Juniper SRX Firewall Common commands

Rollback

Set interface

Set Routing-options static

Set System login user admin class Super-user

Set System login User admin authentication plain-text-password Enter password

Set System Services SSH

Set security Zones security-zone untrust host-inbound-traffic system-services ssh/ping

Set security zones Security-zone Untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh/telnet/ping

Set security Zones Security-zone Trust host-inbound-traffic system-services ssh/telnet/ping

Set security zones Security-zone interfaces ge-0/0/1.0 host-inbound-traffic system-services ssh/telnet/ping

Set security zones Security-zone Untrust Interfaces ge-0/0/0 (no zone defined, NAT cannot be configured)

Set security zones Security-zone Trust Interfaces GE-0/0/1

###### Set security Zones Security-zone Trust Interfaces GE-0/0/1???

###### Set Interfaces Interface-range interfaces-trust member GE-0/0/1????

##################################################

Static NAT:

Set security Nat source Rule-set Interface-nat from Zone

Set security Nat Source Rule-set Interface-nat to zone untrust

Set security Nat Source Rule-set Interface-nat rule rule1 match source-address 192.168.0.0/23

Set security Nat Source Rule-set Interface-nat rule rule1 match destination-address 0.0.0.0/0

Set security Nat Source Rule-set Interface-nat Rule rule1 then Source-nat interface

Set security zones Security-zone Address-book address 192 192.168.0.0/23

Set security Zones Security-zone Address-book address-set 192nat address 192

Set security policies From-zone To-zone untrust policy 192nat match source-address any

Set security policies From-zone To-zone untrust policy 192nat match destination-address any

Set security policies From-zone To-zone untrust policy 192nat match application any

Set security policies From-zone To-zone untrust policy 192nat then permit

#######################################################

Forced 172.16.0.12 to go out 150 (Default walk physical interface 146 go out)

Set security NAT Source Pool Pool-1 Address 121.9.255.112

Set security Nat Source Rule-set Sou-nat rule rule-mail match source-address 172.16.0.12/32

Set security Nat Source Rule-set Sou-nat rule rule-mail match destination-address 0.0.0.0/0

Set security Nat Source Rule-set Sou-nat rule rule-mail then Source-nat pool pool-1

Insert security Nat Source Rule-set Sou-nat rule rule-mail before rule Rule-sou

##########################################################

Port mapping static Pat: from outside to inside

Set security Nat Proxy-arp interface ge-0/0/0.0 address 10.1.1.100/24

Set security Nat Proxy-arp interface ge-0/0/3.0 address 10.1.2.100/24

Set security NAT Destination Pool DNAT-POOL-1 address 192.168.0.9/32

Set security NAT Destination Pool Dnat-pool-2 address 172.16.0.12/32

Set security Nat destination Rule-set Dst-nat from Zone untrust

Set security Nat Destination Rule-set Dst-nat rule rule3 match destination-address 10.1.1.100/24

Set security Nat Destination Rule-set Dst-nat rule rule3 match destination-port 21

Set security Nat Destination rule-set Dst-nat rule rule3 then Destination-nat pool dnat-pool-1

Set security Nat Destination Rule-set Dst-nat rule rule2 match destination-address 10.1.2.100/24

Set security Nat Destination Rule-set Dst-nat rule rule2 match destination-port 443

Set security Nat Destination rule-set Dst-nat rule rule2 then Destination-nat pool Dnat-pool-2

Set security zones security-zone Address-book address Ftpserver 192.168.0.9

Set security zones security-zone Address-book address MailServer 172.16.0.12

Set security Zones Security-zone Address-book address-set ServerGroup address Ftpserver

Set security Zones Security-zone Address-book address-set ServerGroup address mailserver

Set security policies From-zone Untrust To-zone trust policy Static-nat match source-address any destination-address serve Rgroup Application Junos-http

Set security policies From-zone Untrust To-zone Trust policy static-nat match application Junos-pop3

Set security policies From-zone Untrust To-zone Trust policy Static-nat then permit

Set applications application 443 protocol TCP

Set applications application 443 Destination-port 443

##############################################################

Set security Nat source Rule-set Sou-nat from Zone

Set security Nat Source Rule-set Sou-nat to zone untrust

Set security Nat Source Rule-set Sou-nat rule rule-mail match source-address 172.16.0.30/32

Set security Nat Source Rule-set Sou-nat rule rule-mail match destination-address 0.0.0.0/0

Set security Nat Source Rule-set Sou-nat rule rule-mail then Source-nat pool pool-1

##############################################################