一、Source NAT

對(duì)于不需要做NAT的網(wǎng)段（比如IPSec×××），需要先關(guān)閉這些地址的NAT（如果沒(méi)有則跳過(guò)）

成都創(chuàng)新互聯(lián)公司主要從事成都網(wǎng)站設(shè)計(jì)、成都網(wǎng)站建設(shè)、網(wǎng)頁(yè)設(shè)計(jì)、企業(yè)做網(wǎng)站、公司建網(wǎng)站等業(yè)務(wù)。立足成都服務(wù)漣源,十載網(wǎng)站建設(shè)經(jīng)驗(yàn),價(jià)格優(yōu)惠、服務(wù)專(zhuān)業(yè),歡迎來(lái)電咨詢(xún)建站服務(wù):028-86922220

set security nat source rule-set trust-untrust rule no-nat match source-address 192.168.0.0/16

set security nat source rule-set trust-untrust rule no-nat match destination-address 10.10.0.0/24

set security nat source rule-set trust-untrust rule no-nat then source-nat off

對(duì)于需要上網(wǎng)或者所有的網(wǎng)段（做地址轉(zhuǎn)換的網(wǎng)段），做source-nat

首先定義一個(gè)地址池（要轉(zhuǎn)換的公網(wǎng)地址）：

set security nat source pool natpool1?address 112.48.20.11/32 to 112.48.20.15/32

set security nat source pool natpool2 address 112.48.20.21/32 to 112.48.20.30/32

配置NAT規(guī)則匹配源、目、轉(zhuǎn)換地址池

set security nat source rule-set trust-untrust from zone trust

set security nat source rule-set trust-untrust to zone untrust

//匹配特定的地址進(jìn)行轉(zhuǎn)換（沒(méi)有特定可省略）

set security nat source rule-set trust-untrust rule nat1?match source-address 0.0.0.0/0

set security nat source rule-set trust-untrust rule nat1?match destination-address 183.253.58.253/32

set security nat source rule-set trust-untrust rule nat1?then source-nat pool natpool1

//默認(rèn)所有的源、目地址進(jìn)行轉(zhuǎn)換

set security nat source rule-set trust-untrust rule nat2?match source-address 0.0.0.0/0

set security nat source rule-set trust-untrust rule nat2?match destination-address 0.0.0.0/0

set security nat source rule-set trust-untrust rule nat2?then source-nat pool natpool2

如果NAT地址池有多個(gè)地址，除了接口地址，那么其它地址需要做proxy-arp

set security nat proxy-arp interface ge-0/0/0.0 address 112.48.20.11/32 to 112.48.20.15/32

set security nat proxy-arp interface ge-0/0/0.0 address 112.48.20.21/32 to 112.48.20.30/32

做完這些就可以了？ NO！ NO！ NO！防火墻域間策略不能忘

//首先定義兩個(gè)地址池，并加入到地址組NET中

set security zones security-zone trust address-book address192.168.100.0?192.168.100.0/24

set security zones security-zone trust address-book address192.168.200.0?192.168.200.0/24

set security zones security-zone trust address-book address-setNET?address192.168.100.0

set security zones security-zone trust address-book address-setNET?address192.168.200.0

//將地址組匹配到trust到untrust的策略中，并放行

set security policies from-zone trust to-zone untrust policy1?match source-addressNET

set security policies from-zone trust to-zone untrust policy1?match destination-address any

set security policies from-zone trust to-zone untrust policy1?match application any

set security policies from-zone trust to-zone untrust policy1?then permit

到此，這192.168.100.0和192.168.200.0就可以通過(guò)NAT上網(wǎng)了

二、Destination NAT

部分服務(wù)器需要映射到公網(wǎng)去，怎么做呢？那么往下看：

//首先創(chuàng)建要映射的服務(wù)器地址池（包括IP地址和端口）

set security nat destination pool1?address 192.168.168.168/32

set security nat destination pool1?address port 443

//創(chuàng)建Destination NAT規(guī)則要映射的服務(wù)器地址池（包括IP地址和端口）

set security nat destination rule-set desnat from zoneuntrust

set security nat destination rule-set desnatto?zone trust

set security nat destination rule-set desnat ruleserver1?match source-address 0.0.0.0/0

