Netscreen配置VIP

NS设备默认有三种NAT方式：DIP、MIP、VIP。其中：

DIP用于针对NAT-scr方式的地址映射（连接发起端的NAT方式）；

MIP用于针对主机地址的映射；

VIP用于针对服务的映射。

本文的主要内容是针对VIP的映射方式进行下面的叙述的。 

实验设备： 
 

端口配置：

ns204-> get int all

box is not in pure_l2_mode

A - Active, I - Inactive, U - Up, D - Down, R - Ready

Total interface: 13

Name         IP Address         Zone        MAC            VLAN State VSD

eth1           0.0.0.0/0          Trust       0012.1ea0.0ae0        -   D   -

eth2           192.168.2.1/24     Untrust    0012.1ea0.0ae5        -   U   -

eth3           0.0.0.0/0          Untrust     0012.1ea0.0ae6        -   D   -

eth4           192.168.1.1/24     Trust       0012.1ea0.0ae7        -   U   -

vlan1          0.0.0.0/0          VLAN     0012.1ea0.0aef        1   D   - 

具体操作步骤：

1）首先登陆WEB UI，进入Network->Interfaces界面： 

2）选定Untrust区域的网络接口—本例是eth2，进入其Basic页面： 

3）切换至VIP分页，在Virtual IP Address栏输入VIP NAT后的地址（注意：这个地址一定要与你的NAT出口同一网段，但系统默认不支持使用与NAT出口同一地址，具体内容请参照本文最后的“小技巧”部分），本例使用的是192.168.2.3，按Add按钮添加： 

4）添加完成后可以在主页面偏下方看到我们添加的VIP记录，设置VIP---在主页面右上角有一个New VIP Service的按钮，点击它… 

5）在Virtual IP中选定我们刚新建好的、VIP NAT后的地址；Virtual Port中输入VIP NAT后的传输层端口；Map to Service是我们需要映射的传输层端口（这个可以在NetScreen设备的Objects->Services->Custom中自行定义）；Map to IP中输入我们要映射的主机IP地址；Server Auto Detection用于防火墙以PING的方式检测该Map to IP的主机是否‘存在’的功能（作用不大…）；按OK按钮进入下一步操作… 

6）现在我们回到VIP的主界面后就可以观赏到一条完整的VIP记录了： 

7）建立了VIP后需要定义一条策略使其生效，进入Policies页面，建立一条Untrust到Global的策略：Source Address=Any；Destination Address=VIP(192.168.2.3)；Service=Any；Application=None；Action=Permit；（忽略其它通用的选项）… 

8）建立后我们可以在Policies主界面看到该策略： 

9）现在我们重新回到eth2的VIP界面，可以看到我们原来新建的那条VIP记录的Status了吧？J 
 

下面提供一个我在项目实施中的具体案例：

拓扑： 

cfg配置：

set clock timezone 0

set vrouter trust-vr sharable

unset vrouter "trust-vr" auto-route-export

set service "20" protocol tcp src-port 0-65535 dst-port 20-20

set service "21" protocol tcp src-port 0-65535 dst-port 21-21

set service "8023" protocol tcp src-port 0-65535 dst-port 8023-8023

set service "80" protocol tcp src-port 0-65535 dst-port 80-80

set service "80" + udp src-port 0-65535 dst-port 80-80

set service "6633" protocol tcp src-port 0-65535 dst-port 6633-6633

set service "6633" + udp src-port 0-65535 dst-port 6633-6633

set service "1554" protocol tcp src-port 0-65535 dst-port 1554-1554

set service "1554" + udp src-port 0-65535 dst-port 1554-1554

set service "3389" protocol tcp src-port 0-65535 dst-port 3389-3389

set service "3389" + udp src-port 0-65535 dst-port 3389-3389

set auth-server "Local" id 0

set auth-server "Local" server-name "Local"

set auth default auth server "Local"

set admin name "netscreen"

set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn"

set admin auth timeout 10

set admin auth server "Local"

set admin format dos

set zone "Trust" vrouter "trust-vr"

set zone "Untrust" vrouter "trust-vr"

set zone "DMZ" vrouter "trust-vr"

