此文是经验描述，无理论性的东西，juniper高手请略过。
root> show version
Model: srx240h2
JUNOS Software Release [12.3X48-D101]
防火墙透明部署，由外到内仅放行一个端口，由内到外全放行；
原配置文件如下：
root# show
## Last changed: 2020-07-28 22:19:04 UTC
version 12.3X48-D101;
system {
time-zone Aisa/Shanghai;
root-authentication {
encrypted-password "$1$pVcwp59a$qQzd.NtKbPEcogDIn7Ltw0"; ## SECRET-DATA
}
name-server {
208.67.222.222;
208.67.220.220;
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
http {
interface [ vlan.0 ge-0/0/0.0 ];
}
https {
system-generated-certificate;
interface vlan.0;
}
}
dhcp {
router {
192.168.1.1;
}
pool 192.168.1.0/24 {
address-range low 192.168.1.2 high 192.168.1.254;
}
propagate-settings ge-0/0/0.0;
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
security {
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule source-nat-rule {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone trust {
policy permit_1701 {
match {
source-address any;
destination-address any;
application [ tcp1701 udp1701 ];
}
then {
permit;
}
}
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0;
}
}
security-zone untrust {
screen untrust-screen;
host-inbound-traffic {
system-services {
ping;
http;
telnet;
ssh;
}
}
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
dhcp;
tftp;
}
}
}
ge-0/0/2.0;
}
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 192.168.1.238/24;
}
}
}
ge-0/0/1 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members vlan10;
}
}
}
}
ge-0/0/2 {
unit 0 {
family ethernet-switching {
port-mode access;
vlan {
members vlan10;
}
}
}
}
ge-0/0/3 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/4 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/5 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/6 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/7 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/8 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/9 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/10 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/11 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/12 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/13 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/14 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
ge-0/0/15 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
vlan {
unit 0 {
family inet {
address 192.168.1.1/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 192.168.1.253;
}
}
protocols {
stp;
}
bridge-domains {
bd1 {
domain-type bridge;
vlan-id 10;
}
}
applications {
application tcp1701 {
protocol tcp;
destination-port 1701;
}
application udp1701 {
protocol udp;
destination-port 1701;
}
}
vlans {
vlan-trust {
vlan-id 3;
l3-interface vlan.0;
}
vlan10 {
vlan-id 10;
}
}
[edit]
root> show security flow session
Total sessions: 0
测试过程中，没看到会话；就。。。。。。。
不知道这样是不是能清晰些。。。
root# show | display set
set version 12.3X48-D101
set system root-authentication encrypted-password "$1$w9Ch8UnB$Mkbvr5cZjoR3EVvINu7zh/"
set system name-server 208.67.222.222
set system name-server 208.67.220.220
set system services ssh
set system services telnet
set system services xnm-clear-text
set system services web-management http interface vlan.0
set system services web-management http interface ge-0/0/0.0
set system services web-management https system-generated-certificate
set system services web-management https interface vlan.0
set system services dhcp router 192.168.1.1
set system services dhcp pool 192.168.1.0/24 address-range low 192.168.1.2
set system services dhcp pool 192.168.1.0/24 address-range high 192.168.1.254
set system services dhcp propagate-settings ge-0/0/0.0
set system syslog archive size 100k
set system syslog archive files 3
set system syslog user * any emergency
set system syslog file messages any critical
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands error
set system max-configurations-on-flash 5
set system max-configuration-rollbacks 5
set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval
set security screen ids-option untrust-screen icmp ping-death
set security screen ids-option untrust-screen ip source-route-option
set security screen ids-option untrust-screen ip tear-drop
set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200
set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024
set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048
set security screen ids-option untrust-screen tcp syn-flood timeout 20
set security screen ids-option untrust-screen tcp land
set security nat source rule-set trust-to-untrust from zone trust
set security nat source rule-set trust-to-untrust to zone untrust
set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 0.0.0.0/0
set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface
set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any
set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit
set security policies from-zone untrust to-zone trust policy permit1701 match source-address any
set security policies from-zone untrust to-zone trust policy permit1701 match destination-address any
set security policies from-zone untrust to-zone trust policy permit1701 match application tcp1701
set security policies from-zone untrust to-zone trust policy permit1701 match application udp1701
set security policies from-zone untrust to-zone trust policy permit1701 then permit
set security policies from-zone untrust to-zone trust policy deny_any match source-address any
set security policies from-zone untrust to-zone trust policy deny_any match destination-address any
set security policies from-zone untrust to-zone trust policy deny_any match application any
