最基本的物质需求得到满足之后，唯一能够不断增加个人幸福感的事情就是帮助他人

方案图如下：

配置步骤：

SSG520:
1、添加三层区段zone_test1

set zone id 100 "zone_test1"


2、设置接口基本信息

set interface "ethernet0/0" zone "zone_test1"

set interface ethernet0/0 ip 195.168.1.1/24
set interface ethernet0/0 route
set interface ethernet0/0 ip manageable

set interface ethernet0/0 manage ping
set interface ethernet0/0 manage ssh
set interface ethernet0/0 manage telnet
set interface ethernet0/0 manage snmp
set interface ethernet0/0 manage ssl
set interface ethernet0/0 manage web


set interface "ethernet0/2" zone "Untrust"

set interface ethernet0/2 ip 10.0.1.1/24
set interface ethernet0/2 route
set interface ethernet0/2 ip manageable


set interface ethernet0/2 manage ping
set interface ethernet0/2 manage ssh
set interface ethernet0/2 manage telnet
set interface ethernet0/2 manage snmp
set interface ethernet0/2 manage ssl
set interface ethernet0/2 manage web

3、建立tunnel接口
set interface "tunnel.1" zone "Untrust"
set interface tunnel.1 ip unnumbered interface ethernet0/2

4、设置地址，为policy做准备


5、添加vpn gateway和vpn，并绑定tunnel
set ike gateway "p1-VPN" address 10.0.2.1 Main outgoing-interface "ethernet0/2" preshare "b8T7jXayN9IQk3sjBvCRFCCE3rn4M+aNWQ==" sec-level standard



set vpn "p2-VPN" gateway "p1-VPN" no-replay tunnel idletime 0 sec-level standard
set vpn "p2-VPN" id 0x4 bind interface tunnel.1

6、设置规则

set policy id 1 from "Untrust" to "zone_test1"  "192.168.1.0" "195.168.1.0" "ANY" permit


7、设置必要的路由


set route 10.0.2.0/24 interface ethernet0/2 gateway 10.0.1.254
set route 192.168.1.0/24 interface tunnel.1

注意：一定不要添加
set route 192.168.1.0/24 interface ethernet0/2 gateway 10.0.1.254

否则，流量不会被加密。


SSG5:






3、建立tunnel接口

5、添加vpn gateway和vpn，并绑定tunnel

6、设置规则

set policy id 1 from "zone_test1" to "Untrust"  "192.168.1.0" "Any" "ANY" permit
set policy id 1 

标签： Juniper, Netscreen, Route-based VPN