ジュニパーネットワークスSRXシリーズおよびJシリーズのNAT（ScreenOSユーザー向け）

Size: px

Start display at page:

Download "ジュニパーネットワークスSRXシリーズおよびJシリーズのNAT（ScreenOSユーザー向け）"

とよみおおばま
3 years ago
Views:

4 SRX J Junos OS CLI Command-line Interface ScreenOS NAT CLI ScreenOS NAT Network Address Translation CLI NAT SRX J Junos OS NAT SRX J NAT ScreenOS NAT J2320 J2350 J4350 J6350 SRX 9.2 SRX 9.2 SRX 9.5 J SRX J NAT NAT IP NAT インターネット /24 SRX /24 1 NAT NAT IP Ethernet 0/0 untrust /24 Ethernet 0/1 trust /24 set policy id 1 from trust to untrust any any any nat src permit Copyright 2014, Juniper Networks, Inc. 1

5 set security nat source rule-set interface-nat from zone trust set security nat source rule-set interface-nat to zone untrust set security nat source rule-set interface-nat rule rule1 match source-address /0 destination-address /0 set security nat source rule-set interface-nat rule rule1 then source-nat interface set security policies from-zone trust to-zone untrust policy permit-all match source-address any destination-address any application any set security policies from-zone trust to-zone untrust policy permit-all then permit IP NAT / IP IP Ethernet 0/0 untrust /24 Ethernet 0/1 trust /24 set int e0/0 dip set policy id 1 from trust to untrust any any any nat src dip-id 4 permit set security nat source pool pool-1 address to set security nat source rule-set pool-nat from zone trust set security nat source rule-set pool-nat to zone untrust set security nat source rule-set pool-nat rule rule1 match source-address /0 destination-address /0 set security nat source rule-set pool-nat rule rule1 then source-nat pool pool-1 set security nat proxy-arp interface ge-0/0/0 address to set security policies from-zone trust to-zone untrust policy permit-all match source-address any destination-address any application any set security policies from-zone trust to-zone untrust policy permit-all then permit set int e0/0 dip fix-port set security nat source pool pool-1 address to set security nat source pool pool-1 port no-translation set security nat source rule-set pool-nat from zone trust set security nat source rule-set pool-nat to zone untrust set security nat source rule-set pool-nat rule rule1 match source-address /0 destination-address /0 set security nat source rule-set pool-nat rule rule1 then source-nat pool pool-1 set security policies from-zone trust to-zone untrust policy permit-all match source-address set security nat proxy-arp interface ge-0/0/0 address to any destination-address any application any set security policies from-zone trust to-zone untrust policy permit-all then permit 2 Copyright 2014, Juniper Networks, Inc.

6 IP NAT IP Ethernet 0/0 untrust /24 Ethernet 0/1 trust /24 set int e0/0 dip 4 shift-from to set security nat source pool pool-1 address to set security nat source pool pool-1 host-address-base set security nat source rule-set pool-nat from zone trust set security nat source rule-set pool-nat to zone untrust set security nat source rule-set pool-nat rule rule1 match source-address /0 destination-address /0 set security nat source rule-set pool-nat rule rule1 then source-nat pool pool-1 set security policies from-zone trust to-zone untrust policy permit-all match source-address set security nat proxy-arp interface ge-0/0/0 address to any destination-address any application any set security policies from-zone trust to-zone untrust policy permit-all then permit IP DIP NAT IP Ethernet 0/0 untrust Ethernet 0/1 trust Loopback.1 untrust /24 Ethernet 0/1 trust /24 インターネット SRX /24 2 DIP NAT set int e0/0 loopback-group lo.1 set int e0/2 loopback-group lo.1 set int loopback.1 dip set policy id 1 from trust to untrust any any any nat src dip-id 4 permit Copyright 2014, Juniper Networks, Inc. 3

7 set security nat source pool pool-1 address to set security nat source rule-set pool-nat from zone trust set security nat source rule-set pool-nat to interface ge-0/0/0 interface ge-0/0/2 set security nat source rule-set pool-nat rule rule1 match source-address /0 destination-address /0 set security nat source rule-set pool-nat rule rule1 then source-nat pool pool-1 set security policies from-zone trust to-zone untrust policy permit-all match source-address set security nat proxy-arp interface ge-0/0/0 address to set security nat proxy-arp interface ge-0/0/2 address to any destination-address any application any set security policies from-zone trust to-zone untrust policy permit-all then permit NAT インターネット /24 SRX /24 3 NAT IP IP NAT IP NAT IP IP set int e0/0 mip host set pol from untrust to trust any mip( ) http permit set security nat proxy-arp interface ge-0/0/0 address /32 set security nat static rule-set static-nat from zone untrust set security nat static rule-set static-nat rule rule1 match destination-address set security nat static rule-set static-nat rule rule1 then static-nat prefix set security zones security-zone trust address-book address webserver set security policies from-zone untrust to-zone trust policy static-nat match source-address any destination-address webserver application junos-http set security policies from-zone untrust to-zone trust policy static-nat then permit NAT IP IP / /28 4 Copyright 2014, Juniper Networks, Inc.

