SRX3400安全配置

1、1.1. 安全域zone配置Zone是共享相同安全级别的一组网络接口的集合。SRX3K/5K的所有接口默认都放在null zone内。Null zone是一种系统预定义的特殊的安全域，null zone内的接口不能接受外界的任何报文，也不能对外发送任何报文，即null zone内的接口是不参与业务转发的。因此要配置安全策略，必须先创建zone，并把接口分配到相应的zone里去配置举例：1. 创建安全域zoneset security zones security-zone trustset security zones security-zone untrust 2. 分配接口到相应安全域zo

2、neset security zones security-zone trust interfaces ge-0/0/0.0set security zones security-zone untrust interfaces ge-0/0/1.0每个安全域都有自己的一套自定义属性，包括是否允许接受管理流量？接受那些类型的管理流量？是否接受路由信令？接受那些路由信令等？这些都是在security zone下面相应zone的host-inbound-traffic里配置。SRX自己发出去的流量是不受限制的。配置举例：3. 允许trust zone接受telnet/ssh管理流量set secur

3、ity zones security-zone trust host-inbound-traffic system-services sshset security zones security-zone trust host-inbound-traffic system-services telnet4. 允许trust zone接受ospf/bgp路由信令set security zones security-zone trust host-inbound-traffic protocols ospfset security zones security-zone trust host-i

4、nbound-traffic protocols bgp每个zone还可以定义自己的DDoS防护选项，这是通过Screen配置来实现的5. 定义Screen的ips-options模板testset security screen ids-option test icmp fragmentset security screen ids-option test icmp floodset security screen ids-option test tcp port-scanset security screen ids-option test tcp syn-floodset securit

5、y screen ids-option test tcp landset security screen ids-option test tcp winnukeset security screen ids-option test udp flood6. 在security zone上引用Screen的ips-options模板testset security zones security-zone trust screen test1.2. 安全域zone的地址本配置SRX安全策略里不能直接使用IPv4/IPv6的prefix作为策略匹配的源地址和目标地址，必须先在相关zone的地址本里创建

6、地址本对象，再在安全策略里引用这些对象。配置举例：set security zones security-zone trust address-book address internal-/24 /24set security zones security-zone untrust address-book address webserver 9/32address-book还支持创建address-set来包含多个离散的地址，以方便策略引用1.3. application配置SRX安全策略里不允许直接使用协议号，源端口，目标

7、端口来匹配业务应用，只能使用application下系统预定义的应用类型或用户自定义的业务类型。系统预定义的业务类型名字都是以”junos-“开头的。Application同样允许通过定义application-set来包含多个application，以方便策略引用。配置举例：set applications application http8080 protocol tcpset applications application http8080 source-port 1-65535set applications application http8080 destination-port

8、 8080或applications application http8080 protocol tcp; source-port 1-65535; destination-port 8080; 1.4. 安全策略配置SRX的安全策略配置里必须包含以下要素：l From-zonel To-zonel Policy namel Match source-addressl Match destination-addressl Match applicationl Then action(permit,deny,log,idp policy等等)配置举例：set security policies

9、from-zone trust to-zone untrust policy 1020 match source-address internal-/24set security policies from-zone trust to-zone untrust policy 1020 match destination-address webserverset security policies from-zone trust to-zone untrust policy 1020 match application http8080set security polici

10、es from-zone trust to-zone untrust policy 1020 match application junos-httpset security policies from-zone trust to-zone untrust policy 1020 then permitset security policies from-zone trust to-zone untrust policy 1020 then log session-close或labsrx210# show security policies from-zone trust to-zone u

11、ntrust policy 1020 match source-address internal-/24; destination-address webserver; application http8080 junos-http ; then permit; log session-close; 2. SRX NAT配置介绍SRX的NAT配置与ScreenOS显著不同，为保证系统的灵活性，SRX把NAT配置从安全策略里剥离出来，单独成为一个层次：即在SRX JUNOS中安全策略只负责控制业务数据的转发与否，NAT策略只控制业务数据的源地址和端口的翻译规则，两者各自独立

12、。SRX的NAT配置分为源地址翻译(source NAT), 目标地址翻译(destination NAT)和静态地址翻译(static NAT)三种，其配置语法都类似，只是nat rule必须被放到rule-set里使用，任意两个zone或任意两个网络逻辑接口之间只允许有一个rule-set。值得注意的是SRX不会自动为NAT规则生成proxy-arp配置，因此如果NAT地址翻译之后的地址跟出向接口地址不同但在同一网络内时，必须手工配置相应接口proxy-arp以代理相关IP地址的ARP查询回应，否则下一条设备会由于不能通过ARP得到NAT地址的MAC地址而不能构造完整的二层以太网帧头导致通

13、信失败。配置举例：set security nat source rule-set src-nat from zone trustset security nat source rule-set src-nat to zone untrustset security nat source rule-set src-nat rule src-1 match source-address /24set security nat source rule-set src-nat rule src-1 then source-nat interfaceset security na

14、t destination pool 10-26-105-172-p1812 address 72/32set security nat destination pool 10-26-105-172-p1812 address port 1812set security nat destination rule-set dst-nat from zone ggsnset security nat destination rule-set dst-nat rule 30 match destination-address 73/32set security

15、nat destination rule-set dst-nat rule 30 match destination-port 1645set security nat destination rule-set dst-nat rule 30 then destination-nat pool 10-26-105-172-p1812set security nat destination rule-set dst-nat rule 40 match destination-address 73/32set security nat static rule-set static

16、from zone cmnetset security nat static rule-set static rule static-10 match destination-address 7/32set security nat static rule-set static rule static-10 then static-nat prefix 70/32set security nat proxy-arp interface reth2.0 address 7/32set security nat proxy-ar

17、p interface reth0.0 address 73/32或labsrx210# show security nat source rule-set src from zone trust; to zone cmnet; rule src-10 match source-address /0; then source-nat interface; destination pool 10-26-105-172-p1812 address 72/32 port 1812; rule-set dst-nat from zone ggsn; rule 30 match destination-address 73/32; destination-port 1645; then desti