1) Junper SRX 防火墙,默认 License 支持2个××× 并发连接。
2) Juniper SRX 防火墙的软件版本需要注意下,测试时发现 12.1X46-D40.2 有问题,因为测试设备是SRX210HE,在高的版本升级不上去,使用版本 12.1X44-D60.2 没问题。
配置:
set access profile dyn-***-access-profile client ***user1 firewall-user password "***userpassword01"
set access profile dyn-***-access-profile address-assignment pool dyn-***-address-pool
set access address-assignment pool dyn-***-address-pool family inet network 192.168.11.0/24 //×××拨入获得的地址池
set access address-assignment pool dyn-***-address-pool family inet xauth-attributes primary-dns 192.168.22.2/32 //×××拨入获得的DNS地址
set access firewall-authentication web-authentication default-profile dyn-***-access-profile
set security ike policy ike-dyn-***-policy mode aggressive
set security ike policy ike-dyn-***-policy proposal-set compatible
set security ike policy ike-dyn-***-policy pre-shared-key ascii-text "***-share-key" //设置一个share key,测试结果,拨号客户端不需要输入该值
set security ike gateway dyn-***-local-gw ike-policy ike-dyn-***-policy
set security ike gateway dyn-***-local-gw dynamic hostname Internet-FW-01 // 该值最好和防火墙的主机名一样
set security ike gateway dyn-***-local-gw dynamic connections-limit 2 //具体数值不要超过license数值
set security ike gateway dyn-***-local-gw dynamic ike-user-type group-ike-id
set security ike gateway dyn-***-local-gw external-interface ge-0/0/0 //设置××× Gateway的接口,一般是设置对外接口,Untrust
set security ike gateway dyn-***-local-gw xauth access-profile dyn-***-access-profile
set security ipsec policy ipsec-dyn-***-policy proposal-set compatible
set security ipsec *** dyn-*** ike gateway dyn-***-local-gw
set security ipsec *** dyn-*** ike ipsec-policy ipsec-dyn-***-policy
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match source-address any
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match destination-address any
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match application any
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy then permit tunnel ipsec-*** dyn-***
set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services ike
set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services https
set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services ping
set security dynamic-*** access-profile dyn-***-access-profile
set security dynamic-*** clients all remote-protected-resources 192.168.0.0/24 //设置哪些地址走×××
set security dynamic-*** clients all remote-exceptions 0.0.0.0/0 //设置哪些地址不走×××
set security dynamic-*** clients all ipsec-*** dyn-***
set security dynamic-*** clients all user ***user1 //此处的用户是刚刚创建过的本地账户
show system license //查看License状态
show security dynamic-*** users //查看×××拨号的用户情况
show security ike security-associations //查看IKE阶段的情况
show security ipsec security-associations //查看IPSec阶段的情况,感觉没啥太大用,拨号不成功,看这ike和ipsec协商情况也没啥太好下手解决问题的办法,最好是看类似于ScreenOS系统看***拨号日志,但是还没找到SRX上面命令或者其他方法。
set system service web-management management-url MGT //因为开启了***,默认登录就变成***了,需要单独做一下管理的URL
转载于:https://blog.51cto.com/lzyqlzyq/1878019