API tools faq
paste
Advertisement
Guest User

Juniper-1

a guest
Apr 14th, 2014
332
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.18 KB | None | 0 0
raw download clone embed print report
  1. ## Last changed: 2014-04-14 12:07:03 MSK
  2. version 12.1X44.3;
  3. system {
  4. host-name st-petersburg;
  5. domain-name ariel.ru;
  6. time-zone Europe/Moscow;
  7. root-authentication {
  8. encrypted-password "password";
  9. }
  10. name-server {
  11. 192.168.70.254;
  12. }
  13. services {
  14. ssh;
  15. xnm-clear-text;
  16. web-management {
  17. http {
  18. interface [ vlan.0 fe-0/0/0.0 ];
  19. }
  20. https {
  21. system-generated-certificate;
  22. interface vlan.0;
  23. }
  24. }
  25. dhcp {
  26. pool 192.168.10.0/24 {
  27. address-range low 192.168.10.33 high 192.168.10.254;
  28. default-lease-time 36000;
  29. domain-name domain.loc;
  30. name-server {
  31. 8.8.8.8;
  32. }
  33. router {
  34. 192.168.10.1;
  35. }
  36. }
  37. }
  38. }
  39. syslog {
  40. archive size 100k files 3;
  41. user * {
  42. any emergency;
  43. }
  44. file messages {
  45. any critical;
  46. authorization info;
  47. }
  48. file interactive-commands {
  49. interactive-commands error;
  50. }
  51. }
  52. max-configurations-on-flash 5;
  53. max-configuration-rollbacks 5;
  54. license {
  55. autoupdate {
  56. url https://ae1.juniper.net/junos/key_retrieval;
  57. }
  58. }
  59. ntp {
  60. server 62.76.96.4;
  61. server 212.248.127.94;
  62. server 89.179.120.132;
  63. }
  64. }
  65. interfaces {
  66. fe-0/0/0 {
  67. unit 0 {
  68. family inet {
  69. address Juniper-1_IP/29;
  70. }
  71. }
  72. }
  73. fe-0/0/1 {
  74. unit 0 {
  75. family ethernet-switching {
  76. vlan {
  77. members vlan-trust;
  78. }
  79. }
  80. }
  81. }
  82. fe-0/0/2 {
  83. unit 0 {
  84. family ethernet-switching {
  85. vlan {
  86. members vlan-trust;
  87. }
  88. }
  89. }
  90. }
  91. fe-0/0/3 {
  92. unit 0 {
  93. family ethernet-switching {
  94. vlan {
  95. members vlan-trust;
  96. }
  97. }
  98. }
  99. }
  100. fe-0/0/4 {
  101. unit 0 {
  102. family ethernet-switching {
  103. vlan {
  104. members vlan-trust;
  105. }
  106. }
  107. }
  108. }
  109. fe-0/0/5 {
  110. unit 0 {
  111. family ethernet-switching {
  112. vlan {
  113. members vlan-trust;
  114. }
  115. }
  116. }
  117. }
  118. fe-0/0/6 {
  119. unit 0 {
  120. family ethernet-switching {
  121. vlan {
  122. members vlan-trust;
  123. }
  124. }
  125. }
  126. }
  127. fe-0/0/7 {
  128. unit 0 {
  129. family ethernet-switching {
  130. vlan {
  131. members vlan-trust;
  132. }
  133. }
  134. }
  135. }
  136. st0 {
  137. unit 0 {
  138. family inet;
  139. family inet6;
  140. }
  141. unit 1 {
  142. family inet;
  143. }
  144. }
  145. vlan {
  146. unit 0 {
  147. family inet {
  148. address 192.168.10.1/24;
  149. }
  150. }
  151. }
  152. }
  153. routing-options {
  154. static {
  155. route 0.0.0.0/0 next-hop gateway;
  156. route 192.168.31.0/24 next-hop st0.0;
  157. route 192.168.70.0/24 next-hop st0.0;
  158. route 172.17.20.0/24 next-hop st0.0;
  159. route 172.17.23.0/24 next-hop st0.0;
  160. route 192.168.11.0/24 next-hop st0.1;
  161. }
  162. }
  163. protocols {
  164. stp;
  165. }
  166. security {
  167. ike {
  168. proposal ike-sklad {
  169. authentication-method pre-shared-keys;
  170. dh-group group2;
  171. authentication-algorithm sha1;
  172. encryption-algorithm aes-128-cbc;
  173. }
  174. policy ike_pol_podolsk {
  175. mode main;
  176. proposal-set standard;
  177. pre-shared-key ascii-text "key";
  178. }
  179. policy ike_pol_sklad {
  180. mode main;
  181. proposals ike-sklad;
  182. pre-shared-key ascii-text "key";
  183. }
  184. gateway gw_podolsk {
  185. ike-policy ike_pol_podolsk;
  186. address linux_box_ip;
