//设备登陆
Console口(通用超级终端缺省配置)连接SRX，root用户登陆，密码为空<初始第一次登陆>
login: root
Password:
root% cli /***进入操作模式***/
root> configure /***进入配置模式***/
Root#
//设备恢复出厂介绍
首先根据上述操作进入到配置模式,执行下列命令：
root# load factory-default
warning: activating factory configuration /***系统激活出厂配置***/
恢复出厂后,必须立刻设置 ROOT 帐号密码<默认密码至少 6 位数：字母加数字>
root# set system root-authentication plain-text-password
New password:
当设置完 ROOT 帐号密码以后,进行保存激活配置
root# commit
commit complete
在此需要提醒配置操作员注意，系统恢复出厂后并不代表没有任何配置,系统缺省配置有 Screen\DHCP\Policy
等相关配置,你如果需要完整的删除,可以执行命令 delete 删除相关配置。通过 show 来查看系统是否还有遗留
不需要的配置,可以一一进行删除,直到符合你的要求,然后再重新根据实际需求进行配置。
//配置root用户口令
root# set system root-authentication plain-text-password
root# new password : chenrui123
root# retype new password: chenrui123
//配置远程登录
root# set system login user chenrui class super-user authentication plain-text-password
root# new password : 1qaz@WSX
root# retype new password: 1qaz@WSX
——————————————————————————————————–
//其他
set system time-zone Asia/Shanghai //设置时区
run set date 201610100906.59 //设置时间
root#set system host-name SRX-650-1 /***设置主机名***/
root#set system name-server 8.8.8.8 /***设置 DNS 服务器***/
root#set system services telnet /***在系统级开启telnet远程接入管理服务***/
//端口配置IP
set interfaces ge-0/0/0.0 family inet address 10.1.1.1/24
set interfaces ge-0/0/0 unit 0 family inet address 10.1.1.1/24
set interfaces lo0 unit 0 family inet address 192.168.100.1/24
/***配置逻辑接口地址及缺省路由，SRX 接口要求 IP 地址必须配置在逻辑接口下（类似 ScreenOS 的子接口），
通常使用逻辑接口 0 即可***/
set routing-options static route 192.168.200/0 next-hop 1.1.1.2
/***将 ge-0/0/0.0 接口放到安全区域中***/
set security zones security-zone trust interfaces ge-0/0/0.0
/***在 untrust zone 打开允许远程登陆管理服务,SRX 要求基于 Zone 开放，从 SRX 主动访问出去流量开启服务***/
set security zones security-zone trust host-inbound-traffic system-services ping
set security zones security-zone trust host-inbound-traffic system-services http
set security zones security-zone trust host-inbound-traffic system-services telnet
——————————————————————————————————–
//策略地址对象定义
SRX 服务网关地址对象需要自定义后才可以在策略中进行引用,默认只有 any 对象
自定义单个地址对象如下：
root# set security zones security-zone trust address-book address pc-1 20.1.1.200/32
root# set security zones security-zone trust address-book address pc-2 20.1.1.210/32
自定义单个地址组对象如下：
root# set security zones security-zone trust address-book address-set pc-group address pc-1
root# set security zones security-zone trust address-book address-set pc-group address pc-2
//策略服务对象定义
SRX 服务网关部分服务对象需要自定义后才可以在策略中进行引用,默认仅有预定义常用服务对象
自定义单个服务对象如下：
set applications application tcp-3389 protocol tcp 定义服务对象协议<TCP\UDP\ICMP\OTHER>
set applications application tcp-3389 source-port 1-65535 定义服务对象源端口
set applications application tcp-3389 destination-port 3389-3389 定义服务对象目标地址
set applications application tcp-3389 inactivity-timeout never 可选定义服务对象 timeout 时长
set applications application tcp-8080 protocol tcp
set applications application tcp-8080 source-port 1-65535
set applications application tcp-8080 destination-port 8080-8080
set applications application tcp-8080 inactivity-timeout 3600
//自定义单个服务组对象如下：
set applications application-set aaplications-group application tcp-8080
set applications application-set aaplications-group application tcp-3389
//策略时间调度对象定义
SRX 服务网关时间调度对象需要自定义后才可以在策略中进行引用,默认没有预定义时间调度对象
自定义单个时间调度对象如下：
set schedulers scheduler work-time daily start-time 09:00:00 stop-time 18:00:00
set schedulers scheduler happy-time sunday start-time 00:00:00 stop-time 23:59:59
set schedulers scheduler happy-time saturday start-time 00:00:00 stop-time 23:59:59
//配置域间策略
set security policies from-zone trust to-zone untrust policy 1 match source-address any
set security policies from-zone trust to-zone untrust policy 1 match destination-address any
set security policies from-zone trust to-zone untrust policy 1 match application any
set security policies from-zone trust to-zone untrust policy 1 then permit
set security policies from-zone untrust to-zone trust policy 1 match source-address any
set security policies from-zone untrust to-zone trust policy 1 match destination-address any
set security policies from-zone untrust to-zone trust policy 1 match application any
set security policies from-zone untrust to-zone trust policy 1 then permit