IX2015、CISCO1812に続いて、SRX210の設定サンプルです。
適宜書き換えてますので間違いがあるかもしれませんが、脳内補完しといて下さい。
対象機器：Juniper SRX210H(JUNOS:11.2R4.3)
グローバルIPアドレス：116.91.118.97/32
ローカルネットワーク：192.168.0.0/24(デスクトップPC用セグメント)
192.168.254.0/24(DMZ/公開サーバ用セグメント)
各インターフェイスゾーン：ge-0/0/0-1・・・Trust
fe-0/0/2-3・・・UnTrust
fe-0/0/4-6・・・DMZ
fe-0/0/7・・・割り当てなし
・PPPoE接続で固定グローバルIPアドレスを割り当て
・公開サーバで提供しているサービスはhttp(port80)、https(port443)
・固定グローバルIPアドレスが1つの為、ポートフォワーディングで上記サービスを提供
・各ローカルネットワークからインターネットにアクセスできる
・セキュリティは一切考慮していない(全ての通信を許可)
・NTP、DNSはローカルサーバ(192.168.254.1)を指定
構成イメージ図(全体)
構成イメージ図(SRX210)
上記画像の元になったVisioファイル・・・・https://www.isoppe.jp/upload/log/012.zip
groups {
wiz_PPPoE_0 {
system {
name-server {
163.139.21.197;
163.139.230.168;
}
services {
dhcp {
name-server {
163.139.21.197;
163.139.230.168;
}
}
}
}
interfaces {
lo0 {
unit 0 {
family inet {
address 116.91.118.97/32 {
primary;
}
}
}
}
pp0 {
unit 0 {
description vectant;
ppp-options {
chap {
default-chap-secret "XXXXXXXXXXX"; ## SECRET-DATA
local-name "XXXXXXXX";
no-rfc2486;
passive;
}
}
pppoe-options {
underlying-interface fe-0/0/2.0;
}
family inet {
unnumbered-address lo0.0;
}
}
}
fe-0/0/2 {
unit 0 {
encapsulation ppp-over-ether;
}
}
}
routing-options {
static {
route 0.0.0.0/0 {
qualified-next-hop pp0.0 {
metric 1;
}
}
}
}
security {
zones {
security-zone untrust {
interfaces {
pp0.0;
}
}
}
}
}
}
apply-groups wiz_PPPoE_0;
system {
host-name SRX210H;
domain-name ys-network.info;
time-zone Asia/Tokyo;
root-authentication {
encrypted-password "XXXXXXXXXX"; ## SECRET-DATA
}
name-server {
192.168.254.1;
}
services {
ssh;
xnm-clear-text;
web-management {
https {
system-generated-certificate;
interface vlan.0;
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
ntp {
server 192.168.254.1;
}
}
chassis {
aggregated-devices {
ethernet {
device-count 1;
}
}
}
interfaces {
ge-0/0/0 {
gigether-options {
auto-negotiation;
}
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v0001;
}
}
}
}
ge-0/0/1 {
gigether-options {
auto-negotiation;
}
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members v0001;
}
}
}
}
fe-0/0/2 {
fastether-options {
auto-negotiation;
}
}
fe-0/0/3 {
fastether-options {
auto-negotiation;
}
unit 0;
}
fe-0/0/4 {
fastether-options {
auto-negotiation;
}
unit 0 {
family ethernet-switching;
}
}
fe-0/0/5 {
fastether-options {
auto-negotiation;
}
unit 0 {
family ethernet-switching;
}
}
fe-0/0/6 {
fastether-options {
auto-negotiation;
}
unit 0 {
family ethernet-switching;
}
}
fe-0/0/7 {
fastether-options {
auto-negotiation;
}
unit 0 {
family ethernet-switching {
port-mode access;
}
}
}
pp0 {
unit 0 {
family inet {
negotiate-address;
}
}
}
vlan {
unit 0 {
family inet {
address 192.168.0.254/24;
}
}
unit 1 {
family inet {
address 192.168.254.254/24;
}
}
}
}
snmp {
description SRX210;
location "Juniper SRX210H";
contact "yukio_sumadera@ys-network.info";
community public {
authorization read-only;
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop pp0.0;
}
}
protocols {
}
security {
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set Servers {
from zone dmz;
to zone untrust;
rule Servers {
match {
source-address 192.168.254.0/24;
}
then {
source-nat {
interface;
}
}
}
}
rule-set DesktopPC {
from zone trust;
to zone untrust;
rule DesktopPCs {
match {
source-address [ 192.168.0.0/24 ];
}
then {
source-nat {
interface;
}
}
}
}
}
destination {
pool HTTP {
address 192.168.254.1/32 port 80;
}
pool HTTPS {
address 192.168.254.1/32 port 443;
}
rule-set vectant {
from zone untrust;
rule HTTP {