8 set int e0/0 mip host netmask set policy from untrust to trust any mip( /28) http permit set security zones security-zone trust address-book address webserver-group /28 set security nat proxy-arp interface ge-0/0/0 address /28 set security nat static rule-set static-nat from zone untrust set security nat static rule-set static-set rule rule1 match destination-address /28 set security nat static rule-set static-set rule rule1 then static-nat prefix /28 set security policies from-zone untrust to-zone trust policy static-nat match source-address any destination-address webserver-group application junos-http set security policies from-zone untrust to-zone trust policy static-nat then permit IP IP/ IP /80 HTTP /110 POP インターネット /24 SRX /24 4 IP VIP set int e0/0 vip http set int e0/0 vip pop set policy from untrust to trust any vip( ) http permit set security nat proxy-arp interface ge-0/0/0.0 address set security nat destination pool dnat-pool-1 address /32 set security nat destination pool dnat-pool-2 address /32 set security nat destination rule-set dst-nat from zone untrust set security nat destination rule-set dst-nat rule rule1 match destination-address /32 set security nat destination rule-set dst-nat rule rule1 match destination-port 80 set security nat destination rule-set dst-nat rule rule1 then destination-nat pool dnatpool-1 set security nat destination rule-set dst-nat rule rule2 match destination-address /32 set security nat destination rule-set dst-nat rule rule2 match destination-port 110 set security nat destination rule-set dst-nat rule rule2 then destination-nat pool dnatpool-2 set security zones security-zone trust address-book address webserver set security zones security-zone trust address-book address mailserver Copyright 2014, Juniper Networks, Inc. 5

9 set security zones security-zone trust address-book address-set servergroup address webserver set security zones security-zone trust address-book address-set servergroup address mailserver set security policies from-zone untrust to-zone trust policy static-nat match source-address any destination-address servergroup application junos-http set security policies from-zone untrust to-zone trust policy static-nat match application junos-pop3 set security policies from-zone untrust to-zone trust policy static-nat then permit NAT インターネット /24 SRX /24 5 NAT IP IP IP IP set route /32 int e0/1 set address trust webserver /32 set pol from untrust to trust any webserver http nat dst ip permit set security nat proxy-arp interface ge-0/0/0.0 address set security nat destination pool dnat-pool-1 address set security nat destination rule-set dst-nat from zone untrust set security nat destination rule-set dst-nat rule r1 match destination-address set security nat destination rule-set dst-nat rule r1 then destination-nat pool dnat-pool-1 set security zones security-zone trust address-book address webserver set security policies from-zone untrust to-zone trust policy dst-nat match source-address any destination-address webserver application junos-http set security policies from-zone untrust to-zone trust policy dst-nat then permit IP/ IP/ / / Copyright 2014, Juniper Networks, Inc.

10 set route /32 int e0/1 set address trust webserver /32 set policy from untrust to trust any webserver http nat dst ip port 8000 permit set security nat proxy-arp interface ge-0/0/0.0 address set security nat destination pool dnat-pool-1 address port 8000 set security nat destination rule-set dst-nat from zone untrust set security nat destination rule-set dst-nat rule r1 match destination-address set security nat destination rule-set dst-nat rule r1 then destination-nat pool dnat-pool-1 set security zones security-zone trust address-book address webserver set applications application http-8000 protocol tcp destination-port 8000 set security policies from-zone untrust to-zone trust policy dst-nat match source-address any destination-address webserver application http-8000 set security policies from-zone untrust to-zone trust policy dst-nat then permit IP IP IP IP set arp nat set address trust webserver /32 set pol from untrust to trust any webserver http nat dst ip permit set security nat destination pool dnat-pool-1 address /32 set security nat proxy-arp interface ge-0/0/0.0 address set security nat destination rule-set dst-nat from zone untrust set security nat destination rule-set dst-nat rule r1 match destination-address set security nat destination rule-set dst-nat rule r1 then destination-nat pool dnat-pool-1 set security policies from-zone untrust to-zone trust policy dst-nat match source-address any destination-address any application junos-http set security policies from-zone untrust to-zone trust policy dst-nat then permit Copyright 2014, Juniper Networks, Inc. 7

11 SRX J Junos OS CLI CLI NAT Twitter Facebook Juniper Networks, Inc. Juniper Networks International B.V F FAX URL North Mathilda Ave Sunnyvale, CA USA 888-JUNIPER ( ) FAX URL Boeing Avenue PZ Schiphol-Rijk Amsterdam, The Netherlands FAX Copyright 2014, Juniper Networks, Inc. All rights reserved. Juniper Networks Junos QFabric Juniper Networks Juniper Networks, Inc JP Apr Copyright 2014, Juniper Networks, Inc.

SRXシリーズおよびJシリーズのネットワークアドレス変換

SRXシリーズおよびJシリーズのネットワークアドレス変換 APPLICATION NOTE SRX J SRX J NAT Copyright 2014, Juniper Networks, Inc. ...1...1...1... 1... 1...1... 1...2 NAT...3 NAT...4 NAT...4 NAT...5 NAT...6 NAT...7....7 NAT....7 NAT...7 NAT....8 NAT....8 NAT...9