企业网环境中,客户通常会部署多条运营商线路。同一台服务器的不同端口会通过不同运营商线的线路发布出去。也有客户会问:无法通过ISP2的地址管理设备。我们通过简单的路由实例就可以实现这一要求。

实验拓扑:    

JUNIPER SRX双ISP部署Destination-nat配置实验1.0_第1张图片


实验需求:1.客户通过电信访问服务器8080端口,通过联通ip访问服务器80端口;

               2.(后续)SRX监控电信的443端口,一旦443单口被封掉,业务立即切换到联通ip的443。

实验配置:

1.接口:

set interfaces ge-0/0/0 unit 0 family inet address 1.1.1.2/24

set interfaces ge-0/0/1 unit 0 family inet address 10.10.10.2/24

set interfaces ge-0/0/2 unit 0 family inet address 172.16.10.1/24

2.主路由inet.0:

set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1

set routing-options static route 172.188.10.0/24 next-hop st0.1

3.路由实例:

set routing-options interface-routes rib-group inet share

set routing-options rib-groups share import-rib inet.0

set routing-options rib-groups share import-rib isp2.inet.0

set routing-instances isp2 instance-type virtual-router

set routing-instances isp2 interface ge-0/0/1.0

set routing-instances isp2 routing-options static route 0.0.0.0/0 next-hop 10.10.10.1

4.NAT设置:

set security nat source rule-set 1 from zone trust

set security nat source rule-set 1 to zone untrust

set security nat source rule-set 1 rule 1 match source-address 0.0.0.0/0

set security nat source rule-set 1 rule 1 match destination-address 0.0.0.0/0

set security nat source rule-set 1 rule 1 then source-nat interface

set security nat source rule-set 2 from zone trust

set security nat source rule-set 2 to zone isp2

set security nat source rule-set 2 rule 2 match source-address 0.0.0.0/0

set security nat source rule-set 2 rule 2 match destination-address 0.0.0.0/0

set security nat source rule-set 2 rule 2 then source-nat interface

set security nat destination pool test address 172.16.10.2/32

set security nat destination pool test address port 23

set security nat destination pool test_web address 172.16.10.2/32

set security nat destination pool test_web address port 8080

set security nat destination rule-set 1 from zone isp2

set security nat destination rule-set 1 rule 1 match destination-address 10.10.10.2/32

set security nat destination rule-set 1 rule 1 match destination-port 23

set security nat destination rule-set 1 rule 1 then destination-nat pool test

set security nat destination rule-set 2 from zone untrust

set security nat destination rule-set 2 rule 2 match destination-address 1.1.1.2/32

set security nat destination rule-set 2 rule 2 match destination-port 8080

set security nat destination rule-set 2 rule 2 then destination-nat pool test_web

实验验证:

1.测试联通线路NAT端口。实验环境就用telnet的23号端口做测试。从2.2.2.2上telnet 10.10.10.2 23端口登录到了server:

JUNIPER SRX双ISP部署Destination-nat配置实验1.0_第2张图片

查看10.10.10.2上的NAT HIT:

JUNIPER SRX双ISP部署Destination-nat配置实验1.0_第3张图片

nat装换成功。

查看10.10.10.2上的会话:

JUNIPER SRX双ISP部署Destination-nat配置实验1.0_第4张图片

2.测试电信线路8080端口,用web代替。远端pc浏览器输入1.1.1.2端口8080跳转到了server的web管理界面:

JUNIPER SRX双ISP部署Destination-nat配置实验1.0_第5张图片

JUNIPER SRX双ISP部署Destination-nat配置实验1.0_第6张图片


正常的业务流量就通过电线的ip出去:

正常.png

老司机们经常会提到一个问题,就是xx环境不太好,考虑到实际情况下运营商物理线路很少会出问题,后续针对500和433端口会做一些SRX上面的rpm实验,进而更加优化主备***和地址映射等相关功能。