我有个juniper ssg 5防火墙怎么调
\u6211\u6709\u4e2ajuniper ssg 5\u9632\u706b\u5899\u600e\u4e48\u8c03\u8981\u4e0d\u8981\u7ed9\u4f60\u4e00\u4e2a\u554a\uff0c\u914d\u7f6e\u53c2\u8003\u554a(\u5305\u62ecL2TP-VPN\u8bbe\u5b9a)\u3002\u4e0d\u8fc7\u9700\u8981\u4f60\u81ea\u5df1\u7814\u7a76\u4e00\u4e0b\u554a\u3002\u76f8\u5173IP\u4e3a\u5047\u8bbe\u7684\u3002\u6587\u5b57\u592a\u591a\uff0c\u5206\u4e3a\u591a\u6bb5\u8865\u5145\u3002set clock timezone 7
set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00
set vrouter trust-vr sharable
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset auto-route-export
set protocol ospf
set enable
set area 0.0.0.100
set area 0.0.0.100 range 192.168.100.128 255.255.255.192 advertise
set area 0.0.0.100 range 10.10.10.64 255.255.255.192 advertise
exit
exit
set service "BitComet_Handshake" protocol tcp src-port 0-65535 dst-port 1025-65535
set service "http8080" protocol tcp src-port 0-65535 dst-port 8080-8080
set service "QQ_Servie" protocol udp src-port 0-65535 dst-port 8000-8001
set service "Lotus Notes" protocol tcp src-port 0-65535 dst-port 1352-1352
set service "Lotus Notes" + tcp src-port 0-65535 dst-port 389-389
set service "Lotus Notes" + tcp src-port 0-65535 dst-port 1533-1533
set service "MySql" protocol tcp src-port 0-65535 dst-port 3306-3308
set service "Jabber" protocol tcp src-port 0-65535 dst-port 5220-5220
set service "Jabber" + tcp src-port 0-65535 dst-port 5222-5223
set service "Fin_app" protocol tcp src-port 0-65535 dst-port 7001-7002
set service "HK_IT_TEST" protocol tcp src-port 0-65535 dst-port 1025-1025
set service "softphone" protocol tcp src-port 0-65535 dst-port 4100-4100
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set auth radius accounting port 1646
set admin name "router"
set admin password "nFM9B6r8N+jLcYrAcsqA6DItF5CEmn"
set admin user "admin" password "nNYJKwrqOcrHc93BksIFdiHt1CPV9n" privilege "all"
set admin user "admin2" password "nJAJOhrmAPyPc7PN1sMAq2NtqIN4tn" privilege "all"
set admin manager-ip 192.168.101.210 255.255.255.240
set admin manager-ip 158.215.143.117 255.255.255.255
set admin auth timeout 10
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Untrust-Tun" vrouter "trust-vr"
set zone "Trust" tcp-rst
set zone "Untrust" block
unset zone "Untrust" tcp-rst
set zone "DMZ" tcp-rst
set zone "VLAN" block
unset zone "VLAN" tcp-rst
set zone "Trust" screen port-scan
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "ethernet0/0" zone "Untrust"
set interface "ethernet0/1" zone "DMZ"
set interface "ethernet0/3" zone "Untrust"
set interface "ethernet0/4" zone "Trust"
set interface "ethernet0/5" zone "Trust"
set interface "ethernet0/6" zone "Trust"
set interface "bgroup0" zone "Trust"
set interface "bgroup1" zone "Trust"
set interface "tunnel.1" zone "Untrust"
set interface bgroup0 port ethernet0/2
unset interface vlan1 ip
set interface ethernet0/0 ip 158.215.143.114/29
set interface ethernet0/0 route
set interface ethernet0/1 ip 10.10.10.193/28
set interface ethernet0/1 route
set interface ethernet0/4 ip 192.168.100.173/26
set interface ethernet0/4 nat
set interface ethernet0/5 ip 192.168.101.209/28
set interface ethernet0/5 nat
set interface ethernet0/6 ip 10.10.10.129/26
set interface ethernet0/6 nat
set interface bgroup0 ip 10.10.10.1/26
set interface bgroup0 nat
set interface tunnel.1 ip unnumbered interface ethernet0/0
set interface ethernet0/4 bandwidth egress mbw 2048 ingress mbw 2048
set interface ethernet0/6 bandwidth egress mbw 1024 ingress mbw 1024
