Juniper SRX动态VPN配置
转载请注明：本文出自www.xuexizu.com配置脚本root@ITAA# show | no-more
## Last changed: 2002-01-09 05:10:52 UTC
version 12.1X46-D10.2;
system {
host-name ITAA;
root-authentication {
encrypted-password "$1$G5/tL57r$/.BmhuyouGi7l2DlQv.8X0"; ## SECRET-DATA
}
name-server {
208.67.222.222;
208.67.220.220;
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
http {
interface vlan.0;
}
https {
system-generated-certificate;
interface vlan.0;
}
}
dhcp {
router {
192.168.1.1;
}
pool 192.168.1.0/24 {
address-range low 192.168.1.2 high 192.168.1.254;
}
propagate-settings fe-0/0/0.0;
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
}
interfaces {
fe-0/0/0 {
unit 0 {
family inet {
address 100.1.1.1/24;
}
}
}
fe-0/0/1 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/2 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/3 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/4 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/5 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/6 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/7 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
vlan {
unit 0 {
family inet {
address 192.168.1.1/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 100.1.1.254;
}
}
protocols {
stp;
}
security {
ike {
policy client-vpn-ike-pol {
mode aggressive;
proposal-set standard;
pre-shared-key ascii-text "$9$LWxx-w4aUji.vW"; ## SECRET-DATA
}
gateway client-vpn-gw {
ike-policy client-vpn-ike-pol;
dynamic {
hostname itaadynvpn;
connections-limit 2;
ike-user-type group-ike-id;
}
external-interface fe-0/0/0.0;
xauth access-profile client-vpn-access-profile;
}
}
ipsec {
policy client-vpn-ipsec-pol {
proposal-set standard;
}
vpn client-vpn {
ike {
gateway client-vpn-gw;
ipsec-policy client-vpn-ipsec-pol;
}
}
}
dynamic-vpn {
access-profile client-vpn-access-profile;
clients {
all {
remote-protected-resources {
192.168.1.0/24;
}
remote-exceptions {
0.0.0.0/0;
}
ipsec-vpn client-vpn;
user {
itaa;
}
}
}
}
nat {
source {
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule source-nat-rule {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
proxy-arp {
interface vlan.0 {
address {
192.168.1.192/30;
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone trust {
policy client-vpn-access {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
tunnel {
ipsec-vpn client-vpn;
}
}
}
}
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.0;
}
}
security-zone untrust {
interfaces {
fe-0/0/0.0 {
host-inbound-traffic {
system-services {
ike;
https;
ping;
}
}
}
}
}
}
}
access {
profile client-vpn-access-profile {
client itaa {
firewall-user {
password "$9$Y3gaUk.5Qz6Vw.PTQn6lKv"; ## SECRET-DATA
}
}
address-assignment {
pool client-vpn-pool;
}
}
address-assignment {
pool client-vpn-pool {
family inet {
network 192.168.1.192/30;
xauth-attributes {
primary-dns 8.8.8.8/32;
}
}
}
}
firewall-authentication {
web-authentication {
default-profile client-vpn-access-profile;
}
}
}
vlans {
vlan-trust {
vlan-id 3;
l3-interface vlan.0;
}
}
root@ITAA# run show security dynamic-vpn client version
Junos Pulse 4.0.2.34169
root@ITAA# run show system license usage
Licenses Licenses Licenses Expiry
Feature name used installed needed
dynamic-vpn 1 2 0 permanent
ax411-wlan-ap 0 2 0 permanent
root@ITAA# run show security ike security-associations
Index StateInitiator cookieResponder cookieMode Remote Address
5147891 UP 4562194f6fbb08908ed18385b01ec19aAggressive 100.1.1.254
root@ITAA# run show security ipsec security-associations
Total active tunnels: 1
ID Algorithm SPI Life:sec/kbMon lsys PortGateway
<268173313 ESP:aes-cbc-128/sha1 5dcb207b 2756/500000 - root 51757 100.1.1.254
>268173313 ESP:aes-cbc-128/sha1 6e86077d 2756/500000 - root 51757 100.1.1.254
root@ITAA# run show security ipsec statistics
ESP Statistics:
Encrypted bytes: 1500
Decrypted bytes: 1500
Encrypted packets: 10
Decrypted packets: 10
AH Statistics:
Input bytes: 0
Output bytes: 0
Input packets: 0
Output packets: 0
Errors:
AH authentication failures: 0, Replay errors: 0
ESP authentication failures: 0, ESP decryption failures: 0
Bad headers: 0, Bad trailers: 0
路过了解一下 {:6_267:}
页:
[1]