set zone "VLAN" vrouter "trust-vr"

set zone "Trust" tcp-rst

set zone "Untrust" block

unset zone "Untrust" tcp-rst

set zone "MGT" block

set zone "DMZ" tcp-rst

set zone "VLAN" block

set zone "VLAN" tcp-rst

set zone "Untrust" screen tear-drop

set zone "Untrust" screen syn-flood

set zone "Untrust" screen ping-death

set zone "Untrust" screen ip-filter-src

set zone "Untrust" screen land

set zone "V1-Untrust" screen tear-drop

set zone "V1-Untrust" screen syn-flood

set zone "V1-Untrust" screen ping-death

set zone "V1-Untrust" screen ip-filter-src

set zone "V1-Untrust" screen land

set interface "ethernet1" zone "Untrust"

set interface "ethernet2" zone "Trust"

set interface "ethernet3" zone "Untrust"

set interface "ethernet4" zone "MGT"

unset interface vlan1 ip

set interface ethernet1 ip 211.139.236.75/29

set interface ethernet1 route

set interface ethernet2 ip 10.250.188.141/24

set interface ethernet2 nat

set interface ethernet4 ip 9.9.9.9/24

set interface ethernet4 route

unset interface vlan1 bypass-others-ipsec

unset interface vlan1 bypass-non-ip

set interface ethernet1 ip manageable

set interface ethernet2 ip manageable

set interface ethernet1 manage ping

unset interface ethernet2 manage snmp

unset interface ethernet2 manage ssl

set interface ethernet1 vip 211.139.236.78 80 "HTTP" 10.250.188.11

set interface ethernet1 vip 211.139.236.78 + 20 "20" 10.250.188.11

set interface ethernet1 vip 211.139.236.78 + 21 "21" 10.250.188.11

set interface ethernet1 vip 211.139.236.78 + 8023 "8023" 10.250.188.11

set interface ethernet1 vip 211.139.236.78 + 6633 "6633" 10.250.188.11

set interface ethernet1 vip 211.139.236.78 + 1554 "1554" 10.250.188.12

set interface ethernet1 vip 211.139.236.78 + 3389 "3389" 10.250.188.10

set hostname ns204

set ike respond-bad-spi 1

set policy id 3 from "Untrust" to "Trust"  "Any" "VIP(211.139.236.78)" "ANY" permit log

set policy id 3 disable

set policy id 1 from "Trust" to "Untrust"  "Any" "Any" "ANY" permit log

set policy id 2 from "Untrust" to "Global"  "Any" "VIP(211.139.236.78)" "ANY" permit log

set pki authority default scep mode "auto"

set pki x509 default cert-path partial

set log module system level emergency destination console

set log module system level alert destination console

set log module system level critical destination console

set log module system level error destination console

set log module system level warning destination console

set log module system level notification destination console

set log module system level information destination console

set log module system level debugging destination console

set log module system level error destination webtrends

set log module system level warning destination webtrends

set log module system level information destination webtrends

set log module system level debugging destination webtrends

set firewall log-self

set ssh version v2

set config lock timeout 5

set snmp port listen 161

set snmp port trap 162

set vrouter "untrust-vr"

exit

set vrouter "trust-vr"

unset add-default-route

set route  0.0.0.0/0 interface ethernet1 gateway 211.139.236.73

exit 

*小技巧

正常来讲，NetScreen防火墙的中高端型号（NS204或以上）是不支持将VIP映射后的IP地址绑定在该接口的物理接口IP上的（只允许与该IP同一网段），但最近一次偶然的机会让我和我的同事发现到就算是中高端型号的设备也能达成这样的效果：打个比方，我们的需求是将内网的192.168.1.2的TCP80端口映射到防火墙外网接口192.168.2.1的TCP80端口，首先我们将防火墙的外网接口设置为192.168.2.2（与192.168.2.1同一网段，让VIP绑定在192.168.2.1能顺利进行），然后设置该接口的VIP---将192.168.1.2的TCP80端口映射到192.168.2.1的TCP80端口，保存这些设置后重新进入外网接口的设置界面，将其IP修改为192.168.2.1，再次保存…整个过程完成。