温馨提示×

温馨提示×

您好,登录后才能下订单哦!

密码登录×
登录注册×
其他方式登录
点击 登录注册 即表示同意《亿速云用户服务条款》

JuniperSRX Filter-Based Forwarding

发布时间:2020-07-17 13:35:06 来源:网络 阅读:487 作者:terence88 栏目:网络安全

就是策略路由

1) 创建routing-instance(SP1,SP2),instance-type为fowarding


edit routing-instance [SP1] instance-type forwading

    set routing-options static route 0/0 nex-hop 202.100.1.1


edit routing-instance [SP2] instance-type forwading

    set routing-options static route 0/0 nex-hop 202.100.2.1


2)创建firewall filter


edit friewall filter [Inside1] term [1] 

    set from source-address 10.1.1.0/24

    set then routing-instance SP1

    set term [Default-Permit-All] then accept


set firewall filter [Inside1] term [1] from source-address 10.1.1.0/24

set firewall filter [Inside1] term [1] from source-port xxxx

set firewall filter [Inside1] term [1] destination-address x.x.x.x/x

set firewall filter [Inside1] term [1] destination-port xxxx

set firewall filter [Inside1] term [1] then routing-instance SP1

set firewall filter [Inside1] term [Default-Permit] then accept


edit firewall filter [Inside2] term [2]

    set from source-address 

    set then routing-instance SP2

    set term [Default-Permit-All] then accept


3)接口 调用filter

set interface ge-0/0/2.0 family inet filter input Inside1

set interfaes ge-0/0/3.0 family inet filter input Inside2


4)合并路由表

run show route    //查看全局路由表中,是没有前面定义的routing-instance中的路由的

show routing-instances


edit routing-options 

    set interface-routes rib-group inet [Policy-Routing]

    edit rib-groups [Policy-Routing]

        set import-rib [inet.0 SP1.inet.0 SP2.inet.0]


run show route    //查看合并后的路由表


5)创建Zone间策略:Security Policis(放行流量Inside1->Outside;Inside2->Outside)

set security policies from-zone Inside1 to-zone Outside policy Default-Permit-All

    set match source-address any

    set match destination-address any

    set match application any

    set then permit

set security policies from-zone Inside2 to-zone Outside policy Default-Permit-All

    set match sourc-address any

    set match destination-address any

    set match application-address any

    set then permit


#show security policies

#run show security flow session



向AI问一下细节

免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。

AI