업무이야기

SAISEI Configuration Sample 2021.03.29 1
Configuration Example – Site-to-site VPN between SRX and Cisco ASA (Policy-based VPN) 2021.03.16
Juniper request chassis cluster failover redundancy-group 2021.03.16
MonitorAPP 웹방화벽 동작 체크 방법 2021.01.29
Juniper EX4200 VLAN Configuration 2021.01.25
Could you please share us the below listed information to proceed further on this case. 2021.01.25
Juniper EX S/W Factory Reset 2021.01.25
To set up GRIP successfully, it is advised that you check the inline functions of each HC2 separately. 2021.01.25

SAISEI Configuration Sample

쫑콩아빠 2021. 3. 29. 21:39

2021. 3. 29. 21:39

SAISEI Config

stm1wins# show running_config
#
#
netflow_sender record
no description
no dynamic
max_flow_rate 0
name record
sample_rate 1
no policies
minimum_flow_size 0
no hidden
minimum_flow_duration 0.000
type csv
exit
#
#
ingress_flow_class games
geolocation
no minimum_rate
no next_hop_ases
no dynamic
no maximum_packets
egress_flow_class games
no minimum_total_bytes
no excluded_groups
no threat_level
no capture
no bad_source_internal
no maximum_rate
no final_ases
no bad_source_external
no hidden
initial_rate_plan
no minimum_duration
no description
no applications
minimum_distress 0
name games
no minimum_packets
no maximum_total_bytes
acl
top_host dontcare
no reputation
required_groups games
match_rate_plan
no threat_types
no maximum_duration
exit
ingress_flow_class other
geolocation
no minimum_rate
no next_hop_ases
no dynamic
no maximum_packets
egress_flow_class other
no minimum_total_bytes
no excluded_groups
no threat_level
no capture
no bad_source_internal
no maximum_rate
no final_ases
no bad_source_external
no hidden
initial_rate_plan
no minimum_duration
no description
no applications
minimum_distress 0
name other
no minimum_packets
no maximum_total_bytes
acl
top_host dontcare
no reputation
no required_groups
match_rate_plan
no threat_types
no maximum_duration
exit
ingress_flow_class speedtest
geolocation
no minimum_rate
no next_hop_ases
no dynamic
no maximum_packets
egress_flow_class speedtest
no minimum_total_bytes
no excluded_groups
no threat_level
no capture
no bad_source_internal
no maximum_rate
no final_ases
no bad_source_external
no hidden
initial_rate_plan
no minimum_duration
no description
no applications
minimum_distress 0
name speedtest
no minimum_packets
no maximum_total_bytes
acl
top_host dontcare
no reputation
required_groups speedtest
match_rate_plan
no threat_types
no maximum_duration
exit
ingress_flow_class streaming
geolocation
no minimum_rate
no next_hop_ases
no dynamic
no maximum_packets
egress_flow_class streaming
no minimum_total_bytes
no excluded_groups
no threat_level
no capture
no bad_source_internal
no maximum_rate
no final_ases
no bad_source_external
no hidden
initial_rate_plan
no minimum_duration
no description
no applications
minimum_distress 0
name streaming
no minimum_packets
no maximum_total_bytes
acl
top_host dontcare
no reputation
required_groups streaming
match_rate_plan
no threat_types
no maximum_duration
exit
ingress_flow_class updates
geolocation
no minimum_rate
no next_hop_ases
no dynamic
no maximum_packets
egress_flow_class updates
no minimum_total_bytes
no excluded_groups
no threat_level
no capture
no bad_source_internal
no maximum_rate
no final_ases
no bad_source_external
no hidden
initial_rate_plan
no minimum_duration
no description
no applications
minimum_distress 0
name updates
no minimum_packets
no maximum_total_bytes
acl
top_host dontcare
no reputation
required_groups updates
match_rate_plan
no threat_types
no maximum_duration
exit
ingress_flow_class voip
geolocation
no minimum_rate
no next_hop_ases
no dynamic
no maximum_packets
egress_flow_class voip
no minimum_total_bytes
no excluded_groups
no threat_level
no capture
no bad_source_internal
no maximum_rate
no final_ases
no bad_source_external
no hidden
initial_rate_plan
no minimum_duration
no description
no applications
minimum_distress 0
name voip
no minimum_packets
no maximum_total_bytes
acl
top_host dontcare
no reputation
required_groups voip
match_rate_plan
no threat_types
no maximum_duration
exit
ingress_flow_class Youtube
geolocation
no minimum_rate
no next_hop_ases
no dynamic
no maximum_packets
egress_flow_class Youtube
no minimum_total_bytes
no excluded_groups
no threat_level
no capture
no bad_source_internal
no maximum_rate
no final_ases
no bad_source_external
no hidden
initial_rate_plan
no minimum_duration
no description
applications youtube
minimum_distress 0
name Youtube
no minimum_packets
no maximum_total_bytes
acl Youtube
top_host dontcare
no reputation
no required_groups
match_rate_plan
no threat_types
no maximum_duration
exit
#
#
egress_policy_map external1.any_epm
no description
no dynamic
no hidden
name external1.any_epm
egress_policy games
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class games
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name games
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy other
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class other
no child_equalisation
downstream_cir 0
host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name other
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy speedtest
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class speedtest
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority override
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name speedtest
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy streaming
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class streaming
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name streaming
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 30.0
exit
egress_policy updates
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class updates
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority background
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name updates
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy voip
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class voip
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name voip
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 10.0
exit
egress_policy Youtube
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class Youtube