set security policies from-zone untrust to-zone trust policy deny_any then deny
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces vlan.0
set security zones security-zone trust interfaces ge-0/0/1.0
set security zones security-zone untrust screen untrust-screen
set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services dhcp
set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services tftp
set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services http
set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ping
set security zones security-zone untrust interfaces ge-0/0/2.0
set interfaces ge-0/0/0 unit 0 family inet address 192.168.1.238/24
set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan10
set interfaces ge-0/0/2 unit 0 family ethernet-switching port-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members vlan10
set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/7 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/8 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/9 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/10 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/11 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/12 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/13 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/14 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces ge-0/0/15 unit 0 family ethernet-switching vlan members vlan-trust
set interfaces vlan unit 0 family inet address 192.168.1.1/24
set routing-options static route 0.0.0.0/0 next-hop 192.168.1.253
set protocols stp
set applications application tcp1701 protocol tcp
set applications application tcp1701 destination-port 1701
set applications application udp1701 protocol udp
set applications application udp1701 destination-port 1701
set vlans vlan-trust vlan-id 3
set vlans vlan-trust l3-interface vlan.0
set vlans vlan10 vlan-id 10
[edit]
在web界面的interface中看到有一个键是：转换成二层模式 ，很奇怪 ，现在不是二层模式吗？ 后来按说明书进行配置：
[edit]
root# set bridge-domains bd1 vlan-id 10
[edit]
root# set bridge-domains bd1 routing-interface irb.0
[edit]
root# set interfaces ge-0/0/1 unit 0 family bridge vlan-id 10
[edit]
root# set interfaces ge-0/0/2 unit 0 family bridge vlan-id 10
[edit]
root# commit
[edit interfaces ge-0/0/1 unit 0 family]
'bridge'
family bridge and rest of the families are mutually exclusive
[edit interfaces ge-0/0/1 unit 0 family bridge vlan-id]
'vlan-id 10'
'vlan-id' statement supported only under access interface mode
[edit interfaces ge-0/0/1 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/2 unit 0 family]
'bridge'
family bridge and rest of the families are mutually exclusive
[edit interfaces ge-0/0/2 unit 0 family bridge vlan-id]
'vlan-id 10'
'vlan-id' statement supported only under access interface mode
[edit interfaces ge-0/0/2 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/3 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/4 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/5 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/6 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/7 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/8 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/9 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/10 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/11 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/12 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/13 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/14 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
[edit interfaces ge-0/0/15 unit 0 family]
'ethernet-switching'
Either bridge or ethernet-switching family is allowed in system
error: commit failed: (statements constraint check failed)
报错了：提示只能配置成二层bridge或ethernet-switching family
经同事协助告诉我怎么做顺利处理：将ethernet-switching接口下的配置删掉，然后commit，就会提示重启便进入mix模式；
[edit interfaces ge-0/0/1 unit 0]
root# delete family ethernet-switching
[edit interfaces ge-0/0/1 unit 0]
root# show
[edit interfaces ge-0/0/1 unit 0]
[edit]
root# edit interfaces ge-0/0/2.0
[edit interfaces ge-0/0/2 unit 0]
root# show
family ethernet-switching {
port-mode access;
vlan {
members vlan10;
}
}
[edit interfaces ge-0/0/2 unit 0]
root# delete family ethernet-switching
[edit interfaces ge-0/0/2 unit 0]
root# exit
[edit]
root# edit interfaces ge-0/0/3.0
[edit interfaces ge-0/0/3 unit 0]
root# show
family ethernet-switching {
vlan {
members vlan-trust;
}
}
[edit interfaces ge-0/0/3 unit 0]
root# delete family ethernet-switching
[edit interfaces ge-0/0/3 unit 0]
一直到G0/0/15下的配置均删掉后，然后配置二层，保存
[edit]
root# set bridge-domains bd1 domain-type bridge
[edit]
root# set bridge-domains bd1 vlan-id 10
[edit]
root# set bridge-domains bd1 routing-interface irb.0
[edit]
root# set interfaces ge-0/0/1 unit 0 family bridge vlan-id 10
[edit]
root# set interfaces ge-0/0/2 unit 0 family bridge vlan-id 10
root# commit
[edit interfaces ge-0/0/1 unit 0 family bridge vlan-id]
'vlan-id 10'
'vlan-id' statement supported only under access interface mode
[edit interfaces ge-0/0/2 unit 0 family bridge vlan-id]
'vlan-id 10'
'vlan-id' statement supported only under access interface mode
error: commit failed: (statements constraint check failed)
commit，提交后，提示上述错误，说：在接口下配置的vlan-id 10只能在access模式下，🆗配置接口模式
[edit]
root# set interfaces ge-0/0/1 unit 0 family bridge interface-mode access
[edit]
root# set interfaces ge-0/0/2 unit 0 family bridge interface-mode access
再提交：
[edit]
root# commit
warning: Interfaces are changed from route mode to mix mode. Please reboot the device or all nodes in the HA cluster!