match {
destination-address 116.91.118.97/32;
destination-port 80;
}
then {
destination-nat pool HTTP;
}
}
rule HTTPS {
match {
destination-address 116.91.118.97/32;
destination-port 443;
}
then {
destination-nat pool HTTPS;
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any-ipv4;
destination-address any-ipv4;
application [ junos-icmp-all junos-ping ];
}
then {
permit;
log {
session-init;
session-close;
}
}
}
policy trust-to-untrust-tcp {
match {
source-address any-ipv4;
destination-address any-ipv4;
application junos-tcp-any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
policy trust-to-untrust-udp {
match {
source-address any-ipv4;
destination-address any-ipv4;
application junos-udp-any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone trust to-zone trust {
policy trust-to-trust {
match {
source-address any-ipv4;
destination-address any-ipv4;
application [ junos-icmp-all junos-icmp-ping junos-ping ];
}
then {
permit;
log {
session-close;
}
}
}
}
from-zone trust to-zone dmz {
policy trust-to-dmz {
match {
source-address any-ipv4;
destination-address any-ipv4;
application [ junos-icmp-ping junos-ping junos-icmp-all ];
}
then {
permit;
log {
session-close;
}
}
}
}
from-zone untrust to-zone dmz {
policy untrust-to-dmz {
match {
source-address any-ipv4;
destination-address any-ipv4;
application [ junos-icmp-ping junos-ping junos-icmp-all ];
}
then {
permit;
log {
session-close;
}
}
}
policy untrust-to-dmz-tcp {
match {
source-address any-ipv4;
destination-address any-ipv4;
application junos-tcp-any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
policy untrust-to-dmz-udp {
match {
source-address any-ipv4;
destination-address any-ipv4;
application junos-udp-any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone untrust to-zone trust {
policy untrust-to-trust {
match {
source-address any-ipv4;
destination-address any-ipv4;
application [ junos-icmp-all junos-icmp-ping junos-ping ];
}
then {
permit;
log {
session-init;
}
}
}
}
from-zone dmz to-zone trust {
policy dmz-to-trust {
match {
source-address any-ipv4;
destination-address any-ipv4;
application [ junos-ping junos-icmp-all junos-icmp-ping ];
}
then {
permit;
log {
session-close;
}
}
}
}
from-zone dmz to-zone untrust {
policy dmz-to-untrust {
match {
source-address any-ipv4;
destination-address any-ipv4;
application [ junos-ping junos-icmp-ping ];
}
then {
permit;
log {
session-close;
}
}
}
policy dmz-to-untrust-tcp {
match {
source-address any-ipv4;
destination-address any-ipv4;
application junos-tcp-any;
}
then {
permit;
log {
session-close;
}
}
}
policy dmz-to-untrust-udp {
match {
source-address any-ipv4;
destination-address any-ipv4;
application junos-udp-any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
}
zones {
security-zone trust {
tcp-rst;
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.0;
ge-0/0/0.0;
ge-0/0/1.0;
}
}
security-zone untrust {
tcp-rst;
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
fe-0/0/2.0;
fe-0/0/3.0;
}
}
security-zone dmz {
tcp-rst;
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.1;
fe-0/0/4.0;
fe-0/0/5.0;
fe-0/0/6.0;
}
}
}
}
ethernet-switching-options {
voip;
}
vlans {
v0001 {
vlan-id 1;
interface {
ge-0/0/0.0;
ge-0/0/1.0;
}
l3-interface vlan.0;
}
v0254 {
vlan-id 254;
interface {
fe-0/0/4.0;
fe-0/0/5.0;
fe-0/0/6.0;
}
l3-interface vlan.1;
}
}
=======================
2012/8/27 一部を更新
コメント
[…] 123.107.190.0/24 > 今回追加したPPPoEセッション その他 http://www.ys-network.info/?p=3179に基づきます。 […]