1） Junper SRX 防火墙，默认 License 支持2个××× 并发连接。

2） Juniper SRX 防火墙的软件版本需要注意下，测试时发现 12.1X46-D40.2 有问题，因为测试设备是SRX210HE，在高的版本升级不上去，使用版本 12.1X44-D60.2 没问题。


配置：


set access profile dyn-***-access-profile client ***user1 firewall-user password "***userpassword01"

set access profile dyn-***-access-profile address-assignment pool dyn-***-address-pool

set access address-assignment pool dyn-***-address-pool family inet network 192.168.11.0/24  //×××拨入获得的地址池

set access address-assignment pool dyn-***-address-pool family inet xauth-attributes primary-dns 192.168.22.2/32  //×××拨入获得的DNS地址

set access firewall-authentication web-authentication default-profile dyn-***-access-profile


set security ike policy ike-dyn-***-policy mode aggressive

set security ike policy ike-dyn-***-policy proposal-set compatible 

set security ike policy ike-dyn-***-policy pre-shared-key ascii-text "***-share-key"  //设置一个share key，测试结果，拨号客户端不需要输入该值

set security ike gateway dyn-***-local-gw ike-policy ike-dyn-***-policy

set security ike gateway dyn-***-local-gw dynamic hostname Internet-FW-01  // 该值最好和防火墙的主机名一样

set security ike gateway dyn-***-local-gw dynamic connections-limit 2  //具体数值不要超过license数值

set security ike gateway dyn-***-local-gw dynamic ike-user-type group-ike-id

set security ike gateway dyn-***-local-gw external-interface ge-0/0/0  //设置××× Gateway的接口，一般是设置对外接口，Untrust

set security ike gateway dyn-***-local-gw xauth access-profile dyn-***-access-profile

set security ipsec policy ipsec-dyn-***-policy proposal-set compatible

set security ipsec *** dyn-*** ike gateway dyn-***-local-gw

set security ipsec *** dyn-*** ike ipsec-policy ipsec-dyn-***-policy


set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match source-address any

set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match destination-address any

set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match application any

set security policies from-zone Untrust to-zone Trust policy dyn-***-policy then permit tunnel ipsec-*** dyn-***


set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services ike

set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services https

set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services ping


set security dynamic-*** access-profile dyn-***-access-profile

set security dynamic-*** clients all remote-protected-resources 192.168.0.0/24  //设置哪些地址走×××

set security dynamic-*** clients all remote-exceptions 0.0.0.0/0  //设置哪些地址不走×××

set security dynamic-*** clients all ipsec-*** dyn-***

set security dynamic-*** clients all user ***user1 //此处的用户是刚刚创建过的本地账户



show system license  //查看License状态

show security dynamic-*** users //查看×××拨号的用户情况

show security ike security-associations //查看IKE阶段的情况

show security ipsec security-associations  //查看IPSec阶段的情况，感觉没啥太大用，拨号不成功，看这ike和ipsec协商情况也没啥太好下手解决问题的办法，最好是看类似于ScreenOS系统看***拨号日志，但是还没找到SRX上面命令或者其他方法。


set system service web-management management-url MGT //因为开启了***，默认登录就变成***了，需要单独做一下管理的URL