Juniper防火墙设备部署标准模板

1、 Page * MERGEFORMAT 30Juniper防火墙设备部署标准模板目录 TOC o 1-3 h z u HYPERLINK l _Toc504680559 一、大规模分行（ISG2000） PAGEREF _Toc504680559 h 3 HYPERLINK l _Toc504680560 1. 产品外观及接口标识： PAGEREF _Toc504680560 h 3 HYPERLINK l _Toc504680561 2. ISG2000实物连接拓扑结构 PAGEREF _Toc504680561 h 3 HYPERLINK l _Toc504680562 3. 配置模板 P

2、AGEREF _Toc504680562 h 4 HYPERLINK l _Toc504680563 二、小规模分行（ISG1000） PAGEREF _Toc504680563 h 13 HYPERLINK l _Toc504680564 1. 产品外观及接口标识： PAGEREF _Toc504680564 h 13 HYPERLINK l _Toc504680565 2. ISG1000实物连接拓扑结构 PAGEREF _Toc504680565 h 14 HYPERLINK l _Toc504680566 3. 配置模板 PAGEREF _Toc504680566 h 15一、大规模分

3、行（ISG2000）1. 产品外观及接口标识：2. ISG2000实物连接拓扑结构3. 配置模板以下配置如无标注，都为系统默认设置。红色的为特别需要注意的，必须所有分行统一化的设置。主防火墙配置：set clock dst-off /*设置timezone 为8，实际上用你的电脑的时间同步以下防火墙，就可以了,在Web界面里有个时间同步的页面*/set clock timezone 8set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00set vrouter trust-vr sharableset

4、 vrouter untrust-vrexitset vrouter trust-vrunset auto-route-exportexit/*设置协议对象，各分行自行定义。建议不要定义长的超时时间，对于长连接应用，如果找不全，就通过设置不检测TCP标志位来全局解决*/set service XXX protocol tcp XXXXXX /*全局关闭一些ALG，初上线时必须按照如下设置*/unset alg sip enableunset alg mgcp enableunset alg sccp enableunset alg sunrpc enableunset alg msrpc en

5、ableunset alg sql enableunset alg rtsp enableunset alg h323 enable/*认证和管理员属性的一些默认设置*/set auth-server Local id 0set auth-server Local server-name Localset auth default auth server Localset auth radius accounting port 1646set admin name netscreenset admin password nKVUM2rwMUzPcrkG5sWIHdCtqkAibnset adm

6、in auth timeout 10set admin auth server Localset admin format dos/*设置安全区所属的虚拟路由器，实际上我们用到的只有Trust和Untrust两个zone,把这两个zone都放进Untrust-VR*/set zone Trust vrouter untrust-vrset zone Untrust vrouter untrust-vrset zone DMZ vrouter trust-vrset zone VLAN vrouter trust-vrset zone Untrust-Tun vrouter trust-vr /

7、*Zone内的一些安全设置，关闭一些可能带来连通性问题的安全设置。*/unset zone Trust tcp-rst unset zone Untrust block unset zone Untrust tcp-rst set zone DMZ tcp-rst set zone VLAN block unset zone VLAN tcp-rst /*为保证连通性，牺牲一些安全性，关闭一些抗网络层攻击功能*/unset zone Untrust screen tear-dropunset zone Untrust screen syn-floodunset zone Untrust scr

8、een ping-deathunset zone Untrust screen ip-filter-srcunset zone Untrust screen landset zone V1-Untrust screen tear-dropset zone V1-Untrust screen syn-floodset zone V1-Untrust screen ping-deathset zone V1-Untrust screen ip-filter-srcset zone V1-Untrust screen land /*把e3/1和e3/2两个口放到HA zone里，做HA口使用，用反绞

9、线直接连接，不要通过交换机连接*/set interface ethernet3/1 zone HAset interface ethernet3/2 zone HA/*把e1/1放untrust zone里，把e1/2放trust zone里*/set interface ethernet1/1 zone Untrustset interface ethernet1/2 zone Trust unset interface vlan1 ip/*设置MGT口的IP地址，用MGT做带外管理*/set interface mgt ip 32.0.6.140/25/*设置接口IP地址，注意接口模式为

10、route模式*/set interface ethernet1/1 ip 32.0.224.68/28set interface ethernet1/1 routeset interface ethernet1/2 ip 32.0.224.84/28set interface ethernet1/2 route unset interface vlan1 bypass-others-ipsecunset interface vlan1 bypass-non-ipset interface ethernet1/1 ip manageableset interface ethernet1/2 i