[edit security zones security-zone trust]
'interfaces ge-0/0/1.0'
Interface ge-0/0/1.0 must have the same family as other interfaces in the zone
error: configuration check-out failed
juniper太严谨了 ， 有一点问题都不放过你 ：他告诉我现在重启可以从路由模式转到混合模式，请重启再ha簇中的所有设备🆗，但又报了一个配置问题，说：再这个区域的interface ge-0/0/1.0一定要有一个和其他接口一样的family（这里给他理解成接口模式吧）
然后我就进入这个安全区域，看了一眼，
[edit]
root# edit security zones security-zone trust
[edit security zones security-zone trust]
root# show
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.0;
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
这个区域你是不能待了 ， 把它从这个区域删掉；然后提交
[edit security zones security-zone trust]
root# delete interfaces ge-0/0/1.0
[edit security zones security-zone trust]
root# exit
[edit]
root# commit
然后接口2又有问题了 ：
warning: Interfaces are changed from route mode to mix mode. Please reboot the device or all nodes in the HA cluster!
[edit security zones security-zone untrust]
'interfaces ge-0/0/2.0'
Interface ge-0/0/2.0 must have the same family as other interfaces in the zone
error: configuration check-out failed
接口2，也一样，也删掉
[edit security zones security-zone untrust]
root# delete interfaces ge-0/0/2.0
[edit security zones security-zone untrust]
root# show
screen untrust-screen;
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
dhcp;
tftp;
http;
ping;
}
}
}
}
然后提交
[edit security zones security-zone untrust]
root# exit
[edit]
root# commit
warning: Interfaces are changed from route mode to mix mode. Please reboot the device or all nodes in the HA cluster!
commit complete
终于清净了 ， 重启
guration mode
root> request system reboot
Reboot the system ? [yes,no] (no) yes
Shutdown NOW!
现在开始：从GE-0/0/3口到Ge-0/0/15口下的配置都没了，Ge-0/0/0口用于带外管理，Ge-0/0/1口和Ge-0/0/2口都还没划入区域；安全策略还未加；
在web界面，定义trust-yewu和untrust-yewu区域，并将接口划入分别划入这两个区域，并做安全策略
可是我怎么测都达不到理想效果 ，？？？，然后我看了一眼有没有没commit 的配置
root# show | compare
[edit security policies]
+ from-zone untrust_yewu to-zone trust_yewu {
+ policy permit1701 {
+ match {
+ source-address any;
+ destination-address any;
+ application [ tcp1701 udp1701 ];
+ }
+ then {
+ permit;
+ }
+ }
+ policy deny_any {
+ match {
+ source-address any;
+ destination-address any;
+ application any;
+ }
+ then {
+ deny;
+ }
+ }
+ }
+ from-zone trust_yewu to-zone untrust_yewu {
+ policy trust-to-untrust {
+ match {
+ source-address any;
+ destination-address any;
+ application any;
+ }
+ then {
+ permit;
+ }
+ }
+ }
- from-zone trust to-zone untrust {
- policy trust-to-untrust {
- match {
- source-address any;
- destination-address any;
- application any;
- }
- then {
- permit;
- }
- }
- }
- from-zone untrust to-zone trust {
- policy permit1701 {
- match {
- source-address any;
- destination-address any;
- application [ tcp1701 udp1701 ];
- }
- then {
- permit;
- }
- }
- policy deny_any {
- match {
- source-address any;
- destination-address any;
- application any;
- }
- then {
- deny;
- }
- }
- }
[edit security zones]
security-zone untrust { ... }
+ security-zone untrust_yewu {
+ interfaces {
+ ge-0/0/2.0;
+ }
+ }
+ security-zone trust_yewu {
+ interfaces {
+ ge-0/0/1.0;
+ }
+ }
[edit]
root# commit
commit complete
[edit]
root#
还不少，。。。web界面的action里面有一个commit，需要点一下 。。。 折磨人 。 。 。
然后测试成功。。。
本文编写的意义：为遇到相同问题的后来者提供一些解决问题的途径
由于Ge-0/0/0.0已经配置为3层管理接口，所以它所在的区域就不能放其他二层业务接口了 ， 不然就会出现如下错误：
Interface ge-0/0/1.0 must have the same family as other interfaces in the zone
error: configuration check-out failed
所以需要另外建立区域来放二层业务端口