//匹配訪問(wèn)112.48.20.2的4430端口轉(zhuǎn)換到內(nèi)網(wǎng)服務(wù)器的443端口

set security nat destination rule-set desnat ruleserver1 match destination-address 112.48.20.2/32

set security nat destination rule-set desnat ruleserver1 match destination-port4430

set security nat destination rule-set desnat ruleserver1 then destination-nat pool 1

還有必不可少的防火墻域間策略

//創(chuàng)建內(nèi)網(wǎng)服務(wù)器地址組及端口

set security zones security-zone trust address-book addressserver1?192.168.168.168/32

set applications application Service_4430?term Service_4430 protocol tcp

set applications application Service_4430 term Service_4430 source-port 0-65535

set applications application Service_4430 term Service_4430 destination-port4430-4430

//創(chuàng)建untrust到trust的策略，目前地址匹配內(nèi)網(wǎng)服務(wù)器地址及端口

set security policies from-zone untrust to-zone trust policy1?match source-address any

set security policies from-zone untrust to-zone trust policy1?match destination-addressserver1

set security policies from-zone untrust to-zone trust policy1?match application Service_4430

set security policies from-zone untrust to-zone trust policy1?then permit

至此，外網(wǎng)就可以使用http://112.48.20.2:4430/訪問(wèn)內(nèi)網(wǎng)的服務(wù)器了

還有一個(gè)問(wèn)題，此時(shí)內(nèi)網(wǎng)的用戶(hù)卻不能使用這個(gè)公網(wǎng)地址訪問(wèn)內(nèi)部的服務(wù)器，這個(gè)需要在NAT上再做一個(gè)內(nèi)部的地址轉(zhuǎn)換，如下：

//創(chuàng)建一個(gè)源地址映射的地址池（內(nèi)部服務(wù)器映射的地址）

set security nat source pool sorpool4 address 112.48.20.2/32

//創(chuàng)建trust到trust的策略如下

set security nat source rule-set trust-trust from zone trust

set security nat source rule-set trust-trust to zone trust

set security nat source rule-set trust-trust ruleserver1?match source-address 0.0.0.0/0

set security nat source rule-set trust-trust ruleserver1?match destination-address192.168.168.168/32

set security nat source rule-set trust-trust rule?server1 match destination-port443

set security nat source rule-set trust-trust rule server1 then source-nat pool sorpool4

至此，內(nèi)網(wǎng)也可以通過(guò)公網(wǎng)地址訪問(wèn)內(nèi)部服務(wù)器了?。。?/p>

如有雷同，純屬巧合，歡迎指正！

另外有需要云服務(wù)器可以了解下創(chuàng)新互聯(lián)cdcxhl.cn，海內(nèi)外云服務(wù)器15元起步，三天無(wú)理由+7*72小時(shí)售后在線，公司持有idc許可證，提供“云服務(wù)器、裸金屬服務(wù)器、高防服務(wù)器、香港服務(wù)器、美國(guó)服務(wù)器、虛擬主機(jī)、免備案服務(wù)器”等云主機(jī)租用服務(wù)以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡(jiǎn)單易用、服務(wù)可用性高、性?xún)r(jià)比高”等特點(diǎn)與優(yōu)勢(shì)，專(zhuān)為企業(yè)上云打造定制，能夠滿(mǎn)足用戶(hù)豐富、多元化的應(yīng)用場(chǎng)景需求。

文章標(biāo)題：JuniperSRX550防火墻NAT配置-創(chuàng)新互聯(lián)
標(biāo)題URL：http://weahome.cn/article/pocoi.html