JuniperSRXVirtualRouter专题.docx

JuniperSRXVirtualRouter专题.docx

《JuniperSRXVirtualRouter专题.docx》由会员分享，可在线阅读，更多相关《JuniperSRXVirtualRouter专题.docx（31页珍藏版）》请在冰豆网上搜索。

JuniperSRXVirtualRouter专题

JuniperSRX防火墙VirtualRouter专题

文档查看须知：

测试环境：

SRX220H

拓扑对应IP:

G-0/0/3：

192.168.3.1/24

G-0/0/4：

192.168.4.1/24

G-0/0/5：

192.168.5.1/24

G-0/0/6：

10.10.30.189/24

F0/1：

192.168.4.2/24

F0/2：

192.168.5.2/24

F0/3:

192.168.100.1/24（模拟遥远互联网）

测试拓扑：

一虚拟路由器（记住来流量入口）；

需求：

外网用户访问防火墙的外网接口3389端口NAT到内网服务器192.168.3.5:

3389，流量按原路返回；

放行所有外网用户到主机192.168.3.5的3389端口；（双线接入）

配置：

setrouting-instancesTelinstance-typevirtual-router

setrouting-instancesTelinterfacege-0/0/4.0

setrouting-instancesTelrouting-optionsinterface-routesrib-groupinetBig-rib

setrouting-instancesTelrouting-optionsstaticroute0.0.0.0/0next-hop192.168.4.2

setrouting-instancesCNCinstance-typevirtual-router

setrouting-instancesCNCinterfacege-0/0/5.0

setrouting-instancesCNCrouting-optionsinterface-routesrib-groupinetBig-rib

setrouting-instancesCNCrouting-optionsstaticroute0.0.0.0/0next-hop192.168.5.2

setinterfacesge-0/0/3unit0familyinetaddress192.168.3.1/24

setinterfacesge-0/0/4unit0familyinetaddress192.168.4.1/24

setinterfacesge-0/0/5unit0familyinetaddress192.168.5.1/24

setinterfacesge-0/0/6unit0familyinetaddress10.10.30.189/24

setrouting-optionsinterface-routesrib-groupinetBig-rib

setrouting-optionsstaticroute10.0.0.0/8next-hop10.10.30.1

setrouting-optionsstaticroute0.0.0.0/0next-hop192.168.4.2

setrouting-optionsstaticroute0.0.0.0/0install

setrouting-optionsstaticroute0.0.0.0/0no-readvertise

setrouting-optionsrib-groupsBig-ribimport-ribinet.0

setrouting-optionsrib-groupsBig-ribimport-ribCNC.inet.0

setrouting-optionsrib-groupsBig-ribimport-ribTel.inet.0

setsecuritynatdestinationpool111address192.168.3.5/32

setsecuritynatdestinationrule-set1fromzoneTel-trust

setsecuritynatdestinationrule-set1rule111matchsource-address0.0.0.0/0

setsecuritynatdestinationrule-set1rule111matchdestination-address192.168.4.1/32

setsecuritynatdestinationrule-set1rule111matchdestination-port3389

setsecuritynatdestinationrule-set1rule111thendestination-natpool111

setsecuritynatdestinationrule-set2fromzoneCNC-trust

setsecuritynatdestinationrule-set2rule222matchsource-address0.0.0.0/0

setsecuritynatdestinationrule-set2rule222matchdestination-address192.168.5.1/32

setsecuritynatdestinationrule-set1rule111matchdestination-port3389

setsecuritynatdestinationrule-set2rule222thendestination-natpool111

setapplicationsapplicationtcp_3389protocoltcp

setapplicationsapplicationtcp_3389destination-port3389

setsecurityzonessecurity-zonetrustaddress-bookaddressH_192.168.3.5192.168.3.5/32

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitmatchsource-addressany

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitmatchdestination-addressH_192.168.3.5

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitmatchapplicationtcp_3389

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitthenpermit

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitmatchsource-addressany

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitmatchdestination-addressH_192.168.3.5

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitmatchapplicationtcp_3389

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitthenpermit

setsecurityzonessecurity-zonetrusthost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zonetrusthost-inbound-trafficprotocolsall

setsecurityzonessecurity-zonetrustinterfacesge-0/0/3.0

setsecurityzonessecurity-zoneTel-trusthost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zoneTel-trusthost-inbound-trafficprotocolsall

setsecurityzonessecurity-zoneTel-trustinterfacesge-0/0/4.0

setsecurityzonessecurity-zoneCNC-trusthost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zoneCNC-trusthost-inbound-trafficprotocolsall

setsecurityzonessecurity-zoneCNC-trustinterfacesge-0/0/5.0

setsecurityzonessecurity-zoneMGThost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zoneMGThost-inbound-trafficprotocolsall

setsecurityzonessecurity-zoneMGTinterfacesge-0/0/6.0

验证：

root@SRX-Ipsec-A>showsecurityflowsession

SessionID:

9696,Policyname:

default-permit/5,Timeout:

1794,Valid

In:

192.168.100.211/57408-->192.168.5.1/3389;tcp,If:

ge-0/0/5.0,Pkts:

2,Bytes:

112

Out:

192.168.3.5/3389-->192.168.100.211/57408;tcp,If:

ge-0/0/3.0,Pkts:

1,Bytes:

60

============================================================================

root@SRX-Ipsec-A>showsecurityflowsession

SessionID:

9697,Policyname:

default-permit/4,Timeout:

1796,Valid

In:

192.168.100.211/57409-->192.168.4.1/3389;tcp,If:

ge-0/0/4.0,Pkts:

2,Bytes:

112

Out:

192.168.3.5/3389-->192.168.100.211/57409;tcp,If:

ge-0/0/3.0,Pkts:

1,Bytes:

60

配置解析：

setrouting-instancesTelinstance-typevirtual-router

//创建虚拟VRTel

setrouting-instancesTelinterfacege-0/0/4.0

//把逻辑接口加入虚拟VR

setrouting-instancesTelrouting-optionsinterface-routesrib-groupinetBig-rib

//定义新增的路由表属于路由组“Big-rib”

setrouting-instancesTelrouting-optionsstaticroute0.0.0.0/0next-hop192.168.4.2

//为Tel路由表配置路由

setrouting-instancesCNCinstance-typevirtual-router

setrouting-instancesCNCinterfacege-0/0/5.0

setrouting-instancesCNCrouting-optionsinterface-routesrib-groupinetBig-rib

setrouting-instancesCNCrouting-optionsstaticroute0.0.0.0/0next-hop192.168.5.2

//配置路由表CNC相关信息

setinterfacesge-0/0/3unit0familyinetaddress192.168.3.1/24

setinterfacesge-0/0/4unit0familyinetaddress192.168.4.1/24

setinterfacesge-0/0/5unit0familyinetaddress192.168.5.1/24

setinterfacesge-0/0/6unit0familyinetaddress10.10.30.189/24

//配置逻辑接口的IP地址

setrouting-optionsinterface-routesrib-groupinetBig-rib

//定义路由表组，并把接口路由加入到Big-rib路由组中

setrouting-optionsstaticroute10.0.0.0/8next-hop10.10.30.1

setrouting-optionsstaticroute0.0.0.0/0next-hop192.168.4.2

//配置全局路由表路由信息

setrouting-optionsstaticroute0.0.0.0/0install

//把路由表安装到转发表

setrouting-optionsstaticroute0.0.0.0/0no-readvertise

//

setrouting-optionsrib-groupsBig-ribimport-ribinet.0

setrouting-optionsrib-groupsBig-ribimport-ribCNC.inet.0

setrouting-optionsrib-groupsBig-ribimport-ribTel.inet.0

//导入三张路由表之间的直连路由到路由表组

setsecuritynatdestinationpool111address192.168.3.5/32

//定义目的NAT后的内部服务器的IP地址

setsecuritynatdestinationrule-set1fromzoneTel-trust

setsecuritynatdestinationrule-set1rule111matchsource-address0.0.0.0/0

setsecuritynatdestinationrule-set1rule111matchdestination-address192.168.4.1/32

setsecuritynatdestinationrule-set1rule111matchdestination-port3389

setsecuritynatdestinationrule-set1rule111thendestination-natpool111

//配置ZONETel-trust的目的NAT

setsecuritynatdestinationrule-set2fromzoneCNC-trust

setsecuritynatdestinationrule-set2rule222matchsource-address0.0.0.0/0

setsecuritynatdestinationrule-set2rule222matchdestination-address192.168.5.1/32

setsecuritynatdestinationrule-set1rule111matchdestination-port3389

setsecuritynatdestinationrule-set2rule222thendestination-natpool111

//配置ZONECNC-trust的目的NAT

setapplicationsapplicationtcp_3389protocoltcp

setapplicationsapplicationtcp_3389destination-port3389

setsecurityzonessecurity-zonetrustaddress-bookaddressH_192.168.3.5192.168.3.5/32

//自定义端口和配置地址表

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitmatchsource-addressany

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitmatchdestination-addressH_192.168.3.5

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitmatchapplicationtcp_3389

setsecuritypoliciesfrom-zoneTel-trustto-zonetrustpolicydefault-permitthenpermit

//配置Tel-trust到trust策略

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitmatchsource-addressany

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitmatchdestination-addressH_192.168.3.5

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitmatchapplicationtcp_3389

setsecuritypoliciesfrom-zoneCNC-trustto-zonetrustpolicydefault-permitthenpermit

//配置CNC-trust到trust策略

setsecurityzonessecurity-zonetrusthost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zonetrusthost-inbound-trafficprotocolsall

setsecurityzonessecurity-zonetrustinterfacesge-0/0/3.0

setsecurityzonessecurity-zoneTel-trusthost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zoneTel-trusthost-inbound-trafficprotocolsall

setsecurityzonessecurity-zoneTel-trustinterfacesge-0/0/4.0

setsecurityzonessecurity-zoneCNC-trusthost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zoneCNC-trusthost-inbound-trafficprotocolsall

setsecurityzonessecurity-zoneCNC-trustinterfacesge-0/0/5.0

setsecurityzonessecurity-zoneMGThost-inbound-trafficsystem-servicesall

setsecurityzonessecurity-zoneMGThost-inbound-trafficprotocolsall

setsecurityzonessecurity-zoneMGTinterfacesge-0/0/6.0

//定义逻辑接口到ZONE，并开放所有的协议及服务来访问防火墙的直连接口

二虚拟路由器（多链路负载冗余）；

需求：

内网用户访问端口22.3389.8080,走电信，其他所有流量走CNC；

所有内网访问外网的流量NAT为对应外网接口IP地址；

实现负载冗余的功能；

放行所有服务；（双线接入）

配置：

setrouting-instancesTelinstance-typevirtual-router

setrouting-instancesTelinterfacege-0/0/4.0

setrouting-instancesTelrouting-optionsinterface-routesrib-groupinetBig-rib

setrouting-instancesTelrouting-optionsstaticroute0.0.0.0/0next-hop19