JUNIPER SRX雙ISP部署Destination-nat配置實驗1.0

    企業網環境中，客戶一般會部署多條運營商線路。同一臺服務器的不一樣端口會經過不一樣運營商線的線路發佈出去。也有客戶會問:沒法經過ISP2的地址管理設備。咱們經過簡單的路由實例就能夠實現這一要求。

實驗拓撲：    

實驗需求：1.客戶經過電信訪問服務器8080端口，經過聯通ip訪問服務器80端口；

               2.（後續）SRX監控電信的443端口，一旦443單口被封掉，業務當即切換到聯通ip的443。

實驗配置：

1.接口：

set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.2/24

set interfaces ge-0/0/1 unit 0 family inet address 10.10.10.2/24

set interfaces ge-0/0/2 unit 0 family inet address 172.16.10.1/24

2.主路由inet.0：

set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1

set routing-options static route 172.188.10.0/24 next-hop st0.1

3.路由實例：

set routing-options interface-routes rib-group inet share

set routing-options rib-groups share import-rib inet.0

set routing-options rib-groups share import-rib isp2.inet.0

set routing-instances isp2 instance-type virtual-router

set routing-instances isp2 interface ge-0/0/1.0

set routing-instances isp2 routing-options static route 0.0.0.0/0 next-hop 10.10.10.1

4.NAT設置：

set security nat source rule-set 1 from zone trust

set security nat source rule-set 1 to zone untrust

set security nat source rule-set 1 rule 1 match source-address 0.0.0.0/0

set security nat source rule-set 1 rule 1 match destination-address 0.0.0.0/0

set security nat source rule-set 1 rule 1 then source-nat interface

set security nat source rule-set 2 from zone trust

set security nat source rule-set 2 to zone isp2

set security nat source rule-set 2 rule 2 match source-address 0.0.0.0/0

set security nat source rule-set 2 rule 2 match destination-address 0.0.0.0/0

set security nat source rule-set 2 rule 2 then source-nat interface

set security nat destination pool test address 172.16.10.2/32

set security nat destination pool test address port 23

set security nat destination pool test_web address 172.16.10.2/32

set security nat destination pool test_web address port 8080

set security nat destination rule-set 1 from zone isp2

set security nat destination rule-set 1 rule 1 match destination-address 10.10.10.2/32

set security nat destination rule-set 1 rule 1 match destination-port 23

set security nat destination rule-set 1 rule 1 then destination-nat pool test

set security nat destination rule-set 2 from zone untrust

set security nat destination rule-set 2 rule 2 match destination-address 1.1.1.2/32

set security nat destination rule-set 2 rule 2 match destination-port 8080

set security nat destination rule-set 2 rule 2 then destination-nat pool test_web

實驗驗證：

1.測試聯通線路NAT端口。實驗環境就用telnet的23號端口作測試。從2.2.2.2上telnet 10.10.10.2 23端口登陸到了server:

查看10.10.10.2上的NAT HIT：

nat裝換成功。

查看10.10.10.2上的會話：

2.測試電信線路8080端口，用web代替。遠端pc瀏覽器輸入1.1.1.2端口8080跳轉到了server的web管理界面：

正常的業務流量就經過電線的ip出去：

老司機們常常會提到一個問題，就是xx環境不太好，考慮到實際狀況下運營商物理線路不多會出問題，後續針對500和433端口會作一些SRX上面的rpm實驗，進而更加優化主備***和地址映射等相關功能。