11、p manageableunset interface ethernet1/2 manage snmpunset interface ethernet1/2 manage ssl/*设置Flow的一些参数，这里尤其需要注意*/set flow tcp-rst-invalid-sessionunset flow tcp-syn-checkunset flow tcp-syn-bit-checkset flow reverse-route clear-text preferset flow reverse-route tunnel alwaysset hostname JS_SRV_FW_1set

12、 pki authority default scep mode autoset pki x509 default cert-path partial/*HA属性的一些设置*/set nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror routeset nsrp rto-mirror session ageout-ackset nsrp vsd-group id 0 priority 50set nsrp secondary-path ethernet1/2set nsrp vsd-group id 0 monitor in

13、terface ethernet1/1set nsrp vsd-group id 0 monitor interface ethernet1/2 set ike respond-bad-spi 1unset ike ikeid-enumerationunset ike dos-protectionunset ipsec access-session enableset ipsec access-session maximum 5000set ipsec access-session upper-threshold 0set ipsec access-session lower-threshol

14、d 0set ipsec access-session dead-p2-sa-timeout 0unset ipsec access-session log-errorunset ipsec access-session info-exch-connectedunset ipsec access-session use-error-logset vrouter untrust-vrexitset vrouter trust-vrexitset icap av-vendor-id symantec-5set url protocol websenseexit/*访问控制策略的设置，各分行灵活自定

15、义，注意最后留两条保底策略*/set policy id 1 from Trust to Untrust Any Any ANY permit set policy id 1exitset policy id 2 from Untrust to Trust Any Any ANY permit set policy id 2exit set nsmgmt bulkcli reboot-timeout 60set ssh version v2set config lock timeout 5unset license-key auto-updateset snmp port listen 161

16、set snmp port trap 162/*静态路由设置，各分行自定义*/set vrouter untrust-vrset route 0.0.0.0/0 interface ethernet1/1 gateway 32.0.224.65 preference 20set route 32.0.6.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.7.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route

17、32.0.8.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.12.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.27.0/28 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.30.224/28 interface ethernet1/2 gateway 32.0.224.81 preference

18、 20set route 32.0.32.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.33.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.34.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.40.0/24 interface ethernet1/2 gateway 32.0.224.8

19、1 preference 20set route 32.0.63.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.76.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.88.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.105.0/24 interface ethernet1/2 gatew

20、ay 32.0.224.81 preference 20set route 32.0.108.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.141.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.159.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.160.0/24 interface e

21、thernet1/2 gateway 32.0.224.81 preference 20set route 32.0.161.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.171.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.190.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.191.

22、0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20set route 32.0.192.0/24 interface ethernet1/2 gateway 32.0.224.81 preference 20exit set vrouter trust-vrunset add-default-routeset route 0.0.0.0/0 interface mgt gateway 32.0.6.254 preference 20exit set vrouter untrust-vrexitset vrouter trus

23、t-vrexit备防火墙配置：（备防火墙只有在MGT和NSRP方面的设置与主防火墙不同，其它配置都是自动同步的）二、小规模分行（ISG1000）1. 产品外观及接口标识：2. ISG1000实物连接拓扑结构3. 配置模板以下配置如无标注，都为系统默认设置。红色的为特别需要注意的，必须所有分行统一化的设置。主防火墙配置：set clock dst-off /*设置timezone 为8，实际上用你的电脑的时间同步以下防火墙，就可以了,在Web界面里有个时间同步的页面*/set clock timezone 8set clock dst recurring start-weekday 2 0 3

24、02:00 end-weekday 1 0 11 02:00set vrouter trust-vr sharableset vrouter untrust-vrexitset vrouter trust-vrunset auto-route-exportexit/*设置协议对象，各分行自行定义。建议不要定义长的超时时间，对于长连接应用，如果找不全，就通过设置不检测TCP标志位来全局解决*/set service XXX protocol tcp XXXXXX /*全局关闭一些ALG，初上线时必须按照如下设置*/unset alg sip enableunset alg mgcp enable

25、unset alg sccp enableunset alg sunrpc enableunset alg msrpc enableunset alg sql enableunset alg rtsp enableunset alg h323 enable/*认证和管理员属性的一些默认设置*/set auth-server Local id 0set auth-server Local server-name Localset auth default auth server Localset auth radius accounting port 1646set admin name net

26、screenset admin password nKVUM2rwMUzPcrkG5sWIHdCtqkAibnset admin auth timeout 10set admin auth server Localset admin format dos/*设置安全区所属的虚拟路由器，实际上我们用到的只有Trust和Untrust两个zone,把这两个zone都放进Untrust-VR*/set zone Trust vrouter untrust-vr set zone Untrust vrouter untrust-vrset zone DMZ vrouter untrust-vrset

