Juniper SRX防火墙-目的NAT（一）

Juniper SRX防火墙-目的NAT（一）

Juniper SRX 目的NAT

基于rule的目的地址转换

互联网用户通过100.0.0.1公网地址访问内网服务器10.1.10.5

单地址全端口映射:

§将公网IP：100.0.0.1映射至私网IP：10.1.10.5

配置由Pool和rule组成，以下配置不启用PAT

Destination NAT with address pool:

Destination NAT with address pool:

以下配置启用PAT

将公网IP：100.0.0.1:80映射至私网IP：10.1.10.5:8080

以下配置启用PAT，

将100.0.0.1的80端口映射为10.1.10.5的8080端口

在NETSCREEN中，此功能称之为VIP

基于rule的NAT

set security natproxy-arpinterface ge-0/0/0.0 address 222.0.0.5/32

set security nat destination pool pool-1-8_8080 address 192.168.1.8/32

set security nat destination pool pool-1-8_8080 address port 8080

set security nat destination pool pool-1-8 address 192.168.1.8/32

set security nat destination rule-set dst-nat-rule from zone untrust

set security nat destination rule-set dst-nat-rule rule rule13-30_80 match destination-address 222.0.0.5/32

set security nat destination rule-set dst-nat-rule rule rule13-30_80 match destination-port 80

set security nat destination rule-set dst-nat-rule rule rule13-30_80 then destination-nat pool pool-1-8_8080

set security nat destination rule-set dst-nat-rule rule rule111_8 match destination-address 111.0.0.8/32

set security nat destination rule-set dst-nat-rule rule rule111_8 then destination-nat pool pool-1-8

同一个rule里能否多端口或range？

for i in {15100..15200}

do

echo "

set security nat destinationpool VOIP_$i address 10.10.10.10/32

set security nat destinationpool VOIP_$i address port $i

set security nat destinationrule-set SET_1 rule VOIP_$i match source-address 0.0.0.0/0

set security nat destinationrule-set SET_1 rule VOIP_$i match destination-address

74.125.225.179/32

set security nat destinationrule-set SET_1 rule VOIP_$i match destination-port $i

set security nat destinationrule-set SET_1 rule VOIP_$i then destination-nat pool VOIP_$i

"

Done

多个外部端口对应一个内部端口

set security nat destination pool test3 address 192.168.1.8/32

set security nat destination pool test3 address port 8081

set security natdestination rule-set dst-nat-rule rule 12 match destination-address 222.0.0.8/32

set security natdestination rule-set dst-nat-rule rule 12 match destination-port 8080 to 8081

set security natdestination rule-set dst-nat-rule rule 12 then destination-nat pool test3

端口级转换类型总结

目前版本pool不支持端口范围

功能验证

show security nat destination summary

show security nat destination pool poolXXX

show security nat destination rule rulexxx

show security flow session

查看NAT对应关系与命中数

查看地址池配置与命中

基于rule的目的地址转换

检查NAT、PAT的结果

user@host> show security flow session

可以看到基于端口的，内外网对应端口不同！

基于IP级的，则完整转换

user@host> show security nat destination pool all

再次验证一下命中

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。