Juniper SRX300防火墙零基础实战从拆箱到上网的完整指南刚拿到一台Juniper SRX300防火墙时面对密密麻麻的接口和陌生的命令行界面很多新手会感到无从下手。这台银色金属外壳的设备虽然只有1U高度却承载着企业网络的第一道防线。本文将用最直白的语言带你一步步完成从拆箱到上网的全过程配置即使你从未接触过企业级防火墙也能轻松上手。1. 开箱与物理连接拆开SRX300的包装箱你会看到以下标准配件防火墙主机含机架安装套件电源线串口控制线RJ45转DB9快速入门指南物理连接步骤电源接入将电源线插入设备后方标有PWR的接口接通电源后前面板的PWR指示灯会亮起绿色控制台连接使用附带的串口线连接设备Console口和电脑在电脑上打开终端工具如PuTTY设置参数波特率9600 数据位8 奇偶校验无 停止位1 流控无网络接口连接ge-0/0/0连接外网如光猫或上级路由器ge-0/0/1连接内网交换机其他接口可留作未来扩展使用注意首次启动约需3-5分钟系统指示灯会从黄色变为稳定绿色表示启动完成2. 初始系统配置首次登录需要使用控制台连接默认无密码。看到login:提示后直接输入root回车即可进入系统。基础系统设置# 进入配置模式 cli configure # 恢复出厂设置确保开始前环境干净 load factory-default # 设置root密码建议使用复杂密码 set system root-authentication plain-text-password New password: [输入密码] Retype new password: [再次输入密码] # 配置管理用户 set system login user admin class super-user set system login user admin authentication plain-text-password New password: [输入管理员密码] Retype new password: [再次输入密码] # 设置主机名和时区 set system host-name SRX300-Office set system time-zone Asia/Shanghai # 配置NTP时间同步 set system ntp server pool.ntp.org # 提交配置并保存 commit save关键参数说明配置项示例值作用root密码Juniper2023设备最高权限密码管理用户admin日常管理账户主机名SRX300-Office设备标识名称NTP服务器pool.ntp.org时间同步服务器3. 网络接口与安全区域配置SRX300的核心概念是安全区域Security Zone和接口绑定。我们需要明确三个关键点trust区域通常指内网安全等级高untrust区域通常指外网安全等级低接口类型二层交换或三层路由接口具体配置步骤# 创建VLAN和IRB接口 set vlans vlan-untrust vlan-id 10 set vlans vlan-untrust l3-interface irb.10 set vlans vlan-trust vlan-id 20 set vlans vlan-trust l3-interface irb.20 # 配置物理接口 set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members vlan-untrust set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan-trust # 配置IRB接口IP set interfaces irb unit 10 family inet address 203.0.113.2/24 # 外网IP set interfaces irb unit 20 family inet address 192.168.1.1/24 # 内网IP # 配置安全区域 set security zones security-zone untrust interfaces irb.10 set security zones security-zone trust interfaces irb.20 # 设置默认路由假设网关是203.0.113.1 set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1接口规划表接口类型VLANIP地址安全区域ge-0/0/0二层vlan-untrust (10)-untrustge-0/0/1二层vlan-trust (20)-trustirb.10三层-203.0.113.2/24untrustirb.20三层-192.168.1.1/24trust4. DHCP服务与NAT配置为了让内网设备自动获取IP并访问互联网需要配置DHCP和NATDHCP服务器配置# 创建DHCP地址池 set access address-assignment pool lan-pool family inet network 192.168.1.0/24 set access address-assignment pool lan-pool family inet range dhcp-range low 192.168.1.100 set access address-assignment pool lan-pool family inet range dhcp-range high 192.168.1.200 # 设置DHCP选项 set access address-assignment pool lan-pool family inet dhcp-attributes router 192.168.1.1 set access address-assignment pool lan-pool family inet dhcp-attributes name-server 8.8.8.8 set access address-assignment pool lan-pool family inet dhcp-attributes propagate-settings irb.20 # 启用DHCP服务 set system services dhcpNAT配置内网访问外网# 配置源NAT规则 set security nat source rule-set trust-to-untrust from zone trust set security nat source rule-set trust-to-untrust to zone untrust set security nat source rule-set trust-to-untrust rule src-nat-rule match source-address 192.168.1.0/24 set security nat source rule-set trust-to-untrust rule src-nat-rule then source-nat interface5. 安全策略与管理服务最后需要配置安全策略允许流量通过并开启必要的管理服务基础安全策略# 允许内网访问外网 set security policies from-zone trust to-zone untrust policy allow-outbound match source-address any set security policies from-zone trust to-zone untrust policy allow-outbound match destination-address any set security policies from-zone trust to-zone untrust policy allow-outbound match application any set security policies from-zone trust to-zone untrust policy allow-outbound then permit # 允许外网ping和必要的管理访问谨慎配置 set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services sshWeb管理界面配置# 启用HTTP/HTTPS管理 set system services web-management http interface irb.20 set system services web-management https interface irb.20 # 限制管理访问IP可选但推荐 set system services ssh client-match 192.168.1.0/24 set system services web-management http client-match 192.168.1.0/24完成所有配置后记得执行commit和save保存配置。现在你的SRX300应该已经可以正常工作了内网设备可以通过它访问互联网。如果遇到问题可以使用以下命令检查状态show interfaces terse # 查看接口状态 show security nat source rule all # 检查NAT规则 show security policies # 查看安全策略 ping 8.8.8.8 # 测试外网连通性第一次配置企业级防火墙可能会觉得步骤繁琐但SRX300的这种模块化设计实际上让网络结构更清晰。我在实际部署中发现理清安全区域与接口的关系后后续维护会轻松很多。建议配置完成后导出备份配置show configuration | save /var/tmp/srx300-backup.conf