Shulou(Shulou.com)06/01 Report--

Several common functions of Juniper firewall mainly refer to the implementation of policy-based NAT, including MIP, VIP and DIP. These three common functions are mainly applied to the servers protected by the firewall to provide external services.

MIP

MIP is an one-to-one two-way address translation (translation) process. The usual situation is: when you have several public network IP addresses, and there are a number of servers that provide network services (servers use private IP addresses), in order to achieve Internet users to access these servers, you can establish an one-to-one mapping (MIP) between public network IP addresses and server private IP addresses on the firewall at the Internet exit, and implement access control to the services provided by the server through policies.

VIP

MIP is a public network IP address corresponding to a private IP address, which is an one-to-one mapping relationship, while VIP is a mapping relationship between different ports of a public network IP address (protocol ports such as 21,25,110, etc.) and different service ports of multiple internal private IP addresses. It is usually used in servers with only a few public network IP addresses but multiple private IP addresses, and these servers need to provide a variety of services.

DIP

The application of DIP is generally in the access of internal network and external network. When the internal network port of the firewall is deployed in NAT mode, the access from the internal network to the external network through the firewall will be automatically converted into the IP address of the external network port of the firewall equipment, and the access to the external network (Internet) will be realized. This application has some limitations. The solution to this limitation is DIP, which dynamically translates to IP addresses in a continuous public network IP address pool when the internal network IP address is accessed. The configuration of DIP is even better, especially when there are dual links in your network.

Note: each ip address can only be one role. If VIP is configured, it can no longer be used as DIP. In addition, MIP, DIP and VIP are all configured through APIs and referenced through policies.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.