企业网环境中，客户通常会部署多条运营商线路。同一台服务器的不同端口会通过不同运营商线的线路发布出去。也有客户会问:无法通过ISP2的地址管理设备。我们通过简单的路由实例就可以实现这一要求。
实验拓扑：
实验需求：1.客户通过电信访问服务器8080端口，通过联通ip访问服务器80端口；
2.（后续）SRX监控电信的443端口，一旦443单口被封掉，业务立即切换到联通ip的443。
实验配置：
1.接口：
set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.2/24
set interfaces ge-0/0/1 unit 0 family inet address 10.10.10.2/24
set interfaces ge-0/0/2 unit 0 family inet address 172.16.10.1/24
2.主路由inet.0：
set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1
set routing-options static route 172.188.10.0/24 next-hop st0.1
3.路由实例：
set routing-options interface-routes rib-group inet share
set routing-options rib-groups share import-rib inet.0
set routing-options rib-groups share import-rib isp2.inet.0
set routing-instances isp2 instance-type virtual-router
set routing-instances isp2 interface ge-0/0/1.0
set routing-instances isp2 routing-options static route 0.0.0.0/0 next-hop 10.10.10.1
4.NAT设置：
set security nat source rule-set 1 from zone trust
set security nat source rule-set 1 to zone untrust
set security nat source rule-set 1 rule 1 match source-address 0.0.0.0/0
set security nat source rule-set 1 rule 1 match destination-address 0.0.0.0/0
set security nat source rule-set 1 rule 1 then source-nat interface
set security nat source rule-set 2 from zone trust
set security nat source rule-set 2 to zone isp2
set security nat source rule-set 2 rule 2 match source-address 0.0.0.0/0
set security nat source rule-set 2 rule 2 match destination-address 0.0.0.0/0
set security nat source rule-set 2 rule 2 then source-nat interface
set security nat destination pool test address 172.16.10.2/32
set security nat destination pool test address port 23
set security nat destination pool test_web address 172.16.10.2/32
set security nat destination pool test_web address port 8080
set security nat destination rule-set 1 from zone isp2
set security nat destination rule-set 1 rule 1 match destination-address 10.10.10.2/32
set security nat destination rule-set 1 rule 1 match destination-port 23
set security nat destination rule-set 1 rule 1 then destination-nat pool test
set security nat destination rule-set 2 from zone untrust
set security nat destination rule-set 2 rule 2 match destination-address 1.1.1.2/32
set security nat destination rule-set 2 rule 2 match destination-port 8080
set security nat destination rule-set 2 rule 2 then destination-nat pool test_web
实验验证：
1.测试联通线路NAT端口。实验环境就用telnet的23号端口做测试。从2.2.2.2上telnet 10.10.10.2 23端口登录到了server:
查看10.10.10.2上的NAT HIT：
nat装换成功。
查看10.10.10.2上的会话：
2.测试电信线路8080端口，用web代替。远端pc浏览器输入1.1.1.2端口8080跳转到了server的web管理界面：
正常的业务流量就通过电线的ip出去：
老司机们经常会提到一个问题，就是xx环境不太好，考虑到实际情况下运营商物理线路很少会出问题，后续针对500和433端口会做一些SRX上面的rpm实验，进而更加优化主备***和地址映射等相关功能。