3juniper防火墙地址翻译学习

技术博客 、at-Dst、DIP、MIP、网 客 Copyright©2007JuniperNetworks, Proprietary

网 整理 技术博客

-based

e8:

Copyright©2007JuniperNetworks, Proprietaryand

网 整理 技术博客 DynamicIPA

B

E8primary:E8secondary:E8extended:

AspecifiedIPorrangeofIPaddressesusedforaddressDefinedonoutboundDIPrangemustbeinthesamesubnetrangeasTheinterfaceprimaryIPTheinterfacesecondaryIPTheinterfaceextendedIP©7tr,.dby onfidentialts 网 整理 技术博客 A

E8:B

•••••••• E

FTP

Web

DIPw/DIPw/

IP

Copyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 CreateDIP(ifused)1aPorttranslationon1bPorttranslationoff1cAddressshifting

E8:

ECopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 Step1:CreateDIP–PrivatePublicPublicPublicCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 Step1:CreateDIP-setinterface<name>dip<4-255><start_address>ns208>setinterfacee8dipForextendedaddresssetinterface<name>extip<address>/<mask>dip<4-255>address>[<endns208>setinterfacee8extip/24dip4Noportsetinterface<name>dip<4-255><start_address>[<end_address>]ns208>setinterfacee8dip54fix-Addresssetinterface<name>dip<4-255>shift-from<priv-<start_address>ns208>setinterfacee8dip5shift-fromCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 Step2:Copyright©2007JuniperNetworks, Proprietary

from<zone>to<zone><SA><DA><service>natsrc[dipidWithoutns208>fromPrivatetoExternalanyanyanynatsrcWithns208>fromPrivatetoExternalanyanyanynatsrcdip5网 整理 技术博客 VerifyingDIPgetDipDipDip4Port-xlateddipsticknessCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 VerifyingNAT-src-Copyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 VerifyingNAT-src-ns208-> idid1,namenone,fromzonePrivatetozoneactionPermit,status"enabled"src"Any",dst"Any",serv"ANY"Policieson tunnel:natsrcdip-id4,serv_timeout0 flag00,sessionbackup:trafficshap OFF,urlfilteringOFF,schedulern/a,servflag00logno,logcount0,alertno,counterno(0)rate(min/sec)0/0totaloctets2220,counter(session/packet/octet)0/0/0priority7,diffservmarkingOfftadapter:stateOFF,gbw/mbw0/-1NoAuthenticationNoUser,UserGrouporGroupexpressionns208->getalloc2/max128000,allocfailedid142/s**,vsys 1,time10(20):0/1024<-/512,1,0010db21c041,vlan0,tun0,vsdid143/s**,vsys 1,timeCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 MappedIP

=

One-to-onestaticmap NoportMIPsaredefinedonthe“public”MIPscanbedefinedinANYCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 MIPConfigurationDefineMIPon“public” to“invoke”=

Copyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 Step1:Definesetsetint<name>mip<publicIP>hostns208>setinte8mip5hostCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 Step2:Configure from<zone>to<zone><SA>MIP(<addr>)<service>Copyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 VerifyingMIPOperation-toMIPfromexternalfrominternalhosttoexternalPacketegressistheinterfacewheretheMIPisCopyright©2007JuniperNetworks, Proprietary

ns208->ns208->getalloc225/max128000,allocfailedid292/s**,vsys 2,time10(01):/1728->5/1024,1,0010db21c041,vlan0,vsd0,vsdns208->getalloc2/max128000,allocfailed0id38/s**,vsys0,flag 1,time网 整理 技术博客 VirtualIP-AB

FTP

Web ofIPMapsindividualportstodifferentinternalIPCanonlybeusedoninterfaceinUntrustVIPaddressmustbeinsamesubnetasinterfaceCopyright©2007JuniperNetworks, Proprietary

VIPVIP 网 整理 技术博客 VIPConfigurationDefineVIPoninterfaceinUntrust “invoking”A

BFTP

CWebCopyright©2007JuniperNetworks, Proprietary

VIPVIP 网 整理 技术博客 Step1:Definesetint<name>vip<publicIP><port><service>netftphttpCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 Step2: from<zone>to<zone><SA>VIP(<addr>)<service>ns208> fromuntrusttoprivateanyVIP(00)anyCopyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 VerifyingVIPNetwork>Interface>Edit>VIP/VIPns208->Virtual

Port 80 21 Copyright©2007JuniperNetworks, Proprietary

网 整理 技术博客 VerifyingVIPCopyright©2007JuniperNetworks, Proprietary

ns208->ns208->getalloc2/max128000,allocfailed0id38/s**,vsys0,flag 1,time11(01):/1262->00/8