JUNIPER防火墙配置上网

需求：juniper SRX340配置上网

1.接口配置

配置外网口IP

set interfaces ge-0/0/0 unit 0 family inet address 192.168.58.202/24

配置内网口IP

set interfaces ge-0/0/1 unit 0 family inet address 192.168.2.1/24

2.zone配置

配置外网zone

set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services all

内网zone

set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services all

3.路由配置

set routing-options static route 0.0.0.0/0 next-hop 192.168.58.253

4.nat配置

set security nat source rule-set trust-to-untrust from zone trust
set security nat source rule-set trust-to-untrust to zone untrust
set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 0.0.0.0/0
set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface
 

5.策略配置

set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any
set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit