Juniper SRX(Junos)配置拨号*** （Dynamic ***）
1） Junper SRX 防火墙，默认 License 支持2个*** 并发连接。2） Juniper SRX 防火墙的软件版本需要注意下，测试时发现 12.1X46-D40.2 有问题，因为测试设备是SRX210HE，在高的版本升级不上去，使用版本 12.1X44-D60.2 没问题。
配置：
set access profile dyn-***-access-profile client ***user1 firewall-user password "***userpassword01"
set access profile dyn-***-access-profile address-assignment pool dyn-***-address-pool
set access address-assignment pool dyn-***-address-pool family inet network 192.168.11.0/24//***拨入获得的地址池
set access address-assignment pool dyn-***-address-pool family inet xauth-attributes primary-dns 192.168.22.2/32//***拨入获得的DNS地址
set access firewall-authentication web-authentication default-profile dyn-***-access-profile
set security ike policy ike-dyn-***-policy mode aggressive
set security ike policy ike-dyn-***-policy proposal-set compatible
set security ike policy ike-dyn-***-policy pre-shared-key ascii-text "***-share-key"//设置一个share key，测试结果，拨号客户端不需要输入该值
set security ike gateway dyn-***-local-gw ike-policy ike-dyn-***-policy
set security ike gateway dyn-***-local-gw dynamic hostname Internet-FW-01// 该值最好和防火墙的主机名一样
set security ike gateway dyn-***-local-gw dynamic connections-limit 2//具体数值不要超过license数值
set security ike gateway dyn-***-local-gw dynamic ike-user-type group-ike-id
set security ike gateway dyn-***-local-gw external-interface ge-0/0/0//设置*** Gateway的接口，一般是设置对外接口，Untrust
set security ike gateway dyn-***-local-gw xauth access-profile dyn-***-access-profile
set security ipsec policy ipsec-dyn-***-policy proposal-set compatible
set security ipsec *** dyn-*** ike gateway dyn-***-local-gw
set security ipsec *** dyn-*** ike ipsec-policy ipsec-dyn-***-policy
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match source-address any
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match destination-address any
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy match application any
set security policies from-zone Untrust to-zone Trust policy dyn-***-policy then permit tunnel ipsec-*** dyn-***
set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services ike
set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services https
set security zones security-zone Untrust interfaces ge-0/0/0 host-inbound-traffic system-services ping
set security dynamic-*** access-profile dyn-***-access-profile
set security dynamic-*** clients all remote-protected-resources 192.168.0.0/24//设置哪些地址走***
set security dynamic-*** clients all remote-exceptions 0.0.0.0/0//设置哪些地址不走***
set security dynamic-*** clients all ipsec-*** dyn-***
set security dynamic-*** clients all user ***user1 //此处的用户是刚刚创建过的本地账户
show system license//查看License状态
show security dynamic-*** users //查看***拨号的用户情况
show security ike security-associations //查看IKE阶段的情况
show security ipsec security-associations//查看IPSec阶段的情况，感觉没啥太大用，拨号不成功，看这ike和ipsec协商情况也没啥太好下手解决问题的办法，最好是看类似于ScreenOS系统看***拨号日志，但是还没找到SRX上面命令或者其他方法。
set system service web-management management-url MGT //因为开启了***，默认登录就变成***了，需要单独做一下管理的URL
页:
[1]