set interface bgroup0 bandwidth egress mbw 2048 ingress mbw 2048
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/0 ip manageable
set interface ethernet0/1 ip manageable
set interface ethernet0/4 ip manageable
set interface ethernet0/5 ip manageable
set interface ethernet0/6 ip manageable
set interface bgroup0 ip manageable
set interface ethernet0/0 manage ping
set interface ethernet0/0 manage telnet
set interface ethernet0/0 manage web
unset interface ethernet0/6 manage ssh
unset interface ethernet0/6 manage telnet
unset interface ethernet0/6 manage snmp
unset interface ethernet0/6 manage ssl
unset interface ethernet0/6 manage web
unset interface vlan1 manage ping
unset interface vlan1 manage ssh
unset interface vlan1 manage telnet
unset interface vlan1 manage snmp
unset interface vlan1 manage ssl
unset interface vlan1 manage web
set interface vlan1 monitor track-ip dynamic
set interface ethernet0/5 monitor track-ip ip
unset interface ethernet0/5 monitor track-ip dynamic
set interface ethernet0/4 monitor track-ip ip
unset interface ethernet0/4 monitor track-ip dynamic
set interface bgroup0 monitor track-ip ip
unset interface bgroup0 monitor track-ip dynamic
set interface ethernet0/6 monitor track-ip ip
unset interface ethernet0/6 monitor track-ip dynamic
set interface ethernet0/0 dip interface-ip incoming
set interface "serial0/0" modem settings "USR" init "AT&F"
set interface "serial0/0" modem settings "USR" active
set interface "serial0/0" modem speed 115200
set interface "serial0/0" modem retry 3
set interface "serial0/0" modem interval 10
set interface "serial0/0" modem idle-time 10
set pak-poll p1queue pak-threshold 96
set pak-poll p2queue pak-threshold 32
set flow tcp-mss
unset flow no-tcp-seq-check
set flow tcp-syn-check
unset flow tcp-syn-bit-check
set flow reverse-route clear-text prefer
set flow reverse-route tunnel always
set hostname ssg5-vpn
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set pki x509 dn country-name "CN"
set pki x509 dn state-name "JS"
set pki x509 dn local-name "WX"
set pki x509 dn org-name "BCM"
set pki x509 dn org-unit-name "IT"
set pki x509 dn name "Admin"
set pki x509 dn phone "85233108"
set pki x509 dn email "[email protected]"
set pki x509 cert-fqdn ssg5-vpn.wx.beltongrp.com
set dns host dns1 221.228.255.1 src-interface bgroup0
set dns host dns2 218.2.135.1 src-interface bgroup0
set dns host dns3 0.0.0.0
set dns host schedule 06:28
set address "Trust" "10.10.10.1" 10.10.10.1 255.255.255.192 "SSG5 Router"
set address "Trust" "10.10.10.11" 10.10.10.11 255.255.255.255 "IT Management"
set address "Trust" "10.10.10.2" 10.10.10.2 255.255.255.255 "CPCNet BACKUP Router"
set address "Trust" "218.2.135.1" 218.2.135.1 0.0.0.0
set address "Trust" "221.228.255.1" 221.228.255.1 0.0.0.0
set address "Trust" "BCM Intranet Office" 192.168.150.0 255.255.254.0 "BCM Intranet-c"
set address "Trust" "BCMHK_CS_1000" 192.168.4.0 255.255.255.0 "BCMHK_CS_1000"
set address "Trust" "BIT_CS_1000" 192.168.103.176 255.255.255.240
set address "Trust" "BMC_CS_1000" 192.168.104.0 255.255.255.0
set address "Trust" "BSZ_CS_1000" 192.168.102.0 255.255.255.0 "BSZ_CS_1000"
set address "Trust" "COMM Gateway" 192.168.100.129 255.255.255.255 "For PABX"
set address "Trust" "Comm Server" 192.168.100.128 255.255.255.192 "CCTV & Other Service"
set address "Trust" "CPCnet Backup Router" 192.168.100.30 255.255.255.255
set address "Trust" "CPCNet Master Router" 192.168.100.1 255.255.255.255 "CPCNet Master Router "
set address "Trust" "db1" 192.168.100.228 255.255.255.255 "Mysql"