27、zone VLAN vrouter trust-vrset zone Untrust-Tun vrouter trust-vr/*Zone内的一些安全设置，关闭一些可能带来连通性问题的安全设置。*/unset zone Trust tcp-rst unset zone Untrust block unset zone Untrust tcp-rst unset zone DMZ tcp-rst set zone VLAN block unset zone VLAN tcp-rst /*为保证连通性，牺牲一些安全性，关闭一些抗网络层攻击功能*/unset zone Untrust screen

28、tear-dropunset zone Untrust screen syn-floodunset zone Untrust screen ping-deathunset zone Untrust screen ip-filter-srcunset zone Untrust screen landunset zone V1-Untrust screen tear-dropunset zone V1-Untrust screen syn-floodunset zone V1-Untrust screen ping-deathunset zone V1-Untrust screen ip-filt

29、er-srcunset zone V1-Untrust screen land/*把e1/1和e1/2两个口放到HA zone里，做HA口使用，用反绞线直接连接，不要通过交换机连接*/set interface ethernet1/1 zone HAset interface ethernet1/2 zone HA/*把e2/1放untrust zone里，把e2/2放trust zone里set interface ethernet2/1 zone Untrustset interface ethernet2/2 zone Trustunset interface vlan1 ip/*设置M

30、GT口的IP地址，用MGT做带外管理*/set interface mgt ip 192.168.1.1/24/*设置接口IP地址，注意接口模式为route模式*/set interface ethernet2/1 ip 52.0.224.68/28set interface ethernet2/1 routeset interface ethernet2/2 ip 52.0.224.84/28set interface ethernet2/2 routeunset interface vlan1 bypass-others-ipsecunset interface vlan1 bypass-

31、non-ipset interface ethernet2/1 ip manageableset interface ethernet2/2 ip manageableset interface ethernet2/1 manage pingunset interface ethernet2/2 manage snmpunset interface ethernet2/2 manage ssl/*设置Flow的一些参数，这里尤其需要注意*/set flow tcp-rst-invalid-sessionunset flow tcp-syn-checkunset flow tcp-syn-bit

32、-checkset flow reverse-route clear-text preferset flow reverse-route tunnel alwaysset hostname HB_SRV_FW_1set pki authority default scep mode autoset pki x509 default cert-path partial/*HA属性的一些设置*/set nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror routeset nsrp rto-mirror session ageou

33、t-ackset nsrp vsd-group id 0 priority 50set nsrp secondary-path ethernet2/2set nsrp vsd-group id 0 monitor interface ethernet2/1set nsrp vsd-group id 0 monitor interface ethernet2/2/*地址对象设置*/set address Trust 52.0.44.23/32 52.0.44.23 255.255.255.255set address Untrust 166.166.1.1/32 166.166.1.1 255.

34、255.255.255set ike respond-bad-spi 1unset ike ikeid-enumerationunset ike dos-protectionunset ipsec access-session enableset ipsec access-session maximum 5000set ipsec access-session upper-threshold 0set ipsec access-session lower-threshold 0set ipsec access-session dead-p2-sa-timeout 0unset ipsec ac

35、cess-session log-errorunset ipsec access-session info-exch-connectedunset ipsec access-session use-error-logset vrouter untrust-vrexitset vrouter trust-vrexitset icap av-vendor-id symantec-5set url protocol websenseexit/*访问控制策略的设置，各分行灵活自定义，注意最后留两条保底策略*/set policy id 1 from Trust to Untrust Any Any A

36、NY permit set policy id 1exitset policy id 2 from Untrust to Trust Any Any ANY permit set policy id 2exitset nsmgmt bulkcli reboot-timeout 60set ssh version v2set config lock timeout 5unset license-key auto-updateset ntp server 0.0.0.0set ntp server backup1 0.0.0.0set ntp server backup2 0.0.0.0set s

37、nmp port listen 161set snmp port trap 162/*静态路由设置，各分行自定义*/set vrouter untrust-vrset route 0.0.0.0/0 interface ethernet2/1 gateway 52.0.224.65 preference 20set route 52.0.45.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.46.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.34

38、.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.191.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.192.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.130.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.76.0/24 interface ethernet2/2 gateway 52.0.