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name Youtube
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
exit
egress_policy_map external1_epm
no description
no dynamic
no hidden
name external1_epm
egress_policy games
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class games
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name games
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy other
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class other
no child_equalisation
downstream_cir 0
host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name other
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy speedtest
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class speedtest
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority override
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name speedtest
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy streaming
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class streaming
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name streaming
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 30.0
exit
egress_policy updates
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class updates
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority background
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name updates
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy voip
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class voip
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name voip
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 10.0
exit
egress_policy Youtube
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class Youtube
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name Youtube
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
exit
egress_policy_map internal1.any_epm
no description
no dynamic
no hidden
name internal1.any_epm
egress_policy games
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class games
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name games
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy other
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class other
no child_equalisation
downstream_cir 0
host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name other
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy speedtest
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class speedtest
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority override
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name speedtest
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy streaming
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class streaming
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name streaming
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 30.0
exit
egress_policy updates
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class updates
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority background
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name updates
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy voip
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class voip
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name voip
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 10.0
exit
egress_policy Youtube
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class Youtube
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name Youtube
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
exit
egress_policy_map internal1_epm
no description
no dynamic
no hidden
name internal1_epm
egress_policy games
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class games
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name games
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy other
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class other
no child_equalisation
downstream_cir 0
host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name other
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy speedtest
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class speedtest
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority override
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name speedtest
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy streaming
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class streaming
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name streaming
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 30.0
exit
egress_policy updates
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class updates
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority background
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name updates
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
egress_policy voip
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class voip
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority high
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name voip
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 10.0
exit
egress_policy Youtube
upstream_mir 0
upstream_cir 0
downstream_mir 0
no dynamic
egress_flow_class Youtube
no child_equalisation
downstream_cir 0
no host_equalisation
shaper_margin 10.0
priority normal
no hidden
no description
parent
no rate_multiplier
percent_mir 0.0
no control_peak
name Youtube
no shaped
enabled
secondary_parent
burst_threshold 30
percent_cir 0.0
exit
exit
#
#
management_interface mgmt0
no description
requested_system_interface enp11s0
allowed_subnets 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
no dynamic
pci_address 0000:0b:00.0
no hidden
name mgmt0
exit
#
#
egress_flow_class games
no hidden
no dynamic
no description
name games
exit
egress_flow_class other
no hidden
no dynamic
no description
name other
exit
egress_flow_class speedtest
no hidden
no dynamic
no description
name speedtest
exit
egress_flow_class streaming
no hidden
no dynamic
no description
name streaming
exit
egress_flow_class updates
no hidden
no dynamic
no description
name updates
exit
egress_flow_class voip
no hidden
no dynamic
no description
name voip
exit
egress_flow_class Youtube
no hidden
no dynamic
no description
name Youtube
exit
#
#
parameter_info internal_host_quiet_limit

exit

parameter_info model

exit

#
#
fib fib0
no parent_fib
no description
no dynamic
no permitted_hosts
no hidden
root
name fib0
exit
#
#
ingress_policy_map external1.any_ipm
no description
no dynamic
no hidden
name external1.any_ipm
ingress_policy games
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name games
reverse
ingress_flow_class games
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy other
sequence 9000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name other
reverse
ingress_flow_class other
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy speedtest
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name speedtest
reverse
ingress_flow_class speedtest
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy streaming
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name streaming
reverse
ingress_flow_class streaming
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy updates
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name updates
reverse
ingress_flow_class updates
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy voip
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name voip
reverse
ingress_flow_class voip
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy Youtube
sequence 1000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name Youtube
reverse
ingress_flow_class Youtube
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
exit
ingress_policy_map external1_ipm
no description
no dynamic
no hidden
name external1_ipm
ingress_policy games
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name games
reverse
ingress_flow_class games
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy other
sequence 9000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name other
reverse
ingress_flow_class other
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy speedtest
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name speedtest
reverse
ingress_flow_class speedtest
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy streaming
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name streaming
reverse
ingress_flow_class streaming
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy updates
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name updates
reverse
ingress_flow_class updates
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy voip
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name voip
reverse
ingress_flow_class voip
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy Youtube
sequence 1000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name Youtube
reverse
ingress_flow_class Youtube
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
exit
ingress_policy_map internal1.any_ipm
no description
no dynamic
no hidden
name internal1.any_ipm
ingress_policy games
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name games
reverse
ingress_flow_class games
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy other
sequence 9000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name other
reverse
ingress_flow_class other
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy speedtest
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name speedtest
reverse
ingress_flow_class speedtest
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy streaming
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name streaming
reverse
ingress_flow_class streaming
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy updates
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name updates
reverse
ingress_flow_class updates
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy voip
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name voip
reverse
ingress_flow_class voip
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy Youtube
sequence 1000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name Youtube
reverse
ingress_flow_class Youtube
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
exit
ingress_policy_map internal1_ipm
no description
no dynamic
no hidden
name internal1_ipm
ingress_policy games
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name games
reverse
ingress_flow_class games
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy other
sequence 9000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name other
reverse
ingress_flow_class other
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy speedtest
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name speedtest
reverse
ingress_flow_class speedtest
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy streaming
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name streaming
reverse
ingress_flow_class streaming
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy updates
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name updates
reverse
ingress_flow_class updates
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy voip
sequence 8000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name voip
reverse
ingress_flow_class voip
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
ingress_policy Youtube
sequence 1000
no dynamic
flow_rate_cap 0
no reverse_path_forward
minimum_delay 0.000
no dscp_rewrite
