JUNIPER SRX双ISP部署Destination-nat配置实验1.0

    企业网环境中，客户通常会部署多条运营商线路。同一台服务器的不同端口会通过不同运营商线的线路发布出去。也有客户会问:无法通过ISP2的地址管理设备。我们通过简单的路由实例就可以实现这一要求。

实验拓扑：    

实验需求：1.客户通过电信访问服务器8080端口，通过联通ip访问服务器80端口；

               2.（后续）SRX监控电信的443端口，一旦443单口被封掉，业务立即切换到联通ip的443。

实验配置：

1.接口：

set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.2/24

set interfaces ge-0/0/1 unit 0 family inet address 10.10.10.2/24

set interfaces ge-0/0/2 unit 0 family inet address 172.16.10.1/24

2.主路由inet.0：

set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1

set routing-options static route 172.188.10.0/24 next-hop st0.1

3.路由实例：

set routing-options interface-routes rib-group inet share

set routing-options rib-groups share import-rib inet.0

set routing-options rib-groups share import-rib isp2.inet.0

set routing-instances isp2 instance-type virtual-router

set routing-instances isp2 interface ge-0/0/1.0

set routing-instances isp2 routing-options static route 0.0.0.0/0 next-hop 10.10.10.1

4.NAT设置：

set security nat source rule-set 1 from zone trust

set security nat source rule-set 1 to zone untrust

set security nat source rule-set 1 rule 1 match source-address 0.0.0.0/0

set security nat source rule-set 1 rule 1 match destination-address 0.0.0.0/0

set security nat source rule-set 1 rule 1 then source-nat interface

set security nat source rule-set 2 from zone trust

set security nat source rule-set 2 to zone isp2

set security nat source rule-set 2 rule 2 match source-address 0.0.0.0/0

set security nat source rule-set 2 rule 2 match destination-address 0.0.0.0/0

set security nat source rule-set 2 rule 2 then source-nat interface

set security nat destination pool test address 172.16.10.2/32

set security nat destination pool test address port 23

set security nat destination pool test_web address 172.16.10.2/32

set security nat destination pool test_web address port 8080

set security nat destination rule-set 1 from zone isp2

set security nat destination rule-set 1 rule 1 match destination-address 10.10.10.2/32

set security nat destination rule-set 1 rule 1 match destination-port 23

set security nat destination rule-set 1 rule 1 then destination-nat pool test

set security nat destination rule-set 2 from zone untrust

set security nat destination rule-set 2 rule 2 match destination-address 1.1.1.2/32

set security nat destination rule-set 2 rule 2 match destination-port 8080

set security nat destination rule-set 2 rule 2 then destination-nat pool test_web

实验验证：

1.测试联通线路NAT端口。实验环境就用telnet的23号端口做测试。从2.2.2.2上telnet 10.10.10.2 23端口登录到了server:

查看10.10.10.2上的NAT HIT：

nat装换成功。

查看10.10.10.2上的会话：

2.测试电信线路8080端口，用web代替。远端pc浏览器输入1.1.1.2端口8080跳转到了server的web管理界面：

正常的业务流量就通过电线的ip出去：

老司机们经常会提到一个问题，就是xx环境不太好，考虑到实际情况下运营商物理线路很少会出问题，后续针对500和433端口会做一些SRX上面的rpm实验，进而更加优化主备***和地址映射等相关功能。

转载于:https://blog.51cto.com/13582804/2067828