Shulou(Shulou.com)06/01 Report--

By default, all Zone belong to the Trunst-VR virtual router

View the virtual router of the firewall

Ns5gt- > get vrouter

Since the firewall needs to link multiple ZOne, the unreachable ZOne belongs to different network segments. If interworking between Zone is required, the firewall needs routing.

Juniper Firewall static Route configuration

Ns5gt- > set route 12.1.1.0 amp 24 gateway 10.1.1.1

Ns5gt- > set vrouter trust-vr

Ns5gt (trust-vr)-> set route 10.3.1.0 Plus 24 gateway 10.1.1.1

View entries learned by static rout

Ns5gt (trust-vr)-> get route protocol static

Juniper defines address groups and address groups

a. Define an address

Ns5gt- > set address untrust 172.16.1.1 172.16.1.1 Universe 32

Ns5gt- > set address untrust 172.16.2.1 172.16.2.1 Universe 32

b. Define an address group

Ns5gt- > set group address untrust huda add 172.16.1.1ns5gt-> set group address untrust huda add 172.16.2.1

Add address groups and address groups through the WEBUI interface

c. Apply the policy from public network to private network ns5gt- > set policy from untrust to home huda any any permit

d. All services from the application public network to the Home section are entered.

Ns5gt- > set policy from untrust to home any any any permit

View Policy

Ns5gt- > get policy

Delete Policy

Ns5gt- > unset policy id 6

Configure the layer 3 functions of Juniper Firewall

a. Create a Zone (if the default Zone is not used)

Ns5gt- > set zone name kang

b. Establish an interface, divide the interface into the Zone, and configure the IP address

Ns5gt- > set interface loopback.1 zone kang

Ns5gt- > set interface lo.1 ip 1.1.1.1 Compact 32

c. Configure static routes for firewalls

Ns5gt- > set route 10.1.2.0Compact 24 interface eth4 gateway 192.168.1.1

View commands on the third floor

1. View route entries to the destination host

Ns5gt- > get route ip 10.1.2.1

two。 View the route entries that arrive at the destination segment

Ns5gt- > get route prefix 10.1.2.0 Compact 24

3. View static route entries

Ns5gt- > get route protocol static

Trace rout

Ns5gt- > trace-route 192.168.1.12

Debug Information of Juniper Firewall

1.Debug information can monitor the packets of traffic sent by the network in real time.

The default Juniper firewall Debug information is placed in the cache

Configuration of 2.Deug information:

a. Open Debug information

Ns5gt- > debug flow basic

b. View DB's cache

Ns5gt- > get db stream

c. View the status of the DB cache

Ns5gt- > get db info

d. Set the size of the DB cache

Ns5gt- > set db size 4096

e. Clear cache count

Ns5gt- > clear dbuf

f. Output Debug information directly through Console interface

Ns5gt- > unset console dbuf

Configure Juniper Firewall flow filtering

Flow Filter:

a. Based on IP address

b. Based on TCP/ UDP port number

c. Based on IP protocol number

Ns5gt- > undebug all

Turn off all Debug messages

View the detailed process of a packet passing through a firewall through Debug information

a. Set up Flow Filter

Ns5gt- > set ff src-ip 192.168.1.12

b. View Flow Filter

Ns5gt- > get ff

c. Open the information of Debug

Ns5gt- > debug flow basic

d. Clear the cache of DB

Ns5gt- > clear dbuf

Detailed process

Inspection of 1.Screen Filter

Packet passed sanity check

two。 Find out if there is a session

Flow got session

3. Find route entry

4. Find Policy

5. Find a normal NAT

6. Establish Session

7. Routed packet

8. Resolve the MAC address of the next-hop IP (using ARP)

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.