netscreen 外網訪問VIP配置

1、編輯interface

Network > Interfaces (List)

	List 5102050100 per page
	List  ALL(5)Layer2(0)Layer3(3)Loopback(0)Physical(3)Tunnel(1)Unused(1)VSI(0) Interfaces	LoopbackIFTunnel IFVSIIF

 

 

Name IP/Netmask Zone Type Link Configure serial 0.0.0.0/0 Null Unused down Edit   trust 172.2.1.254/24 Trust Layer3 up Edit   tunnel.1 unnumbered Untrust Tunnel ready Edit   untrust 58.2.24.246/32 Untrust Layer3 up Edit   vlan1 0.0.0.0/0 VLAN Layer3 down Edit

2、配置untrust

Network > Interfaces > Edit

 

	Interface: untrust (IP/Netmask: 58.2.24.246/32)	Back To Interface List
	Properties:  Basic    MIP     DIP     VIP     Track IP     Track IP Options

 

 

 

 

 

3、建立VIP

Network > Interface > Edit > VIP/VIP Services

Interface: untrust (IP/Netmask: 58.2.24.246/32)	Back To Interface List
	Properties:  Basic     MIP     DIP     VIP    Track IP     Track IP Options

 

 

VIP VIP Services IP Address Configure Virtual Port Service(Port) Server IP Status Configure 58.2.24.246 Edit In use 9080 was (9080) 172.2.1.110... OK Edit Remove

 

 

這是已配置好的VIP，先增加一個VIP，再增加VIP Services，外網連接埠9080,映射服務連接埠為was(9080)，映射內網主機為172.2.1.110

 

 

4、配置存取原則

 

From Untrust To Global, total policy: 1 ID Source Destination Service Action Options Configure Enable Move 5 Any VIP::1 ANY Permit"> Edit Clone Remove

 

這是已配置好的存取原則policies，方向為Untrust 到Global

 

5、存取原則配置

 

6、服務連接埠定製custom，即上面的VIP：：1

Objects > Services > Custom

 

Name Transport Protocol and Parameters Timeout (min) Configure was TCP src port: 0-65535, dst port: 9080-9080 default[30] Edit In Use

 

詳細配置：

Service Name
Service Timeout	Use protocol default Never Custom (minutes)
No. Transport protocol Source Port Destination Port ICMP Low High Low High Type Code 1 none TCP UDP ICMP other 2 none TCP UDP ICMP other 3 none TCP UDP ICMP other 4 none TCP UDP ICMP other 5 none TCP UDP ICMP other 6 none TCP UDP ICMP other 7 none TCP UDP ICMP other 8 none TCP UDP ICMP other