set address "Trust" "db2" 192.168.100.232 255.255.255.255
set address "Trust" "Firewall Management" 10.10.10.0 255.255.255.192
set address "Trust" "IT Printer S" 192.168.100.82 255.255.255.255 "IT Printer Server"
set address "Trust" "IT Users GRP" 192.168.101.208 255.255.255.240 "Interface 5 FOR IT apply"
set address "Trust" "Mail_server_01" 192.168.100.69 255.255.255.255 "Mail_server_01"
set address "Trust" "Mail_server_02" 192.168.100.76 255.255.255.255 "Mail_server_02"
set address "Trust" "prtwx" 192.168.100.100 255.255.255.255 "Samba Server"
set address "Trust" "Vistor User GrouP" 10.10.10.128 255.255.255.192
set address "Trust" "VPN_USERS" 192.168.101.208 255.255.255.240 "BCM VPN USER"
set address "Trust" "WX-Gateway" 192.168.100.2 255.255.255.255 "3550-EMI"
set address "Trust" "WX_BDC_Old" 192.168.100.75 255.255.255.255 "WX_BDC_Old"
set address "Trust" "WX_PDC_Old" 192.168.100.68 255.255.255.255 "WX_PDC_Old"
set group address "Trust" "AdminIPS"
set group address "Trust" "AdminIPS" add "10.10.10.11"
set group address "Trust" "CS-1000-TELE" comment "Other sites cs1000 system"
set group address "Trust" "CS-1000-TELE" add "BCMHK_CS_1000"
set group address "Trust" "CS-1000-TELE" add "BIT_CS_1000"
set group address "Trust" "CS-1000-TELE" add "BMC_CS_1000"
set group address "Trust" "CS-1000-TELE" add "BSZ_CS_1000"
set ippool "L2-Address" 192.168.101.209 192.168.101.222
set user "anthony.tan" uid 13
set user "anthony.tan" type l2tp
set user "anthony.tan" remote ippool "L2-Address"
set user "anthony.tan" remote dns1 "221.228.255.1"
set user "anthony.tan" password "x8WdGgoyNy90C1sFvuCSpj+yuUnj9C+EPA=="
unset user "anthony.tan" type auth
set user "anthony.tan" "enable"
set user "BCMuser" uid 9
set user "BCMuser" type l2tp
set user "BCMuser" remote ippool "L2-Address"
set user "BCMuser" remote dns1 "221.228.255.1"
set user "BCMuser" password "QcGsG4Y1NFTmyusdMwCZnLOjN1n17b8iVg=="
unset user "BCMuser" type auth
set user "BCMuser" "disable"
set user "cindy" uid 2
MIP \u662f\u201c\u4e00\u5bf9\u4e00\u201d\u7684\u53cc\u5411\u5730\u5740\u8f6c\u6362\u8fc7\u7a0b\u3002\u901a\u5e38\u7684\u60c5\u51b5\u662f\uff1a\u6709\u82e5\u5e72\u4e2a\u516c\u7f51IP\u5730\u5740\uff0c\u53c8\u5b58\u5728\u82e5\u5e72\u7684\u5bf9\u5916\u63d0\u4f9b\u7f51\u7edc\u670d\u52a1\u7684\u670d\u52a1\u5668\uff0c \u4e3a\u4e86\u5b9e\u73b0\u4e92\u8054\u7f51\u7528\u6237\u8bbf\u95ee\u8fd9\u4e9b\u670d\u52a1\u5668\uff0c\u53ef\u5728Internet\u51fa\u53e3\u7684\u9632\u706b\u5899\u4e0a\u5efa\u7acb\u516c\u7f51IP\u5730\u5740\u4e0e\u670d\u52a1\u5668\u79c1\u6709IP\u5730\u5740\u4e4b\u95f4\u7684\u4e00\u5bf9\u4e00\u6620\u5c04\u5373MIP\uff0c\u5e76\u901a\u8fc7\u7b56\u7565\u5b9e \u73b0\u5bf9\u670d\u52a1\u5668\u6240\u63d0\u4f9b\u670d\u52a1\u8fdb\u884c\u8bbf\u95ee\u63a7\u5236\u3002
MIP\u8981\u914d\u7f6e\u5728\u9632\u706b\u5899\u7684\u5916\u7f51\u7aef\u53e3\uff0c\u8fdb\u5165ethernet3\u7684\u914d\u7f6e\u754c\u9762\uff0c\u9009\u62e9\u4e0a\u65b9\u7684MIP\u9009\u9879,\u5728Mapped IP\u91cc\u8f93\u5165\u5916\u7f51IP ,Host IP Address\u91cc\u8f93\u5165\u8981\u6620\u5c04\u7684\u5185\u7f51IP ,\u9009\u62e9\u4eceUNtrust\u5230Trust\uff0c\u65b0\u5efa\u7b56\u7565\u3002\u5728Destination Address\uff08\u76ee\u6807\u5730\u5740\uff09\u9009\u9879\u91cc\u9009\u62e9\u521a\u521a\u5efa\u7acb\u7684MIP\uff0c\u70b9\u51fbOK,MIP\u5df2\u7ecf\u88ab\u6fc0\u6d3b\u4e86.
扩展阅读：juniper ssg140 ... whatsapp messenger ... juniper ssg5 ... messenger log in ... shopify官网入口 ... mi messenger安卓下载 ... 抖音很火的英文歌you are ... 抖音很火的one two three ... 最近抖音很火的一首英文歌 ...