no postprocess
no hidden
policy_route_interface
no maximum_delay
no description
policy_route_address ::
chargeable dontcare
name Youtube
reverse
ingress_flow_class Youtube
ip_protocol_rewrite 0
no drop
enabled
fixed_rate 0
no no_police
exit
exit
#
#
condition 5M_over
no dynamic
no clearing_filter
no clear_attribute_value
no attribute_value
object_class interface
severity minor
script
delay 00:00:05.000
no hidden
no description
no name_filter
clearing_script
no mail_subject
no groups
no mail_address
no mail_body
no attribute_name
name 5M_over
clear_delay 00:00:01.000
no enabled
filter name=internal1,transmit_rate>500|receive_rate>500
no trap
no restore_attribute_value
exit
condition 90M_over
no dynamic
clearing_filter rate<90000
no clear_attribute_value
no attribute_value
object_class interface
severity minor
script
delay 00:01:00.000
no hidden
no description
no name_filter
clearing_script
no mail_subject
no groups
no mail_address
no mail_body
no attribute_name
name 90M_over
clear_delay 00:00:10.000
no enabled
filter receive_rate>90000
no trap
no restore_attribute_value
exit
condition Total_Rate_Monitorintg
no dynamic
no clearing_filter
no clear_attribute_value
no attribute_value
object_class application
severity minor
script
delay 00:00:30.000
no hidden
no description
no name_filter
clearing_script
mail_subject Application Total Rate exceeded 90Mbps
no groups
mail_address taks@w-ins.net
mail_body Application Total Rate exceeded 90Mbps
no attribute_name
name Total_Rate_Monitorintg
clear_delay 00:01:00.000
no enabled
filter total_rate>90000
no trap
no restore_attribute_value
exit
#
#
interface external1
no secondary_addresses
ingress_policy_map external1_ipm
no dynamic
unmatched_efc
outer_interface
no secondary_peer
dhcp_subnet 0.0.0.0/0
no port_forwarders
proxy_arp
requested_direction external
dhcp_default_gw 0.0.0.0
shaper_margin 10.0
rate 500000
state enabled
fib fib0
dhcp_low_range 0.0.0.0
no default_ipv4_gateway
no address_pools
no hidden
type ethernet
parent_efc
no description
dhcp_default_lease_time 00:00:00.000
primary_address ::/0
peer internal1
dhcp_broadcast_addr 0.0.0.0
no control_peak
name external1
shaped
arp_timeout 00:00:00.000
lag_interface
no dhcp_enabled
dhcp_max_lease_time 00:00:00.000
egress_policy_map external1_epm
dhcp_hi_range 0.0.0.0
no flash_led
exit
interface external1.any
no secondary_addresses
ingress_policy_map external1.any_ipm
no dynamic
outer_interface external1
no secondary_peer
dhcp_subnet 0.0.0.0/0
no port_forwarders
proxy_arp
requested_direction external
dhcp_default_gw 0.0.0.0
shaper_margin 10.0
rate 500000
state enabled
fib fib0
dhcp_low_range 0.0.0.0
no default_ipv4_gateway
no address_pools
no hidden
type vlan
parent_efc
unmatched_efc
no description
dhcp_default_lease_time 00:00:00.000
primary_address ::/0
peer internal1.any
dhcp_broadcast_addr 0.0.0.0
no control_peak
name external1.any
shaped
arp_timeout 00:00:00.000
lag_interface
no dhcp_enabled
dhcp_max_lease_time 00:00:00.000
egress_policy_map external1.any_epm
dhcp_hi_range 0.0.0.0
no flash_led
exit
interface internal1
no secondary_addresses
ingress_policy_map internal1_ipm
no dynamic
unmatched_efc
outer_interface
no secondary_peer
dhcp_subnet 0.0.0.0/0
no port_forwarders
proxy_arp
requested_direction internal
dhcp_default_gw 0.0.0.0
shaper_margin 10.0
rate 500000
state enabled
fib fib0
dhcp_low_range 0.0.0.0
no default_ipv4_gateway
no address_pools
no hidden
type ethernet
parent_efc
no description
dhcp_default_lease_time 00:00:00.000
primary_address ::/0
peer external1
dhcp_broadcast_addr 0.0.0.0
no control_peak
name internal1
shaped
arp_timeout 00:00:00.000
lag_interface
no dhcp_enabled
dhcp_max_lease_time 00:00:00.000
egress_policy_map internal1_epm
dhcp_hi_range 0.0.0.0
no flash_led
exit
interface internal1.any
no secondary_addresses
ingress_policy_map internal1.any_ipm
no dynamic
outer_interface internal1
no secondary_peer
dhcp_subnet 0.0.0.0/0
no port_forwarders
proxy_arp
requested_direction internal
dhcp_default_gw 0.0.0.0
shaper_margin 10.0
rate 500000
state enabled
fib fib0
dhcp_low_range 0.0.0.0
no default_ipv4_gateway
no address_pools
no hidden
type vlan
parent_efc
unmatched_efc
no description
dhcp_default_lease_time 00:00:00.000
primary_address ::/0
peer external1.any
dhcp_broadcast_addr 0.0.0.0
no control_peak
name internal1.any
shaped
arp_timeout 00:00:00.000
lag_interface
no dhcp_enabled
dhcp_max_lease_time 00:00:00.000
egress_policy_map internal1.any_epm
dhcp_hi_range 0.0.0.0
no flash_led
exit
#
#
administrator admin
encrypted_password $5$LBLoJGFsTPCf$ucn5TXXMFfMz.IkZtsT9EV/CKXihes1.Qw/pNMdSQ3B
no description
no dynamic
enabled
privilege superuser
no hidden
name admin
exit
administrator FlowCommand
encrypted_password $5$JUV7L/f1T4Y$Pq88P9JaDQN/0ei.vi6LH4rpE9SMHW2EfuKyAcI4q02
no description
no dynamic
enabled
privilege monitor
no hidden
name FlowCommand
exit
administrator sbbaek
encrypted_password $5$B5P5XoWFL4$Fg3pM7xmrS31UPouJZsbZ1Oq4EuzNG.AUb9DL0DrKg4
no description
no dynamic
enabled
privilege superuser
no hidden
name sbbaek
exit
#
#
application youtube
no track_in_history
priority 10000
no short_lived
protocol youtube
no description
no stop_dpi
no drop
no dynamic
server youtube%e|googlevideo.com|googlevideo.c|googlevideo.co
