Juniper SSG 防火墙

win10无法登陆SSG进行WEB UI管理

• 故障描述：尝试登录SSG设备时，无法无法刷出页面，但是设备时可以ping通的（内部接口），可以Telnet上设备，就是无法通过网页登录。
• 深入测试：win7的系统可以登录，win10的不行，浏览器报协议版本或加密算法不支持。
• 故障分析：这种情况下，可能是由于防火墙的加密算法的问题。

1、con到设备：

• SSG320M-> get ssh
• SSH V2 is active
• SSH is NOT enabled
• SSH is NOT ready for connections
• Maximum sessions: 6
• Active sessions: 0

2、查看加密算法：

• SSG320M-> get ssl
• web SSL enable.
• web SSL port number(443).
• web SSL cert: Default - System Self-Signed Cert.
• web SSL cipher(RC4_MD5)..

3、修改加密算法并保存配置：

• SSG320M-> set ssl encrypt 3des sha-1
• SSG320M-> save
• Save System Configuration ...
• Done

修改后，测试win10登录SSG管理，正常，问题解决。

NAT

1.NAT-Src with PAT Enabled

• set interface "ethernet0/0" zone "Trust"
• set interface "ethernet0/2" zone "Untrust"
• set interface ethernet0/0 ip 172.16.1.1/24
• set interface ethernet0/0 nat
• set interface ethernet0/2 ip 192.168.0.199/24
• set interface ethernet0/2 route
• set interface ethernet0/2 gateway 192.168.0.1
• set interface ethernet0/2 dip 5 192.168.0.198
• set policy from Trust to Untrust Any Any ANY nat src dip-id 5 permit log

2.NAT-Src with PAT Disabled

• set interface "ethernet0/0" zone "Trust"
• set interface "ethernet0/2" zone "Untrust"
• set interface ethernet0/0 ip 172.16.1.1/24
• set interface ethernet0/0 nat
• set interface ethernet0/2 ip 192.168.0.199/24
• set interface ethernet0/2 route
• set interface ethernet0/2 gateway 192.168.0.1
• set interface ethernet0/2 dip 6 192.168.0.198 fix-port
• set policy from trust to untrust any any any nat src dip-ip 6 permit log

3.NAT-Src Without DIP

• set interface "ethernet0/0" zone "Trust"
• set interface "ethernet0/2" zone "Untrust"
• set interface ethernet0/0 ip 172.16.1.1/24
• set interface ethernet0/0 nat
• set interface ethernet0/2 ip 192.168.0.199/24
• set interface ethernet0/2 route
• set interface ethernet0/2 gateway 192.168.0.1
• set interface ethernet0/2 dip 5 192.168.0.198 192.168.0.198e
• set policy from trust to untrust any any any nat src permit log

透明墙

• set interface "ethernet0/0" zone "V1-Trust"
• set interface "ethernet0/2" zone "V1-Untrust"
• set policy id 3 name "towan" from "V1-Trust" to "V1-Untrust" "Any" "Any" "ANY" permit
• set policy id 3

• 主要区别：
• 思科ASA5500系列防火墙在透明模式下，不会透传CDP和BPDUs；
• Juniper的SSG系列防火墙会透传CDP和BPDUs，有时可能会造成二层环路。

