NetscreenJuniper防火墙VPN配置说明Word文档下载推荐.docx

NetscreenJuniper防火墙VPN配置说明Word文档下载推荐.docx

《NetscreenJuniper防火墙VPN配置说明Word文档下载推荐.docx》由会员分享，可在线阅读，更多相关《NetscreenJuniper防火墙VPN配置说明Word文档下载推荐.docx（31页珍藏版）》请在冰豆网上搜索。

概述

网络防火墙Nescreen208

1

IDC主过滤防火墙

网络防火墙Netscreen50B

2

IDC\办公区VPN端设备

网络防火墙Netscreen5GT

办公网VPN端设备

机房连接使用的防火墙设备列表

１

IDC

3.需求说明

我们的防火墙主要有两个大的用途：

1．将内部的Web服务器向外提供映射及IDC服务器出局访问

2．VPN互通

在上面的列表中，netscreen208主要用向外映射WEB服务器及控制IDC服务器出局访问

50B主要用于与办公网5GT的VPN互通

4.配置说明

4.1.Netscreen208配置说明

映射说明：

setinterfaceethernet1vip211.144.149.1125"

MAIL"

172.16.12.8　　　＃映射25端口

setinterfaceethernet1vip211.144.149.11+80"

HTTP"

172.16.12.8　　＃映射80端口

setinterfaceethernet1vip211.144.149.11+110"

POP3"

172.16.12.8＃映射110端口

setinterfaceethernet1vip211.144.149.1280"

172.16.1.21＃映射80端口网站

setinterfaceethernet1vip211.144.149.1380"

172.16.1.23　　＃映射80端口网站

setinterfaceethernet1vip211.144.149.1480"

172.16.4.14　　　　＃映射80端口网站

策略说明：

setpolicyid1name"

webnat"

from"

Trust"

to"

Untrust"

"

172.16.1.1/25"

Any"

permit

setpolicyid1

setservice"

ICMP-ANY"

exit

＃内网所有出局80及icmp访问均可

setpolicyid3name"

smtp"

network"

ANY"

setpolicyid3

setsrc-address"

network2"

＃允许内网地址network（172.16.12.9）网管服务器及network2（172.16.12.8）邮件服务器全部访问出局

setpolicyid5from"

Global"

VIP（211.144.149.11）"

permitlog

setpolicyid5

SMTP"

＃允许外部访问VIP（211.144.149.11）mail/web服务

setpolicyid6from"

VIP（211.144.149.12）"

setpolicyid6

＃允许外部访问VIP（211.144.149.12）web服务

setpolicyid7from"

VIP（211.144.149.13）"

setpolicyid7

＃允许外部访问VIP（211.144.149.13）web服务

setpolicyid8from"

VIP（211.144.149.14）"

setpolicyid8

＃允许外部访问VIP（211.144.149.14）web服务

setpolicyid9from"

172.16.4.14/32"

setpolicyid9

＃暂时不生效

setpolicyid10from"

172.16.1.25"

211.144.158.218/32"

setpolicyid10

setpolicyid11from"

MIP（211.144.149.6）"

setpolicyid11

＃暂时不生效，以后用于主从DNS服务器

setpolicyid12name"

deny"

203.196.128.49/32"

denylog

setpolicyid12

4.2.Netscreen50B配置说明（国研机房）

50B主要是用于跟办公网的VPN通信，主要是用于VPN策略

详细配置说明相对较复杂，我们只在附表中给出配置文件。

4.3.Netscreen5gt配置说明（办公网）

5GT主要是用于跟国研机房的VPN通信，主要是用于VPN策略

5.配置附表

5.1.Netscreen208

setclocktimezone7

setvroutertrust-vrsharable

setvrouter"

untrust-vr"

trust-vr"

unsetauto-route-export

8080"

protocoltcpsrc-port0-65535dst-port8080-8080

setauth-server"

Local"

id0

server-name"

setauthdefaultauthserver"

setauthradiusaccountingport1646

setadminname"

testadmin"

setadminpassword"

nGV2PirHHhcNcrOM9sTB+rJt/6OPrn"

setadminport8000

setadminauthtimeout10

setadminauthserver"

setadminformatdos

setzone"

vrouter"

DMZ"

VLAN"

Untrust-Tun"

tcp-rst

block

unsetzone"

MGT"

screentear-drop

screensyn-flood

screenping-death

screenip-filter-src

screenland

V1-Untrust"

screenlimit-sessionsource-ip-based1000

screenlimit-sessiondestination-ip-based1000

screensyn-ack-ackthreshold1000

setinterface"

ethernet1"

zone"

ethernet2"

ethernet3"

unsetinterfacevlan1ip

setinterfaceethernet1ip211.144.149.2/25

setinterfaceethernet1route

setinterfaceethernet2ip172.16.1.2/24

setinterfaceethernet2nat

unsetinterfacevlan1bypass-others-ipsec

unsetinterfacevlan1bypass-non-ip

setinterfaceethernet1ipmanageable

setinterfaceethernet2ipmanageable

setinterfaceethernet1managessh

setinterfaceethernet1managessl

172.16.12.8

172.16.1.21

172.16.1.23

172.16.4.14

mip211.144.149.6host172.16.1.25netmask255.255.255.255vr"

unsetflowno-tcp-seq-check

setflowtcp-syn-check

setaddress"

172.16.1.1255.255.255.128

172.16.1.25255.255.255.255

172.16.12.0/24"

172.16.12.0255.255.255.0

172.16.4.14255.255.255.255

bbs"

172.16.12.9255.255.255.255

172.16.12.10255.255.255.255

172.16.12.8255.255.255.255

203.196.128.49255.255.255.255

211.144.158.218255.255.255.255

setikerespond-bad-spi1

unsetikeikeid-enumeration

unsetikedos-protection

unsetipsecaccess-sessionenable

setipsecaccess-sessionmaximum5000

setipsecaccess-sessionupper-threshold0

setipsecaccess-sessionlower-threshold0

setipsecaccess-sessiondead-p2-sa-timeout0

unsetipsecaccess-sessionlog-error

unsetipsecaccess-sessioninfo-exch-connected

unsetipsecaccess-sessionuse-error-log

seturlprotocolwebsense

setpkiauthoritydefaultscepmode"

auto"

setpkix509defaultcert-pathpartial

setsyslogconfig"

172.16.12.9"

facilitieslocal0local0

setsyslogsrc-interfaceethernet2

setsyslogenable

unsetlogmodulesystemlevelnotificationdestinationsyslog

unsetlogmodulesystemlevelinformationdestinationsyslog

unsetlogmodulesystemleveldebuggingdestinationsyslog

setnsmgmtbulkclireboot-timeout60

setsshversionv2

setsshenable

setconfiglocktimeout5

setsnmpcommunity"

testsnmp"

Read-WriteTrap-ontrafficversionv2c

setsnmphost"

172.16.12.9255.255.255.255src-interfaceethernet2trapv2

192.168.21.102255.255.255.255src-interfaceethernet2trapv2

setsnmpname"

uns208"

setsnmpportlisten161

setsnmpporttrap162

unsetadd-default-route

setroute172.16.12.0/24interfaceethernet2gateway172.16.1.1preference20

setroute0.0.0.0/0interfaceethernet1gateway211.144.149.1preference20

setroute192.168.0.0/16interfaceethernet2gateway172.16.1.3preference20

setroute172.16.4.14/32interfaceethernet2gateway172.16.1.1preference20

5.2.Netscreen50B

5222"

protocoltcpsrc-port0-65535dst-port5222-5222

6664"

protocoltcpsrc-port0-65535dst-port6664-6664

t