点击WEB界面顶端菜单栏的”Configure”按钮，然后点击并展开左边菜单栏的”NAT”按钮，接下来点击Static NAT按钮，开始配置静态地址转换，在配置静态地址转换之前，还需要做一个与NAT相关的配置，那就是定义Proxy ARP，定义Proxy ARP是因为我们接下来使用的NAT公网地址并不是接口自身的IP地址。点击Proxy ARP按钮在NAT配置菜单里，点击add,系统自动弹出对话框要求填写NAT公网地址段、连接公网的接口。最后如下图：

接下来配置静态地址转换的规则，其中有两个部分内容需要填写，第一部分是rule-set,然后在rule-set里面定义真正的NAT 规则rules，rules由多个小的rule组成，比如下图中的右边部分就是rule配置，一个公网地址对应一个内部DMZ区域私网IP地址，实现一对一的静态地址转换。

下图就是在完成上图之后的结果展示，点击定义好的rule-set,可以看到相应的ruels资源。

接下来配置源地址转换的规则，内网地址转换到fe-0/0/0.0接口地址。实现内网地址访问公网。

打开source nat，点击add,首先配置rule set,此时需要指定rule set name以及NAT的方向，比如从trust zone to untrust zone,接下来点击rules中的Add，开始添加rule,同样需要填写rule name、匹配的条件(源地址、目标地址必须，可选IP协议和目的端口号)，然后在action部分选择引用inteface

最后我们可以查看定义完之后的源地址rule-set对象并执行commit提交配置，最终结果展现如下：

五、配置安全策略

本次应用场景一中的安全策略配置涉及三个方向，内网与外网之间的访问、、外网到内网之间的访问，在配置安全策略之前，我们需要提前配置与安全策略相关的策略元素，其中包括地址对象的自定义，服务对象的自定义等。

下面首先将介绍策略元素的自定义，地址对象与服务对象。首先点击WEB界面顶端菜单栏的”Configure”按钮，然后点击并展开左边菜单栏的”security”按钮，接下来点击policy elements按钮，然后再点击”address book”按钮，接着可以点击右上角的ADD按钮添加地址对象和地址组，地址对象菜单“address”地址组对象菜单”address sets”。

当我们完成地址对象和服务对象的自定义之后，接下来可以书写安全访问控制策略，首先点击WEB界面顶端菜单栏的”Configure”按钮，然后点击并展开左边菜单栏的”security”按钮，接下来点击policy按钮,最后点击apply policy按钮去创建区域与区域之间的安全策略。

配置完成。可以利用内网地址，ping外网测试下。

六、应用场景一测试配置CLI(生产配置)

set version 12.1X44-D35.5

set system host-name juniper-fw-srx100

set system time-zone Asia/Chongqing

set system root-authentication encrypted-password "$1$SL2B6zY9$bo.R3TbT4v0vO7sWgR7Vl."

set system login user topsci uid 2001

set system login user topsci class super-user

set system login user topsci authentication encrypted-password "$1$EjN.ZIvT$YYy6M6qo5oTxvSnWqCFq2/"

set system services ssh

set system services telnet

set system services web-management http port 6666

set system services web-management http interface all

set system services web-management https system-generated-certificate

set system services web-management https interface all

set system syslog file policy_session user info

set system syslog file policy_session match RT_FLOW

set system syslog file policy_session archive size 1000k

set system syslog file policy_session archive world-readable

set system syslog file policy_session structured-data

set interfaces fe-0/0/0 unit 0 family inet address 192.1685.1/24

set interfaces fe-0/0/2 unit 0 family inet address 10.10.10.1/24

set interfaces fe-0/0/7 unit 0 family inet address 192.168.1.1/24

set interfaces st0 unit 0 family inet

set routing-options static route 0.0.0.0/0 next-hop 192.168.5.1

set routing-options static route 168.192.0.0/16 next-hop 10.10.10.2

set routing-options static route 172.16.0.0/24 next-hop st0.0

set routing-options static route 192.168.0.0/16 next-hop st0.0

set security ike policy aike mode main

set security ike policy aike proposal-set standard

set security ike policy aike pre-shared-key ascii-text "$9$WTu8-wkqf5z6k.5Fn9OBL x7NwYgoJ"

set security ike gateway gw1 ike-policy aike

set security ike gateway gw1 address 58.135.84.24

set security ike gateway gw1 external-interface fe-0/0/0.0

set security ipsec policy ap2 proposal-set standard

set security ipsec vpn vpn1 bind-interface st0.0

set security ipsec vpn vpn1 ike gateway gw1

set security ipsec vpn vpn1 ike ipsec-policy ap2

set security ipsec vpn vpn1 establish-tunnels immediately

set security nat source pool nap-pool1 address 192.168.5.2/25 to 192.168.5.3 /24

set security nat source rule-set nat1 from zone trust

set security nat source rule-set nat1 to zone untrue

set security nat source rule-set nat1 rule nat1 match source-address 168.192.0.0/16 set security nat source rule-set nat1 rule nat1 match source-address 10.10.10.0/24 set security nat source rule-set nat1 rule nat1 match destination-address 0.0.0.0/0 set security nat source rule-set nat1 rule nat1 then source-nat interface

set security nat static rule-set nat-1 from zone untrue

set security nat static rule-set nat-1 rule rule1 match destination-address 192.168.5.1/32

set security nat static rule-set nat-1 rule rule1 match destination-port 80

set security nat static rule-set nat-1 rule rule1 then static-nat prefix 168.192.1.18/32 set security nat static rule-set nat-1 rule rule1 then static-nat prefix mapped-port 80 set security policies from-zone trust to-zone untrue policy trust-untrust match source-address 168.192

set security policies from-zone trust to-zone untrue policy trust-untrust match source-address 10.10

set security policies from-zone trust to-zone untrue policy trust-untrust match destination-address any

set security policies from-zone trust to-zone untrue policy trust-untrust match application any

set security policies from-zone trust to-zone untrue policy trust-untrust then permit set security policies from-zone trust to-zone untrue policy trust-untrust then log session-init

set security policies from-zone trust to-zone untrue policy trust-untrust then log session-close

set security policies from-zone untrue to-zone trust policy untrust-trust match source-address any

set security policies from-zone untrue to-zone trust policy untrust-trust match destination-address 168.192

set security policies from-zone untrue to-zone trust policy untrust-trust match destination-address 10.10

set security policies from-zone untrue to-zone trust policy untrust-trust match application any

set security policies from-zone untrue to-zone trust policy untrust-trust then permit set security policies from-zone untrue to-zone trust policy untrust-trust then log session-init

set security policies from-zone untrue to-zone trust policy untrust-trust then log session-close

set security policies from-zone untrue to-zone untrue policy untrue-untrue match source-address any

set security policies from-zone untrue to-zone untrue policy untrue-untrue match destination-address any

set security policies from-zone untrue to-zone untrue policy untrue-untrue match application any

set security policies from-zone untrue to-zone untrue policy untrue-untrue then permit

set security policies from-zone vpn to-zone trust policy vpn-policy match source-address any

set security policies from-zone vpn to-zone trust policy vpn-policy match destination-address any

set security policies from-zone vpn to-zone trust policy vpn-policy match application any

set security policies from-zone vpn to-zone trust policy vpn-policy then permit

set security policies from-zone trust to-zone vpn policy vpn-policy match source-address any

set security policies from-zone trust to-zone vpn policy vpn-policy match destination-address any

set security policies from-zone trust to-zone vpn policy vpn-policy match application any

set security policies from-zone trust to-zone vpn policy vpn-policy then permit

set security policies policy-rematch

set security zones security-zone trust address-book address 168.192 168.192.0.0/16 set security zones security-zone trust address-book address 10.10 10.10.10.0/24

set security zones security-zone trust host-inbound-traffic system-services all

set security zones security-zone trust host-inbound-traffic protocols all

set security zones security-zone trust interfaces fe-0/0/2.0 host-inbound-traffic system-services all

set security zones security-zone trust interfaces fe-0/0/2.0 host-inbound-traffic protocols all

set security zones security-zone trust interfaces fe-0/0/7.0 host-inbound-traffic system-services all

set security zones security-zone trust interfaces fe-0/0/7.0 host-inbound-traffic protocols all

set security zones security-zone untrue host-inbound-traffic system-services all

set security zones security-zone untrue host-inbound-traffic protocols all

set security zones security-zone untrue interfaces fe-0/0/0.0 host-inbound-traffic system-services all

set security zones security-zone untrue interfaces fe-0/0/0.0 host-inbound-traffic system-services ike

set security zones security-zone untrue interfaces fe-0/0/0.0 host-inbound-traffic protocols all

set security zones security-zone vpn interfaces st0.0