ACL生效顺序和ID无关和acl 顺序有关

常用命令

配置

• injoin-ssg320m-> get config
• Total Config size 3586:
• unset key protection enable
• set clock timezone 0
• set vrouter trust-vr sharable
• set vrouter "untrust-vr"
• exit
• set vrouter "trust-vr"
• unset auto-route-export
• exit
• set vrouter name "MGMT" id 1025 sharable
• set vrouter "MGMT"
• unset auto-route-export
• exit
• set alg appleichat enable
• unset alg appleichat re-assembly enable
• set alg sctp enable
• set auth-server "Local" id 0
• set auth-server "Local" server-name "Local"
• set auth default auth server "Local"
• set auth radius accounting port 1646
• set admin name "netscreen"
• set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn"
• set admin port 8000
• set admin http redirect
• set admin auth web timeout 10
• set admin auth server "Local"
• set admin format dos
• set zone "Trust" vrouter "trust-vr"
• set zone "Untrust" vrouter "trust-vr"
• set zone "DMZ" vrouter "trust-vr"
• set zone "VLAN" vrouter "trust-vr"
• set zone "Untrust-Tun" vrouter "trust-vr"
• set zone "Trust" tcp-rst
• set zone "Untrust" block
• unset zone "Untrust" tcp-rst
• set zone "MGT" block
• unset zone "V1-Trust" tcp-rst
• unset zone "V1-Untrust" tcp-rst
• set zone "DMZ" tcp-rst
• unset zone "V1-DMZ" tcp-rst
• unset zone "VLAN" tcp-rst
• set zone "Untrust" screen tear-drop
• set zone "Untrust" screen syn-flood
• set zone "Untrust" screen ping-death
• set zone "Untrust" screen ip-filter-src
• set zone "Untrust" screen land
• set zone "V1-Untrust" screen tear-drop
• set zone "V1-Untrust" screen syn-flood
• set zone "V1-Untrust" screen ping-death
• set zone "V1-Untrust" screen ip-filter-src
• set zone "V1-Untrust" screen land
• set interface "ethernet0/0" zone "V1-Trust"
• set interface "ethernet0/1" zone "DMZ"
• set interface "ethernet0/2" zone "V1-Untrust"
• set interface vlan1 ip 192.168.0.250/24
• unset interface vlan1 bypass-others-ipsec
• unset interface vlan1 bypass-non-ip
• set interface vlan1 ip manageable
• set interface ethernet0/0 manage mtrace
• set interface vlan1 manage mtrace
• unset flow no-tcp-seq-check
• set flow tcp-syn-check
• unset flow tcp-syn-bit-check
• set flow reverse-route clear-text prefer
• set flow reverse-route tunnel always
• set hostname injoin-ssg320m
• set pki authority default scep mode "auto"
• set pki x509 default cert-path partial
• set dns host dns1 0.0.0.0
• set dns host dns2 0.0.0.0
• set dns host dns3 0.0.0.0
• set address "Untrust" "8.8.8.8/32" 8.8.8.8 255.255.255.255
• set crypto-policy
• exit
• set ike respond-bad-spi 1
• set ike ikev2 ike-sa-soft-lifetime 60
• unset ike ikeid-enumeration
• unset ike dos-protection
• unset ipsec access-session enable
• set ipsec access-session maximum 5000
• set ipsec access-session upper-threshold 0
• set ipsec access-session lower-threshold 0
• set ipsec access-session dead-p2-sa-timeout 0
• unset ipsec access-session log-error
• unset ipsec access-session info-exch-connected
• unset ipsec access-session use-error-log
• set url protocol websense
• exit
• set policy id 2 from "Trust" to "Untrust" "Any" "Any" "ANY" nat src permit log
• set policy id 2
• exit
• set policy id 3 name "towan" from "V1-Trust" to "V1-Untrust" "Any" "Any" "ANY" permit
• set policy id 3
• exit
• set nsmgmt bulkcli reboot-timeout 60
• set ssh version v2
• set config lock timeout 5
• unset license-key auto-update
• set telnet client enable
• set ssl encrypt 3des sha-1
• set snmp port listen 161
• set snmp port trap 162
• set snmpv3 local-engine id "JN1230D03ADD"
• set vrouter "untrust-vr"
• exit
• set vrouter "trust-vr"
• unset add-default-route
• set route 8.8.8.8/32 interface ethernet0/0 gateway 172.16.1.2
• exit
• set vrouter "MGMT"
• exit
• set vrouter "untrust-vr"
• exit
• set vrouter "trust-vr"
• exit
• set vrouter "MGMT"
• exit

初始化

设备开机状态下，使用插到设备正前方的reset口，有手感，直到等到status灯变成橙色，再变绿色后，针松开2秒钟，再将针插入reset孔不放直到灯变红，此时所有端口灯都会灭掉。针取出即可。最后设备会自动重启。设备即恢复出厂默认值。