从零上手Juniper SRX300防火墙：手把手配置内网上网（含DHCP、安全策略）
当你第一次拆开Juniper SRX300防火墙的包装时，这台银色金属外壳的设备可能会让你感到既兴奋又忐忑。作为一款在企业级市场广受好评的防火墙，SRX300以其出色的性能和灵活的配置选项著称，但对于新手来说，它的CLI界面和Juniper特有的配置语法可能会形成一道门槛。本文将带你一步步完成从开箱到内网上网的全过程配置，重点关注那些实际部署中最容易卡壳的环节。
1. 设备初始化与基础配置
刚拿到SRX300时，设备处于出厂状态，我们需要通过Console线连接进行初始配置。使用PuTTY或SecureCRT等终端工具，设置波特率为9600，数据位8，无奇偶校验，停止位1，流控无。
连接成功后，你会看到root@%的提示符，这时设备处于操作模式。输入以下命令进入配置模式：
cli configure首先进行最基本的系统设置：
# 设置主机名 set system host-name SRX300-GW01 # 配置时区（亚洲/上海） set system time-zone Asia/Shanghai # 设置root密码（会提示输入两次） set system root-authentication plain-text-password注意：Juniper设备在配置密码时不会显示输入的字符，这是正常的安全设计。
建议同时创建一个管理员账户，避免总是使用root账户：
set system login user admin class super-user set system login user admin authentication plain-text-password网络设备的时间同步非常重要，配置NTP服务器：
set system ntp server 0.pool.ntp.org set system ntp server 1.pool.ntp.org最后提交配置并保存：
commit save2. 网络接口规划与配置
SRX300的接口配置需要明确三个关键概念：
- 安全区域(Security Zone)：定义接口的信任级别
- VLAN：用于逻辑划分网络
- IRB接口：三层虚拟接口，用于VLAN间路由
假设我们的网络拓扑如下：
- ge-0/0/0：连接互联网（untrust区域）
- ge-0/0/1：连接内网交换机（trust区域）
- 192.168.10.0/24：内网IP段
- DHCP范围：192.168.10.100-192.168.10.200
首先删除出厂默认配置：
delete interfaces ge-0/0/0 unit 0 delete interfaces ge-0/0/1 unit 0然后配置untrust区域（外网接口）：
# 创建VLAN set vlans vlan-untrust vlan-id 10 set vlans vlan-untrust l3-interface irb.10 # 将物理接口划入VLAN set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members vlan-untrust # 配置IRB接口 set interfaces irb unit 10 family inet address 203.0.113.2/24 # 配置默认路由 set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1接着配置trust区域（内网接口）：
# 创建VLAN set vlans vlan-trust vlan-id 20 set vlans vlan-trust l3-interface irb.20 # 将物理接口划入VLAN set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan-trust # 配置IRB接口 set interfaces irb unit 20 family inet address 192.168.10.1/24最后将接口分配到安全区域：
set security zones security-zone untrust interfaces irb.10 set security zones security-zone trust interfaces irb.203. DHCP服务配置
内网用户需要自动获取IP地址，配置DHCP服务：
# 创建DHCP地址池 set access address-assignment pool lan-pool family inet network 192.168.10.0/24 set access address-assignment pool lan-pool family inet range dhcp-range low 192.168.10.100 set access address-assignment pool lan-pool family inet range dhcp-range high 192.168.10.200 # 设置DHCP选项 set access address-assignment pool lan-pool family inet dhcp-attributes router 192.168.10.1 set access address-assignment pool lan-pool family inet dhcp-attributes name-server 8.8.8.8 set access address-assignment pool lan-pool family inet dhcp-attributes name-server 8.8.4.4 # 将DHCP服务绑定到内网接口 set access address-assignment pool lan-pool family inet dhcp-attributes propagate-settings irb.20允许trust区域的DHCP流量：
set security zones security-zone trust host-inbound-traffic system-services dhcp4. NAT与安全策略配置
这是最关键也是最容易出问题的部分。我们需要配置两项核心功能：
- 源NAT(SNAT)：将内网IP转换为公网IP
- 安全策略：允许内网访问互联网
首先配置源NAT：
# 创建NAT地址池（使用接口地址） set security nat source rule-set trust-to-untrust from zone trust set security nat source rule-set trust-to-untrust to zone untrust set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 192.168.10.0/24 set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface然后配置安全策略：
# 允许内网访问互联网 set security policies from-zone trust to-zone untrust policy allow-outbound match source-address 192.168.10.0/24 set security policies from-zone trust to-zone untrust policy allow-outbound match destination-address any set security policies from-zone trust to-zone untrust policy allow-outbound match application