172.18.18.42 port 2020、2009 ISP_IP Port XXXX、XXXX
172.18.18.45 port 2020、2009 ISP_IP Port XXXX、XXXX

專業(yè)成都網(wǎng)站建設(shè)公司，做排名好的好網(wǎng)站，排在同行前面，為您帶來(lái)客戶和效益!創(chuàng)新互聯(lián)建站為您提供成都網(wǎng)站建設(shè)，五站合一網(wǎng)站設(shè)計(jì)制作，服務(wù)好的網(wǎng)站設(shè)計(jì)公司，成都網(wǎng)站設(shè)計(jì)、網(wǎng)站建設(shè)負(fù)責(zé)任的成都網(wǎng)站制作公司!

步驟一：定義全局地址
set security address-book global address Nutanix_Cluster 172.18.18.50/32
步驟二：定義協(xié)議端口
set applications application tcp-2020 protocol tcp
set applications application tcp-2020 destination-port 2020
set applications application tcp-2009 protocol tcp
set applications application tcp-2009 destination-port 2009
步驟三：定義目的NAT+Port之定義內(nèi)網(wǎng)IP匹配端口
set security nat destination pool DP_Nutanix_Cluster_2020 address 172.18.18.50/32
set security nat destination pool DP_Nutanix_Cluster_2020 address port 2020
set security nat destination pool DP_Nutanix_Cluster_2009 address 172.18.18.50/32
set security nat destination pool DP_Nutanix_Cluster_2009 address port 2009
步驟三：定義目的NAT+Port之定義內(nèi)外網(wǎng)NAT規(guī)則
set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_Nutanix_2020_Owenli match destination-address-name WAN3006_162
set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_Nutanix_2020_Owenli match destination-port 2020
set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_Nutanix_2020_Owenli then destination-nat pool DP_Nutanix_Cluster_2020
set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_Nutanix_2009_Owenli match destination-address-name WAN3006_162
set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_Nutanix_2009_Owenli match destination-port 2009
set security nat destination rule-set DNAT_FROM_ISP6 rule ISP6_TO_Nutanix_2009_Owenli then destination-nat pool DP_Nutanix_Cluster_2009

步驟四：定義源區(qū)域訪問(wèn)內(nèi)網(wǎng)特定區(qū)域的控制策略
set security policies from-zone ISP6 to-zone trust policy Nutanix_Cluster-OWEN-EDIT match source-address any destination-address Nutanix_Cluster application tcp-2020 application tcp-2009
set security policies from-zone ISP6 to-zone trust policy Nutanix_Cluster-OWEN-EDIT then permit
set security policies from-zone ISP6 to-zone trust policy Nutanix_Cluster-OWEN-EDIT then log session-init
set security policies from-zone ISP6 to-zone trust policy Nutanix_Cluster-OWEN-EDIT then log session-close
set security policies from-zone ISP6 to-zone trust policy Nutanix_Cluster-OWEN-EDIT then count
步驟五：新定義之策略插入拒絕策略之前，即調(diào)整策略優(yōu)先順序
insert security policies from-zone ISP6 to-zone trust policy Nutanix_Cluster-OWEN-EDIT before policy DENY

set security policies from-zone trust to-zone ISP6 policy Nutanix_Cluster-OWEN-EDIT match source-address Nutanix_Cluster destination-address any application tcp-2020 application tcp-2009
set security policies from-zone trust to-zone ISP6 policy Nutanix_Cluster-OWEN-EDIT then permit
set security policies from-zone trust to-zone ISP6 policy Nutanix_Cluster-OWEN-EDIT then log session-init
set security policies from-zone trust to-zone ISP6 policy Nutanix_Cluster-OWEN-EDIT then log session-close
set security policies from-zone trust to-zone ISP6 policy Nutanix_Cluster-OWEN-EDIT then count
步驟六：定義網(wǎng)段或特定IP從那條ISP線路訪問(wèn)外網(wǎng)資源

INGRESS_FROM_TRUST---- 在內(nèi)網(wǎng)接口應(yīng)用過(guò)濾器filter [reth4.500 zone trust]

set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from source-address 172.18.18.45/32
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from source-address 172.18.18.50/32
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from source-address 172.18.18.42/32
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from source-address 172.18.18.48/32
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from source-address 172.18.18.52/32
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from source-address 172.18.18.55/32
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from source-address 172.18.18.58/32
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster from destination-address 0.0.0.0/0
set firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster then routing-instance FORWARD_TO_ISP6
步驟七：新定義之firewall filter策略執(zhí)行 then acceppt，若之前已有跳至步驟八；
set firewall family inet filter INGRESS_FROM_TRUST term ACCEPT_ALL then accept
步驟八：把步驟六插入步驟七之前，即調(diào)整策略優(yōu)先順序；
insert firewall family inet filter INGRESS_FROM_TRUST term Nutanix_Cluster before term ACCEPT_ALL
步驟九：查詢NAT會(huì)話，確定IN AND OUT雙向策略是否正確；

show security flow session nat destination-port 2020
node0:

Session ID: 91904, Policy name: LEGACY_ID_15/89, State: Backup, Timeout: 14342, Valid
In: 172.18.18.45/46082 --> 202.82.130.199/2020;tcp, If: reth4.500, Pkts: 0, Bytes: 0
Out: 202.82.130.199/2020 --> 119.145.16.241/24323;tcp, If: reth25.3001, Pkts: 0, Bytes: 0

Session ID: 234948, Policy name: Nutanix_Cluster-OWEN-EDIT/263, State: Backup, Timeout: 14292, Valid
In: 202.82.130.199/6688 --> 210.21.218.163/2020;tcp, If: reth25.3006, Pkts: 0, Bytes: 0
Out: 172.18.18.50/2020 --> 202.82.130.199/6688;tcp, If: reth4.500, Pkts: 0, Bytes: 0
Total sessions: 2