chargeable dontcare
track_users
no location
groups streaming
map_location
no hidden
no ports
no postprocess
name youtube
exit
#
#
group games
no nested_groups
no description
no dynamic
no track_in_history
no hidden
type app
name games
exit
group p2p
no nested_groups
no description
no dynamic
no track_in_history
no hidden
type app
name p2p
exit
group speedtest
no nested_groups
no description
no dynamic
no track_in_history
no hidden
type app
name speedtest
exit
group streaming
no nested_groups
no description
no dynamic
no track_in_history
no hidden
type app
name streaming
exit
group updates
no nested_groups
no description
no dynamic
no track_in_history
no hidden
type app
name updates
exit
group voip
no nested_groups
no description
no dynamic
no track_in_history
no hidden
type app
name voip
exit
#
#
script USER_LISTENER
no interval
no description
no persistent
file_name user_listener.py
no dynamic
no argument
no days
no start_times
no end_time
directory /etc/stmfiles/files/scripts
no hidden
run_on_boot
name USER_LISTENER
exit
#
#
user User-10.10.100.35
description tak
no dynamic
chargeable_bytes_base 0
quota 0
no track_in_history
no location
no groups
map_location
no hidden
name User-10.10.100.35
exit
#
#
acl Youtube
no subnets
no description
no dynamic
no hidden
no ports
name Youtube
exit
#
#
policy games
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
no host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 8000
no maximum_rate
priority high
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
no applications
no shaped
groups games
percent_mir 0.0
minimum_distress 0
no minimum_rate
name games
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 0.0
burst_threshold 30
attach_to_rate_plan
exit
policy other
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 9000
no maximum_rate
priority normal
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
no applications
no shaped
no groups
percent_mir 0.0
minimum_distress 0
no minimum_rate
name other
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 0.0
burst_threshold 30
attach_to_rate_plan
exit
policy p2p
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 8000
no maximum_rate
priority normal
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
no applications
no shaped
groups p2p
percent_mir 0.0
minimum_distress 0
no minimum_rate
name p2p
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 0.0
burst_threshold 30
attach_to_rate_plan
exit
policy speedtest
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
no host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 8000
no maximum_rate
priority override
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
no applications
no shaped
groups speedtest
percent_mir 0.0
minimum_distress 0
no minimum_rate
name speedtest
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 0.0
burst_threshold 30
attach_to_rate_plan
exit
policy streaming
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
no host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 8000
no maximum_rate
priority high
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
no applications
no shaped
groups streaming
percent_mir 0.0
minimum_distress 0
no minimum_rate
name streaming
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 30.0
burst_threshold 30
attach_to_rate_plan
exit
policy updates
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
no host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 8000
no maximum_rate
priority background
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
no applications
no shaped
groups updates
percent_mir 0.0
minimum_distress 0
no minimum_rate
name updates
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 0.0
burst_threshold 30
attach_to_rate_plan
exit
policy voip
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
no host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 8000
no maximum_rate
priority high
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
no applications
no shaped
groups voip
percent_mir 0.0
minimum_distress 0
no minimum_rate
name voip
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 10.0
burst_threshold 30
attach_to_rate_plan
exit
policy Youtube
geolocation
shared_partition
chargeable dontcare
no next_hop_ases
upstream_cir 0
downstream_mir 0
no dynamic
flow_rate_cap 0
no maximum_packets
no maximum_total_bytes
no excluded_groups
acl
host_downstream_mir 0
downstream_cir 0
no minimum_duration
no host_equalisation
no maximum_delay
shaper_margin 10.0
minimum_delay 0.000
sequence 1000
no maximum_rate
priority normal
no final_ases
no dscp_rewrite
no minimum_total_bytes
no hidden
no maximum_duration
initial_rate_plan
no ports
no subnets
policy_route_interface
host_upstream_cir 0
no description
parent
attach_to_tunnel
no rate_multiplier
attach_to_interface
applications youtube
no shaped
no groups
percent_mir 0.0
minimum_distress 0
no minimum_rate
name Youtube
policy_route_address ::
no threat_level
no minimum_packets
no drop
enabled
host_downstream_cir 0
host_upstream_mir 0
attach_to_access_point
top_host dontcare
no reputation
upstream_mir 0
no threat_types
percent_cir 0.0
burst_threshold 30
attach_to_rate_plan
exit
stm1wins#