any set security policies from-zone trust to-zone untrust policy allow-outbound then permit # 允许必要的管理流量 set security policies from-zone trust to-zone trust policy allow-management match source-address 192.168.10.0/24 set security policies from-zone trust to-zone trust policy allow-management match destination-address 192.168.10.0/24 set security policies from-zone trust to-zone trust policy allow-management match application junos-ssh set security policies from-zone trust to-zone trust policy allow-management match application junos-http set security policies from-zone trust to-zone trust policy allow-management match application junos-https set security policies from-zone trust to-zone trust policy allow-management then permit提示：在生产环境中，应该根据最小权限原则细化安全策略，而不是简单地允许所有流量。
5. 系统服务与管理配置
为了方便后续管理，我们需要开启一些必要的服务：
# 开启SSH服务（推荐禁用root直接登录） set system services ssh set system services ssh root-login deny set system services ssh protocol-version v2 # 开启Web管理界面（J-Web） set system services web-management http interface irb.20 set system services web-management https interface irb.20 # 允许管理流量 set security zones security-zone trust host-inbound-traffic system-services ssh set security zones security-zone trust host-inbound-traffic system-services http set security zones security-zone trust host-inbound-traffic system-services https set security zones security-zone trust host-inbound-traffic system-services ping配置系统日志服务器（可选但推荐）：
set system syslog host 192.168.10.100 any any set system syslog host 192.168.10.100 port 514最后，不要忘记提交并保存所有配置：
commit save6. 验证与排错
配置完成后，需要进行全面测试：
内网设备能否获取IP地址
- 连接内网设备，检查是否获得192.168.10.x的IP
- 在SRX上运行：
show system services dhcp server statistics
测试互联网连接
- 从内网ping一个公网IP（如8.8.8.8）
- 检查NAT转换：
show security nat source rule all
检查安全策略匹配
- 查看策略命中计数：
show security policies hit-count
- 查看策略命中计数：
常见问题排查命令：
# 查看接口状态 show interfaces terse # 检查路���表 show route # 查看安全策略匹配情况 show security match-policies source-ip 192.168.10.100 destination-ip 8.8.8.8 # 检查系统日志 show log messages | last 50如果遇到配置问题，可以回滚到之前的版本：
rollback 1 commit7. 进阶配置建议
完成基础配置后，可以考虑以下增强措施：
1. 配置DDNS服务对于动态公网IP的环境，可以配置动态DNS：
set system ddns-adapter dyndns hostname yourhost.dyndns.org set system ddns-adapter dyndns login yourusername set system ddns-adapter dyndns password yourpassword set system ddns-adapter dyndns server updates.dyndns.org set system ddns-adapter dyndns interface irb.102. 启用流量监控配置NetFlow/sFlow流量分析：
set protocols sflow polling-interval 60 set protocols sflow sample-rate 1000 set protocols sflow collector 192.168.10.100 port 6343 set protocols sflow interfaces ge-0/0/0 set protocols sflow interfaces ge-0/0/13. 设置带宽限制对特定应用或用户进行带宽控制：
set class-of-service schedulers best-effort transmit-rate percent 30 set class-of-service schedulers best-effort buffer-size percent 30 set class-of-service interfaces ge-0/0/0 scheduler-map wan-scheduler4. 配置VPN接入设置IPSec VPN供远程办公使用：
set security ike proposal ike-proposal1 authentication-method pre-shared-keys set security ike proposal ike-proposal1 dh-group group2 set security ike proposal ike-proposal1 authentication-algorithm sha-256 set security ike proposal ike-proposal1 encryption-algorithm aes-256-cbc set security ike policy ike-policy1 mode main set security ike policy ike-policy1 proposals ike-proposal1 set security ike policy ike-policy1 pre-shared-key ascii-text "YourSharedSecret"在实际部署SRX300时，我发现最常遇到的问题往往出在安全策略和NAT配置的配合上。特别是在升级Junos版本后，某些语法可能会有细微变化，建议在重大变更前先在小规模环境测试。
