最基本的物质需求得到满足之后，唯一能够不断增加个人幸福感的事情就是帮助他人

1. 管理工具——〉路由与远程访问，打开“路由与远程访问”控制台。
2. 如果是禁用状态，鼠标右击服务器图标，单击“配置启用路由和远程访问”启动“路由和远程访问服务器安装向导”，单击“下一步”继续。
3. 单击“自定义配置”选项，单击“下一步”。
4. 勾选“VPN访问”和“NAT和基本防火墙”，单击“下一步”，在下一页面中单击“完成”。注意：此时要确保“windows Firewall/Internet Connection Sharing（ICS）”服务保持禁用状态。
5. 配置静态地址池。配置窗口左侧的“xxx（本地）”按正常应该显示绿色箭头，右键单击，选择“属性”->IP选项卡->静态地址池，添加静态地址池然后点击“确定”。
6. 配置访问接口和NAT。xxx（本地）->IP路由选择->NAT/基本防火墙，右键单击->新增接口->本地连接->公共接口连接到Internet->在此接口上启用NAT->确定。
7. 配置相应的用户，注意添加远程访问权限（拨入或VPN）。

标签： NAT, VPN, Windows2003

实验拓扑如下图：
要求：
1、ssg5后的主机192.168.1.100可以访问ssg520后的主机192.168.1.100，两台主机均在NAT后，如图所示。
2、ssg520后的主机192.168.2.100可以访问ssg5后的主机192.168.2.100，两台主机均在NAT后，如图所示。


配置步骤：

SSG520:
1、添加三层区段zone_test1、zone_test2

set zone id 100 "zone_test1"
set zone id 101 "zone_test2"

2、设置接口基本信息

set interface "ethernet0/0" zone "zone_test1"

set interface ethernet0/0 ip 192.168.1.1/24
set interface ethernet0/0 route
set interface ethernet0/0 ip manageable

set interface ethernet0/0 manage ping
set interface ethernet0/0 manage ssh
set interface ethernet0/0 manage telnet
set interface ethernet0/0 manage snmp
set interface ethernet0/0 manage ssl
set interface ethernet0/0 manage web




set interface "ethernet0/1" zone "zone_test2"

set interface ethernet0/1 ip 192.168.2.1/24
set interface ethernet0/1 route
set interface ethernet0/1 ip manageable

set interface ethernet0/1 manage ping
set interface ethernet0/1 manage ssh
set interface ethernet0/1 manage telnet
set interface ethernet0/1 manage snmp
set interface ethernet0/1 manage ssl
set interface ethernet0/1 manage web




set interface "ethernet0/2" zone "Untrust"

set interface ethernet0/2 ip 10.0.1.1/24
set interface ethernet0/2 route
set interface ethernet0/2 ip manageable


set interface ethernet0/2 manage ping
set interface ethernet0/2 manage ssh
set interface ethernet0/2 manage telnet
set interface ethernet0/2 manage snmp
set interface ethernet0/2 manage ssl
set interface ethernet0/2 manage web

3、在非信任端口上设置MIP

set interface "ethernet0/2" mip 10.0.1.100 host 192.168.1.100 netmask 255.255.255.255 vr "trust-vr"
set interface "ethernet0/2" mip 10.0.1.200 host 192.168.2.100 netmask 255.255.255.255 vr "trust-vr"


4、设置地址，为policy做准备

set address "Untrust" "10.0.1.0" 10.0.1.0 255.255.255.0
set address "Untrust" "10.0.2.0" 10.0.2.0 255.255.255.0
set address "zone_test1" "192.168.1.0" 192.168.1.0 255.255.255.0
set address "zone_test2" "192.168.2.0" 192.168.2.0 255.255.255.0
set address "zone_test1" "192.168.1.100/32" 192.168.1.100 255.255.255.255

5、设置规则

set policy id 1 from "zone_test2" to "Untrust"  "192.168.2.0" "10.0.1.0" "PING" permit
set policy id 1
exit
set policy id 2 from "zone_test2" to "Untrust"  "192.168.2.0" "10.0.2.0" "ANY" permit
set policy id 2
exit
set policy id 3 from "Untrust" to "zone_test1"  "10.0.2.0" "MIP(10.0.1.100)" "ANY" permit
set policy id 3
exit
6、设置必要的路由。
set route 10.0.2.0/24 interface ethernet0/2 gateway 10.0.1.254


SSG5：












set address "Untrust" "10.0.1.0" 10.0.1.0 255.255.255.0
set address "Untrust" "10.0.2.0" 10.0.2.0 255.255.255.0
set address "zone_test1" "192.168.1.0" 192.168.1.0 255.255.255.0
set address "zone_test2" "192.168.2.0" 192.168.2.0 255.255.255.0
set address "zone_test2" "192.168.2.100/32" 192.168.2.100 255.255.255.255
set policy id 1 from "zone_test1" to "Untrust"  "192.168.1.0" "10.0.2.0" "PING" permit
set policy id 1
exit
set policy id 2 from "zone_test1" to "Untrust"  "192.168.1.0" "10.0.1.0" "ANY" permit
set policy id 2
exit
set policy id 3 from "Untrust" to "zone_test2"  "10.0.1.0" "MIP(10.0.2.200)" "ANY" permit
set policy id 3
exit

标签： Juniper, NAT, Netscreen

网络拓扑图如上图，ssg5 trust接口采用nat模式，映射关系如图中所指。

1、bgroup属于trust zone，ip地址10.1.1.254/24，端口模式为nat（trust zone的端口默认即为nat模式），manageable，不设另外manage ip，service options作为模板支持web ui，telnet，ssh和ping。

2、eth0/0属于untrust zone，ip地址为220.220.1.1/24，端口模式为route，manageble，不设另外manage ip，service options作为模板支持web ui，telnet，ssh和ping。

3、在端口eth0/0中设置mip。
mapped ip: 220.220.1.100
host ip: 10.1.1.100
netmask: 255.255.255.255
vrouter: trust-vr

4、在端口eth0/0设置vip
先添加virtual ip address:220.220.1.80
分别new vip service:
virtual ip: 220.220.1.80
virtual port: 80
map to service: 80
map to ip: 10.1.1.10
server auto detection: checked

virtual ip: 220.220.1.80
virtual port: 8080
map to service: 80
map to ip: 10.1.1.20
server auto detection: checked

virtual ip: 220.220.1.80
virtual port: 8800
map to service: 80
map to ip: 10.1.1.30
server auto detection: checked

可以看出mip和vip的区别，mip是一对一的ip映射，vip可以进行端口映射，ip地址的映射可以是一对多。

5、添加costom services
set service "TCP-8080" protocol tcp src-port 0-65535 dst-port 8080-8080
set service "TCP-8800" protocol tcp src-port 0-65535 dst-port 8800-8800

6、添加policy
set policy from trust to untrust any any any permit
set policy from untrust to trust "any" "MIP(220.220.1.100)" "POP3" permit log
set policy from untrust to trust "any" "VIP(220.220.1.80)" "HTTP" permit log
set policy from untrust to trust "any" "VIP(220.220.1.80)" "TCP-8080" permit log
set policy from untrust to trust "any" "VIP(220.220.1.80)" "TCP-8800" permit log

OK!

标签： Juniper SSG 5, NAT