저작자표시

'업무이야기 > etc' 카테고리의 다른 글

Eclipse2640 adminstrator configuration Guide (1)	2012.01.12
Cluster NAS Gateway(Scaleway) (1)	2011.11.03

Configuration Example – Site-to-site VPN between SRX and Cisco ASA (Policy-based VPN)

쫑콩아빠 2021. 3. 16. 11:29

2021. 3. 16. 11:29

Configuration for SRX

root# show |no-more
system {
     root-authentication {
        encrypted-password “$ABC123"; ## SECRET-DATA
    }
    services {
        ssh;
        telnet;
        }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
}
interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                address 100.1.1.2/24;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
           family inet {
                address 192.168.2.1/24;
            }
        }
    }

}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 100.1.1.1;
    }
}

security {
    ike {
        proposal ike-phase1-proposal {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 86400;
        }
        policy ike-phase1-policy {
            mode main;
            proposals ike-phase1-proposal;
            pre-shared-key ascii-text “$ABC123"; ## SECRET-DATA
        }
        gateway gw-chicago {
            ike-policy ike-phase1-policy;
            address 100.1.1.1;
            external-interface ge-0/0/0.0;
        }
    }
    ipsec {
        proposal ipsec-phase2-proposal {
            protocol esp;
            authentication-algorithm hmac-md5-96;
            encryption-algorithm des-cbc;
            lifetime-seconds 28800;
        }
        policy ipsec-phase2-policy {
            perfect-forward-secrecy {
                keys group2;
            }
            proposals ipsec-phase2-proposal;
        }
        vpn ike-vpn-chicago {
            ike {
                gateway gw-chicago;
                ipsec-policy ipsec-phase2-policy;
            }
            establish-tunnels immediately;
        }

    }
    policies {
        from-zone trust to-zone untrust {
           policy vpn-tr-untr {
                match {
                    source-address sunnyvale;
                    destination-address chicago;
                    application any;
                }
                then {
                    permit {
                        tunnel {
                            ipsec-vpn ike-vpn-chicago;
                        }
                    }
                }
            }

        }
        from-zone untrust to-zone trust {
            policy vpn-untr-tr {
                match {
                    source-address chicago;
                    destination-address sunnyvale;
                    application any;
                }
                then {
                    permit {
                        tunnel {
                            ipsec-vpn ike-vpn-chicago;
                        }
                    }
                }
            }

    }
    zones {
        security-zone trust {
            address-book {
                address sunnyvale 192.168.2.0/24;

           }
            host-inbound-traffic {
                system-services {
                    all;
                }
            }
            interfaces {
                ge-0/0/1.0;
            }
        }
        security-zone untrust {
            address-book {
                address chicago 192.168.1.0/24;
            }
            host-inbound-traffic {
                system-services {
                    ike;
                }
            }
            interfaces {
                ge-0/0/0.0;
            }
        }
    }

}

VPN Configuration for Cisco ASA

(Only VPN related config included)
Interface Configuration:
------------------------------------------------------------------------------------------------------------------

!
interface GigabitEthernet0
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0

!
interface GigabitEthernet1
nameif outside
security-level 0
ip address 100.1.1.1 255.255.255.0
!

Policy Configuration :   ------------------------------------------------------------------------------------------------------------------
access-list s2s extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

IPSEC/IKE Configuration :
-----------------------------------------------------------------------------------------------------------------
crypto ipsec ikev1 transform-set CISCO esp-des esp-md5-hmac
crypto map outside_map 20 match address s2s
crypto map outside_map 20 set pfs
crypto map outside_map 20 set peer 100.1.1.2
crypto map outside_map 20 set ikev1 transform-set CISCO
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map interface outside
crypto isakmp identity address
no crypto isakmp nat-traversal
crypto ikev1 enable outside
crypto ikev1 policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400

tunnel-group 100.1.1.2 type ipsec-l2l
tunnel-group 100.1.1.2 ipsec-attributes
ikev1 pre-shared-key *****

Verification of VPN connection
SRX:

root> show security ike sa
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
778322  UP     8858011cc0881359  e5ecd6302f0306b0  Main           100.1.1.1

root> show security ipsec sa
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon vsys Port  Gateway
  <131073 ESP:des/ md5  fb0a0946 28765/unlim   -   root 500   100.1.1.1
  >131073 ESP:des/ md5  11f6197b 28765/unlim   -   root 500   100.1.1.1

root> show security ipsec sa detail
  ID: 131073 Virtual-system: root, VPN Name: ike-vpn-chicago
  Local Gateway: 100.1.1.2, Remote Gateway: 100.1.1.1
  Local Identity: ipv4_subnet(any:0,[0..7]=192.168.2.0/24)
  Remote Identity: ipv4_subnet(any:0,[0..7]=192.168.1.0/24)
  Version: IKEv1
    DF-bit: clear
    Policy Name:vpn-tr-untr

    Direction: inbound, SPI: 22abf60, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 28571 seconds
    Lifesize Remaining:  4607999 kilobytes
    Soft lifetime: Expires in 27982 seconds
    Mode: Tunnel, Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc
    Anti-replay service: counter-based enabled, Replay window size: 64

