1,路由实例
路由实例是路由表,接口和路由协议参数的集合。通过设置接口及路由协议各种参数可以形成路由实例的路由表。
每个路由实例都有自己的实例名称,并且各自维护一张独立的路由表。
全局路由其实也是一个路由实例,其实例名称为inet。0。
2,普通静态策略路由(只做策略,不作NAT转换)
设置包括如下步骤:
1)设置应用接口子接口,定义为服务区域的入接口/出接口
2)定义路由实例,实例类型为转发,实例路由表
3)定义过滤器防火墙过滤
4)定义接口路由组rib集团;
5)将接口路由组导入到全局路由表及路由实例的路由表中,
6)在内网接口应用过滤器过滤
3,做NAT的静态策略路由(既做策略又做NAT转换)
注意:
1)该情况下需要试用virtual-router类型的路由实例
2)每个virtual-router维护一张独立的路由表
配置实例拓扑图
达到目的:
默认内网主机上网走数控2 m链路访问公网,指定的电脑走数控50米链路访问外网
实现思路:
默认内网所有主机通过全局路由表inet。0走数控2 m链路出局访问公网,部分指定的电脑通过Juniper SRX的巴西利亚足协收入囊中路由策略走路由实例的路由表出局访问公网
设置步骤如下:
1)定义服务区域区
配置示例:
设置安全区域安全区lt host-inbound-traffic系统服务所有
设置安全区域安全区lt host-inbound-traffic协议所有
2)设置应用接口子接口,定义为服务区域的入接口/出接口
配置示例:
设置安全区域安全区lt接口ge-0/0/2.0 host-inbound-traffic系统服务所有
设置安全区域安全区lt接口ge-0/0/2.0 host-inbound-traffic协议所有
3)定义路由实例,路由实例数量可根据接入的ISP线路数量来定义。实例类型为virtual-router,虚拟现实的虚拟接口,虚拟现实的路由表
配置示例:
设置routing-instances CNC50M实例类型virtual-router
设置routing-instances CNC50M接口ge-0/0/2.0
设置routing-instances CNC50M routing-options静态路由转发0.0.0.0/0 XX.XX.XX。XX ##指向ISP提供的公网网关
4）定义NAT的相关映射rule-set、rule，策略policy、address-book、application等
√Source NAT的rule-set 配置示例：
set security nat source rule-set CNC50M-snat-internet from zone trust
set security nat source rule-set CNC50M-snat-internet to zone lt
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside match source-address 0.0.0.0/0
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside match destination-address 0.0.0.0/0
set security nat source rule-set CNC50M-snat-internet rule CNC50M-inside-to-outside then source-nat interface
√ 策略policy 配置示例：
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match source-address CBGZ-out-norestrict
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match destination-address any
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet match application any
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then permit
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then log session-init
set security policies from-zone trust to-zone lt policy CNC50M-snat-internet then log session-close
5）定义过滤器filter
配置示例：
set firewall family inet filter filter-1 term LAN_term from destination-address 172.16.0.0/16
set firewall family inet filter filter-1 term LAN_term from destination-address 172.20.0.0/16
set firewall family inet filter filter-1 term LAN_term from destination-address 192.168.0.0/16
set firewall family inet filter filter-1 term LAN_term then accept ,# #允许内网电脑互访,不作以上配置将会导致网关为此防火墙内网接口的电脑无法访问内网其他电脑。
# #指定的电脑从数控50米链路出局访问公网
设置防火墙家庭inet从源地址过滤filter 1项CNC50M_term 172.16.29.25/32
设置防火墙家庭inet从源地址过滤filter 1项CNC50M_term 172.16.29.251/32
设置防火墙家庭inet从源地址过滤filter 1项CNC50M_term 172.16.28.166/32