  187. dead-peer-detection {
  188. always-send;
  189. interval 20;
  190. threshold 5;
  191. }
  192. external-interface fe-0/0/0.0;
  193. }
  194. gateway gw-sklad {
  195. ike-policy ike_pol_sklad;
  196. address Juniper-2-ip;
  197. external-interface fe-0/0/0.0;
  198. }
  199. }
  200. ipsec {
  201. vpn-monitor-options;
  202. proposal ipsec-sklad {
  203. protocol esp;
  204. authentication-algorithm hmac-sha1-96;
  205. encryption-algorithm aes-128-cbc;
  206. }
  207. policy ipsec_pol_podolsk {
  208. perfect-forward-secrecy {
  209. keys group2;
  210. }
  211. proposal-set standard;
  212. }
  213. policy ipsec-pol-sklad {
  214. perfect-forward-secrecy {
  215. keys group2;
  216. }
  217. proposals ipsec-sklad;
  218. }
  219. vpn podolsk {
  220. bind-interface st0.0;
  221. ike {
  222. gateway gw_podolsk;
  223. ipsec-policy ipsec_pol_podolsk;
  224. }
  225. establish-tunnels immediately;
  226. }
  227. vpn ike-sklad {
  228. bind-interface st0.1;
  229. ike {
  230. gateway gw-sklad;
  231. ipsec-policy ipsec-pol-sklad;
  232. }
  233. establish-tunnels immediately;
  234. }
  235. }
  236. screen {
  237. ids-option untrust-screen {
  238. icmp {
  239. ping-death;
  240. }
  241. ip {
  242. source-route-option;
  243. tear-drop;
  244. }
  245. tcp {
  246. syn-flood {
  247. alarm-threshold 1024;
  248. attack-threshold 200;
  249. source-threshold 1024;
  250. destination-threshold 2048;
  251. timeout 20;
  252. }
  253. land;
  254. }
  255. }
  256. }
  257. nat {
  258. source {
  259. rule-set trust-to-untrust {
  260. from zone trust;
  261. to zone untrust;
  262. rule source-nat-rule {
  263. match {
  264. source-address 0.0.0.0/0;
  265. }
  266. then {
  267. source-nat {
  268. interface;
  269. }
  270. }
  271. }
  272. }
  273. }
  274. }
  275. policies {
  276. from-zone trust to-zone untrust {
  277. policy trust-to-untrust {
  278. match {
  279. source-address any;
  280. destination-address any;
  281. application any;
  282. }
  283. then {
  284. permit;
  285. }
  286. }
  287. }
  288. from-zone trust to-zone trust {
  289. policy policy_out_podolsk {
  290. match {
  291. source-address addr_192_168_10_0_24;
  292. destination-address [ addr_192_168_31_0_24 addr_192_168_70_0_24 addr_172_17_20_0_24 addr_172_17_23_0_24 addr_192_168_10_0_24 addr_192_168_11_0_24 ];
  293. application any;
  294. }
  295. then {
  296. permit;
  297. }
  298. }
  299. policy policy_in_podolsk {
  300. match {
  301. source-address [ addr_192_168_11_0_24 addr_192_168_31_0_24 addr_192_168_70_0_24 addr_172_17_20_0_24 addr_172_17_23_0_24 addr_192_168_10_0_24 ];
  302. destination-address addr_192_168_10_0_24;
  303. application any;
  304. }
  305. then {
  306. permit;
  307. }
  308. }
  309. }
  310. }
  311. zones {
  312. security-zone trust {
  313. address-book {
  314. address addr_192_168_10_0_24 192.168.10.0/24;
  315. address addr_192_168_11_0_24 192.168.11.0/24;
  316. address addr_192_168_31_0_24 192.168.31.0/24;
  317. address addr_192_168_70_0_24 192.168.70.0/24;
  318. address addr_172_17_20_0_24 172.17.20.0/24;
  319. address addr_172_17_23_0_24 172.17.23.0/24;
  320. }
  321. host-inbound-traffic {
  322. system-services {
  323. all;
  324. }
  325. protocols {
  326. all;
  327. }
  328. }
  329. interfaces {
  330. vlan.0;
  331. st0.0;
  332. }
  333. }
  334. security-zone untrust {
  335. screen untrust-screen;
  336. interfaces {
  337. fe-0/0/0.0 {
  338. host-inbound-traffic {
  339. system-services {
  340. dhcp;
  341. tftp;
  342. ping;
  343. ssh;
  344. http;
  345. }
  346. }
  347. }
  348. }
  349. }
  350. }
  351. }
  352. vlans {
  353. vlan-trust {
  354. vlan-id 3;
  355. l3-interface vlan.0;
  356. }
  357. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!