TechTalkSecurity

 

 

 SRX Configuration: Interface: set interfaces ge-0/0/0 unit 0 family inet address 192.168.0.184/24 set routing-instances untrust interface ge-0/0/0.0 set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ike set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ping set security zones security-zone untrust interfaces lo0.0 set interfaces lo0 unit 0 family inet address 11.11.11.1/24 set routing-instances untrust interface lo0.0 set interfaces st0 unit 0 family inet address 1.1.1.1/24 set security zones security-zone untrust interfaces st0.0 set routing-instances untrust interface st0.0 Routing: set routing-instances untrust routing-options static route 2.2.2.0/24 next-hop st0.0 VPN: Phase1: set security ike proposal P1 authentication-method pre-shared-keys set security ike proposal P1 dh-group group2 set security ike proposal P1 authentication-algorithm sha-256 set security ike proposal P1 en...

Configuration: NAT:  set security nat static rule-set StaticNAT from zone untrust set security nat static rule-set StaticNAT rule StNAT match source-address 192.168.0.109/32 set security nat static rule-set StaticNAT rule StNAT match destination-address 3.3.3.0/24 set security nat static rule-set StaticNAT rule StNAT then static-nat prefix 11.11.11.0/24 set security nat static rule-set StaticNAT rule StNAT then static-nat prefix routing-instance untrust Security Policy (untrust to untrust): set security policies from-zone untrust to-zone untrust policy allow match source-address any set security policies from-zone untrust to-zone untrust policy allow match destination-address any set security policies from-zone untrust to-zone untrust policy allow match application junos-icmp-all set security policies from-zone untrust to-zone untrust policy allow then permit Proxy ARP for the external pool: set security nat proxy-arp interface ge-0/0/0.0 address 3.3.3.1/32 to 3.3.3.254/32