Juniper SRX300上的源NAT

Question

在我的SRX300防火墙上设置源代码NAT有问题。防火墙通过0/6端口中的光纤电缆连接到LC面板。我在该接口上设置了公共ip，并配置了dns服务器和默认网关。另外，我在端口0/3上运行了一个DHCP服务器。SRX有一个连接，可以对远程主机进行ping，将一个设备连接到端口0/3将从池中给它一个IP地址。端口3上的设备可以平SRX，但不能到达公共互联网，我相信我在我的源NAT配置中遗漏了一些东西。

以下是我的nat安全性(203.0.113.192/30 )：

security {
    nat {
        source {
            pool src-nat-pool-1 {
                address {
                    203.0.113.192/30;
                }
            }
            rule-set rs1 {
                from zone trust;
                to zone untrust;
                rule r1 {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            pool {
                                src-nat-pool-1;
                            }
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
            policy internet-access {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/2.0;
                ge-0/0/3.0;
                ge-0/0/4.0;
                ge-0/0/5.0;
                ge-0/0/6.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
        }
        security-zone untrust {
            screen untrust-screen;
        }
    }
}

相关接口配置如下：

interfaces {
    ge-0/0/3 {
        unit 0 {
            family inet {
                address 192.168.3.1/24;
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family inet {
                address 203.0.113.192/30;
            }
        }
    }
}

遗憾的是，我甚至连翻译的热门作品都找不到。

Answer 1

你好，欢迎来到NetworkEngineering！

1. 在SNAT配置中将source-nat pool...更改为source-nat interface。
2. 将ge-0/0/6.0接口从信任区域移到不信任区域。

编辑

delete security nat source rule-set rs1 rule r1 then source-nat
set security nat source rule-set rs1 rule r1 then source-nat interface

delete security zones security-zone trust interfaces ge-0/0/6.0
set security zones security-zone untrust interfaces ge-0/0/6.0