39、224.81set route 52.0.0.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.8.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.16.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.12.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.105.0/24 interface ethern

40、et2/2 gateway 52.0.224.81set route 52.0.108.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.32.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.33.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.44.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.141

41、.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.159.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.161.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.171.0/24 interface ethernet2/2 gateway 52.0.224.81set route 52.0.40.0/24 interface ethernet2/2 gateway 52.0.

42、224.81set route 52.0.30.4/32 interface ethernet2/2 gateway 52.0.224.81exitset vrouter trust-vrunset add-default-routeset route 0.0.0.0/0 interface mgt gateway 192.168.1.254 preference 20exitset vrouter untrust-vrexitset vrouter trust-vrexit备防火墙配置：（备防火墙只有在MGT和NSRP方面的设置与主防火墙不同，其它配置都是自动同步的）set clock ds

43、t-offset clock timezone 8set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00set vrouter trust-vr sharableset vrouter untrust-vrexitset vrouter trust-vrunset auto-route-exportexitset service XXX protocol tcp XXXXXX unset alg sip enableunset alg mgcp enableunset alg sccp enableu

44、nset alg sunrpc enableunset alg msrpc enableunset alg sql enableunset alg rtsp enableunset alg h323 enableset auth-server Local id 0set auth-server Local server-name Localset auth default auth server Localset auth radius accounting port 1646set admin name netscreenset admin password nKVUM2rwMUzPcrkG

45、5sWIHdCtqkAibnset admin auth timeout 10set admin auth server Localset admin format dosset zone Trust vrouter untrust-vrset zone Untrust vrouter untrust-vrset zone DMZ vrouter untrust-vrset zone VLAN vrouter trust-vrset zone Untrust-Tun vrouter trust-vrunset zone Trust tcp-rst unset zone Untrust bloc

46、k unset zone Untrust tcp-rst unset zone DMZ tcp-rst set zone VLAN block unset zone VLAN tcp-rst unset zone Untrust screen tear-dropunset zone Untrust screen syn-floodunset zone Untrust screen ping-deathunset zone Untrust screen ip-filter-srcunset zone Untrust screen landunset zone V1-Untrust screen

47、tear-dropunset zone V1-Untrust screen syn-floodunset zone V1-Untrust screen ping-deathunset zone V1-Untrust screen ip-filter-srcunset zone V1-Untrust screen landset interface ethernet1/1 zone HAset interface ethernet1/2 zone HAset interface ethernet2/1 zone Untrustset interface ethernet2/2 zone Trus

48、tunset interface vlan1 ipset interface mgt ip 192.168.1.2/24set interface ethernet2/1 ip 52.0.224.68/28set interface ethernet2/1 routeset interface ethernet2/2 ip 52.0.224.84/28set interface ethernet2/2 routeunset interface vlan1 bypass-others-ipsecunset interface vlan1 bypass-non-ipset interface et

49、hernet2/1 ip manageableset interface ethernet2/2 ip manageableset interface ethernet2/1 manage pingunset interface ethernet2/2 manage snmpunset interface ethernet2/2 manage sslset flow tcp-rst-invalid-sessionunset flow tcp-syn-checkunset flow tcp-syn-bit-checkset flow reverse-route clear-text prefer

50、set flow reverse-route tunnel alwaysset hostname HB_SRV_FW_2set pki authority default scep mode autoset pki x509 default cert-path partialset nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror routeset nsrp rto-mirror session ageout-ackset nsrp vsd-group id 0 priority 100set nsrp secondary

51、-path ethernet2/2set nsrp vsd-group id 0 monitor interface ethernet2/1set nsrp vsd-group id 0 monitor interface ethernet2/2set address Trust 52.0.44.23/32 52.0.44.23 255.255.255.255set address Untrust 166.166.1.1/32 166.166.1.1 255.255.255.255set ike respond-bad-spi 1unset ike ikeid-enumerationunset

52、 ike dos-protectionunset ipsec access-session enableset ipsec access-session maximum 5000set ipsec access-session upper-threshold 0set ipsec access-session lower-threshold 0set ipsec access-session dead-p2-sa-timeout 0unset ipsec access-session log-errorunset ipsec access-session info-exch-connected

53、unset ipsec access-session use-error-logset vrouter untrust-vrexitset vrouter trust-vrexitset icap av-vendor-id symantec-5set url protocol websenseexitset policy id 1 from Trust to Untrust Any Any ANY permit set policy id 1exitset policy id 2 from Untrust to Trust Any Any ANY permit set policy id 2exitset nsmgmt bulkcli reboot-timeout 60set ssh version v2set config lock timeout 5unset license-key auto-updateset ntp server 0.0.0.0set nt