juniper srx650防护防火墙公网IP被攻击方法

内网通过源地址的NAT上网，通常情况下，这个公网IP是防火墙的IP，即内网公网IP。这个IP默认情况下管理员为了便于管理，会打开http、https、ssh等端口。这样容易被外网的人猜测到密码。现采取以下措施：
　　开放系统的相关服务：
　　set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh
　　set system services ssh
　　set system services telnet
　　set system services web-management http interface ge-0/0/3.0
　　set system services web-management https system-generated-certificate
　　set system services web-management https interface ge-0/0/1.0
　　set security zones security-zone trust host-inbound-traffic system-services all
　　set security zones security-zone trust host-inbound-traffic protocols all
　　set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services dhcp
　　set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ping
　　set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services http
　　set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services https
　　set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ssh
　　现思路如下：
　　将该公网的ip的服务关闭，然后将防火墙内网IP的管理端口映射到其它公网的某个端口
　　delete security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh
　　/*/建立元素
　　set security zones security-zone trust address-book address juniper2541 192.168.254.1/32
　　#建立NAT
　　set security nat destination pool 2541 address 192.168.254.1/32
　　set security nat destination pool 2541 address port 22
　　set security nat destination rule-set 1 rule 2541 match source-address 0.0.0.0/0
　　set security nat destination rule-set 1 rule 2541 match destination-address 113.106.95.x/32
　　set security nat destination rule-set 1 rule 2541 match destination-port 1055
　　set security nat destination rule-set 1 rule 2541 then destination-nat pool 2541
　　#建立策略
　　set security policies from-zone untrust to-zone trust policy yc2541 match source-address any
　　set security policies from-zone untrust to-zone trust policy yc2541 match destination-address juniper2541
　　set security policies from-zone untrust to-zone trust policy yc2541 match application juniper1055
　　set security policies from-zone untrust to-zone trust policy yc2541 then permit

亿恩科技地址(ADD)：郑州市黄河路129号天一大厦608室 邮编(ZIP)：450008 传真(FAX)：0371-60123888
   联系：亿恩小凡
   QQ：89317007
   电话:0371-63322206
 

服务器租用/服务器托管中国五强！虚拟主机域名注册顶级提供商！15年品质保障！--亿恩科技[ENKJ.COM]