    Direction: outbound, SPI: ccb96ffb, AUX-SPI: 0
                              , VPN Monitoring: -
    Hard lifetime: Expires in 28571 seconds
    Lifesize Remaining:  4607999 kilobytes
    Soft lifetime: Expires in 27982 seconds
    Mode: Tunnel(0 0), Type: dynamic, State: installed
    Protocol: ESP, Authentication: hmac-md5-96, Encryption: des-cbc
    Anti-replay service: counter-based enabled, Replay window size: 64

root> show security ipsec statistics | no-more
ESP Statistics:
  Encrypted bytes:          1842192
  Decrypted bytes:          1210704
  Encrypted packets:          12144
  Decrypted packets:          12144
AH Statistics:
  Input bytes:                    0
  Output bytes:                   0
  Input packets:                  0
  Output packets:                 0
Errors:
  AH authentication failures: 0, Replay errors: 0
  ESP authentication failures: 0, ESP decryption failures: 0
  Bad headers: 0, Bad trailers: 0

저작자표시

'업무이야기 > Security' 카테고리의 다른 글

Juniper SRX request chassis cluster failover redundancy-group (0)	2021.04.13
IPS (Sniper) 기본 Command (3)	2021.03.29
MonitorAPP 웹방화벽 동작 체크 방법 (0)	2021.01.29
Fortinet FortiSandbox Shell mode (0)	2021.01.20
Fortinet FortiSandbox Clustering Setting sample (0)	2021.01.20

Juniper request chassis cluster failover redundancy-group

쫑콩아빠 2021. 3. 16. 11:25

2021. 3. 16. 11:25

request chassis cluster failover redundancy-group

request chassis cluster failover node node-number redundancy-group redundancy-group-number
Release Information
Command introduced in Junos OS Release 9.0.

Description
For chassis cluster configurations, initiate manual failover in a redundancy group from one node to the other, which becomes the primary node, and automatically reset the priority of the group to 255. The failover stays in effect until the new primary node becomes unavailable, the threshold of the redundancy group reaches 0, or you use the request chassis cluster failover reset command.

After a manual failover, you must use the request chassis cluster failover reset command before initiating another failover.

Options
node node-number—Number of the chassis cluster node to which the redundancy group fails over.

Range: 0 or 1

redundancy-group group-number—Number of the redundancy group on which to initiate manual failover. Redundancy group 0 is a special group consisting of the two Routing Engines in the chassis cluster.

Range: 0 through 255

Required Privilege Level
maintenance

RELATED DOCUMENTATION
Initiating a Chassis Cluster Manual Redundancy Group Failover

Verifying Chassis Cluster Failover Status

List of Sample Output
request chassis cluster failover redundancy-group
Output Fields
When you enter this command, you are provided feedback on the status of your request.

Sample Output
request chassis cluster failover redundancy-group

user@host> request chassis cluster failover redundancy-group 0 node 1
content_copy zoom_out_map
{primary:node0}

user@host> request chassis cluster failover redundancy-group 0 node 1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Initiated manual failover for redundancy group 0

저작자표시

'업무이야기 > Network' 카테고리의 다른 글

Juniper show command (RSI : request support information) (0)	2021.03.29
Juniper Troubleshooting Commands (0)	2021.03.29
Juniper EX4200 VLAN Configuration (0)	2021.01.25
Juniper EX S/W Factory Reset (0)	2021.01.25
Alteon-5208 Default Config (0)	2021.01.20

MonitorAPP 웹방화벽 동작 체크 방법

쫑콩아빠 2021. 1. 29. 08:36

2021. 1. 29. 08:36

웹방화벽 동작 체크 방법

웹방화벽 게이트웨이로 접속 방법

[root@WIM ~]# ssh wig1 # 웹방화벽 게이트웨이로 접속

(1번 wig1 or 10.1.1.100 2번 wig2 or 10.1.2.100)

root@wig1's password: # root03 입니다.

체크 스크립트 항목별 설명

[root@WIG1 ~]# cd # 어떤 경로에 위치하더라도 스크립트의 경로로 이동

[root@WIG1 ~]# ./regular_check.sh

ENTER키 치면 한 개씩 항목이 실행되어 경과가 나타납니다.

