Juniper SRX 防火墙透明模式配置手册Word下载.docx

1、硬件型号SRX3400软件版本 9.6R1.13配置案例图在上图中ge-0/0/0, ge-0/0/10, ge-0/0/8均让VLAN 199-223穿过。GSR和cisco 3750，6509之间通过上述vlan连通。在GSR、3750和6509之间运行3层协议（如ospf、static等）根据需求，在SRX上运行policy实现trust、DMZ和untrust流量控制Juniper防火墙作为透明模式部署需要建立3个区域,分别、L2_DMZ1.1设置node ID和cluster ID#在操作模式下输入，后面没有注明的则默认是在配置模式下操作#SRX3400-1_L2配置为set cha

2、ssis cluster node 0 cluster-id 1 reboot#SRX3400-2_L2配置为set chassis cluster node 1 cluster-id 1 reboot1.2防火墙系统全局配置（初始化配置）#设置root的用户名和密码system root-authentication encrypted-password $1$R7QtWpjt$OsUXw/4GC.7AiGO2bFHUz.; # SECRET-DATA #添加用户名为lab的用户和密码 login user lab uid 2000; class superuser; authenticat

3、ion $1$h54Sa7e3$cjwdMDkIcvEN89jSZ8eSa/#设置防火墙自己开启的服务 services ftp; telnet; web-management http; syslog user * any emergency; file messages any notice; authorization info;1.3建立集群#双机配置，设置node0为主，node1为备。#设置node0主机名groups node0 system host-name SRX3400-1_L2; backup-router 192.168.2.1 destination 0.0.0.0

4、/0;#设置带外管理地址和带外管理的网关 interfaces fxp0 unit 0 family inet address 192.168.2.254/24; routing-options static route 0.0.0.0/0 next-hop 192.168.2.1; retain; no-readvertise;#设置node1主机名,带外管理地址和带外管理的网关 node1 host-name SRX3400-2_L2; address 192.168.2.253/24; apply-groups $node1.4设置cluster冗余组和接口对象#设置reth-count

5、 数目及主机单元的优先级，并设置监控的端口和权重chassis cluster reth-count 3; heartbeat-interval 1000; heartbeat-threshold 3;#redundancy-group 0为引擎组对象，此处将所有业务接口都放到此组中，这样#设置的结果就是只要有一个业务接口down了，则引擎也进行切换，防止出现#业务接口进行了切换，而引擎没有切换的结果 redundancy-group 0 node 0 priority 100; node 1 priority 1; interface-monitor ge-0/0/10 weight 255

6、; ge-0/0/8 weight 255; ge-8/0/8 weight 255; ge-8/0/10 weight 255; ge-0/0/0 weight 255; ge-8/0/0 weight 255; redundancy-group 1 #设置相关的物理接口与相应的logical接口reth关联interfaces ge-0/0/0 gigether-options redundant-parent reth2; ge-0/0/8 no-auto-negotiation; redundant-parent reth0; ge-0/0/10 redundant-parent re

7、th1; ge-8/0/0 ge-8/0/8 ge-8/0/10 #设置两台防火墙互联的接口 fab0 fabric-options member-interfaces ge-0/0/7; fab1 ge-8/0/7; irb unit 220 disable; address 192.168.1.10/28; lo0 address 127.0.0.1/32;#设置reth接口为trunk接口，所允许的vlan号 reth0 vlan-tagging; redundant-ether-options redundancy-group 1; family bridge interface-mo

8、de trunk; vlan-id-list 1-4094; reth1 reth2 1.5设置安全区域和策略#设置防火墙的安全区域，其中l2开头的代表两层，并把相关的reth接口同安全区域关联security zones functional-zone management; security-zone l2-trust host-inbound-traffic system-services all; protocols reth1.0; security-zone l2-untrust reth0.0; security-zone trust; security-zone l2-dmz

9、reth2.0;#设置防火墙的策略，目前各安全区域之间是全开放 policies from-zone l2-trust to-zone l2-untrust policy trust-untrust match source-address any; destination-address any; application any; then permit; from-zone l2-untrust to-zone l2-trust policy untrust-trust from-zone l2-trust to-zone l2-trust policy trust-trust from-

10、zone l2-trust to-zone l2-dmz policy trust-dmz from-zone l2-untrust to-zone l2-dmz policy untrust-dmz from-zone l2-dmz to-zone l2-trust policy dmz-trust from-zone l2-dmz to-zone l2-untrust policy dmz-untrust alg ftp disable; tftp disable;1.6设置全局l2特性#全局设置vlan透传bridge-domains trunk199-223 vlan-id-list 199-223; vlan001 vlan-id 1; routing-interface irb.0;secondary:node0