WI Model : 2030BF # 장비 모델명을 나타냅니다.

eth0 MAC Address : 00:10:F3:0F:BC:1E

장비 eth0 맥어드레스이며 라이선스 갱신시 필요한 값

Gateway License : This is unlimited license for

게이트웨이 동작 라이선스상태

WIG version: 2.1.16_6 # 게이트웨이 펌웨어 버전

HTTP(s) Gateway : OK (Listen Port 8001 80 8080)

                    # 웹방화벽 엔진 상태 및 감시 포트 정보

Log Agent : OK

                    # 매니저로 로그를 전송을 담당하는 Agent

Policy Agent : OK

                    # 서버에 적용시 정책을 내려받아 적용하는 Agent

System Monitoring : OK

                    # 웹방화벽 게이트웨이의 동작 상태를 감시하는 Agent

Docfilter : OK

                    # 개인정보관련 Agent

Lan Bypass : OK

                    # Bypass TAB의 동작 상태

Interface status # 인터페이스에서 처리하는 트래픽양이며 ONE-ARMED에서는 SERVER 포트는 0

Client Device

eth6: rx/tx 4582/4582 Kbps, 737/740 pps

Server Device

eth6: rx/tx 0/0 Kbps, 0/0 pps

CLIENT PORT : eth6 # 인터페이스의 LINK상태

Settings for eth6:

Speed: 1000Mb/s

Duplex: Full

Port: FIBRE

Auto-negotiation: on

Link detected: yes

SERVER PORT: eth6 # 인터페이스 LINK 상태

Settings for eth6:

Speed: 1000Mb/s

Duplex: Full

Port: FIBRE

Auto-negotiation: on

Link detected: yes

CLIENT PORT : eth6 # 인터페이스 관련 Count 값 확인

      RX packets:423616900 errors:0 dropped:0 overruns:0 frame:0 

      TX packets:338826150 errors:0 dropped:0 overruns:0 carrier:0 

      collisions:0 txqueuelen:1000  

      Base address:0xaf00 Memory:fdca0000-fdcc0000

SERVER PORT: eth6 # 인터페이스 관련 Count 값 확인

RX packets:423616900 errors:0 dropped:0 overruns:0 frame:0

      TX packets:338826150 errors:0 dropped:0 overruns:0 carrier:0 

      collisions:0 txqueuelen:1000  

      Base address:0xaf00 Memory:fdca0000-fdcc0000

Httpgw Process Status #웹방화벽 엔진이 두개 떠있는지 확인

root 28135 1 0 Jan18 ? 00:00:00 /wig/bin/httpgw

root 28136 28135 5 Jan18 ? 00:47:28 /wig/bin/httpgw

Fail Open Mode : ENABLE # Bypass 모듈의 활성화 상태

WIG Uptime : 08:43:12 up 51 days, 22:36, 1 user, load average: 0.02, 0.03, 0.00

                         # 장비의 지속동작 상태 확인

Web Server List # 웹방화벽이 처리할 서버 정보 리스트

0.0.0.0 - 255.255.255.255:8001

0.0.0.0 - 255.255.255.255:8080

0.0.0.0 - 255.255.255.255:80

registered server: count 3

Bypass IP Address Count=7 # 바이패스할 IP 리스트

   166.104.117.75 - 166.104.117.75 

   166.104.117.77 - 166.104.117.77 

   121.138.193.186 - 121.138.193.186 

   166.104.157.92 - 166.104.157.92 

   166.104.27.1 - 166.104.27.254 

   166.104.177.1 - 166.104.177.254 

   166.104.96.1 - 166.104.96.254

[root@WIG1 ~]#

각 항목별 긴급 대응 방안

웹방화벽 게이트웨이로 접속이 안되는 경우

-. 게이트웨이가 전원ON 상태 인지 확인

( 전원이 ON되지 않는 경우 파워 또는 보드 장애로 예상됨)

-. 매니저와 게이트웨이간 케이블이 정상적으로 연결되었는지 확인

(LINK상태 및 정확한 포트간 연결 다른 포트에 연결되었거나 케이블 불량 예상)

-. 게이트웨이LCD 창의 메시지의 내용 변화가 있는지 확인

(멈춰있는 경우 다운 상태이므로 강제 재부팅)

eth0 의 MAC이 변화한 경우

-. 게이트웨이의 eth0가 물리적인 장애인 상태에서 재부팅 되면 eth1이 eth0가 되어

변화할 수 있으며 장비 교체 필요함

-. 게이트웨이 동작 라이선스 재발급 요청

게이트웨이 펌웨어 정보 확인

HTTP(s) Gateway 가 Not OK인 경우

[root@WIG1 ~]# killall httpgw 를 약 3회 수행

[root@WIG1 ~]# /wig/bin/restart_httpgw.sh