網(wǎng)絡(luò)出口配置問題，pix與netscreen熟悉的進(jìn)來幫一下忙，謝謝！

guozhongyan

客戶的公網(wǎng)出口是兩臺(tái)防火墻串接，Pix525作為內(nèi)網(wǎng)防火墻，netscreen作為外網(wǎng)防火墻，采用兩層地址映射的方式\r\n\r\npix后有兩臺(tái)主機(jī)，一臺(tái)為unix服務(wù)器，地址為134.64.2.10,之前僅在公網(wǎng)上開放了7001與9001端口，另一臺(tái)為pc server作為測試機(jī)地址為134.64.2.18此前沒有出公網(wǎng)，pix將兩臺(tái)主機(jī)分別mip為192.168.200.100與 192.168.200.104，netscreen再將這兩個(gè)192地址映射為公網(wǎng)地址；\r\n\r\n出于業(yè)務(wù)需要，主機(jī)需要調(diào)用公網(wǎng)上的某臺(tái)服務(wù)器的smtp，即需要開放兩臺(tái)主機(jī)外出訪問25端口的權(quán)限，我對(duì)pix和netscreen做了如下配置：\r\n\r\npix的acl配置：\r\n\r\naccess-list 101 permit tcp any host 192.168.200.100 eq 7001\r\naccess-list 101 permit tcp any host 192.168.200.100 eq 9001\r\naccess-list 101 permit tcp any host 192.168.200.103 eq 7001\r\naccess-list 101 permit tcp any host 192.168.200.103 eq 9001\r\naccess-list 101 permit tcp any host 192.168.200.104 eq smtp\r\naccess-list 101 permit tcp any host 192.168.200.100 eq smtp\r\naccess-list 101 permit icmp any host 192.168.200.100 echo-reply\r\naccess-list 101 permit icmp any host 192.168.200.104 echo-reply\r\naccess-group 101 in interface outside\r\n\r\nnetscreen上做了如下policy配置：\r\nset policy id 14 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.35)\" \"7001\" Permit\r\nset policy id 0 name \"go-out\" from \"Trust\" to \"Untrust\"  \"192.168.100.0/24\" \"192.168.100.0/24\" \"7001\" Permit\r\nset policy id 13 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.35)\" \"9001\" Permit\r\nset policy id 1 from \"Trust\" to \"Untrust\"  \"192.168.100.0/24\" \"192.168.100.0/24\" \"9001\" Permit\r\nset policy id 2 from \"Untrust\" to \"Trust\"  \"Any\" \"Any\" \"MAIL\" Permit\r\nset policy id 3 from \"Trust\" to \"Untrust\"  \"Any\" \"Any\" \"MAIL\" Permit\r\nset policy id 4 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.35)\" \"MAIL\" Permit\r\nset policy id 5 from \"Untrust\" to \"Global\"  \"Any\" \"MIP(x.x.x.3\" \"MAIL\" Permit\r\n\r\nx.x.x.35是134.64.2.10的公網(wǎng)地址\r\nx.x.x.38是134.64.2.18的公網(wǎng)地址\r\n\r\n經(jīng)過配置以后做測試，測試機(jī)可以順利聯(lián)通遠(yuǎn)端25端口，但是正式機(jī)卻怎么也聯(lián)不上公網(wǎng)地址\r\n1、是否與unix本地沒有打開25端口有關(guān)？連接遠(yuǎn)程25端口需要本地主機(jī)自身也同時(shí)打開25端口嗎？\r\n2、是否與主機(jī)雙網(wǎng)卡多地址綁定有關(guān)？我已經(jīng)在主機(jī)里面添加了目標(biāo)主機(jī)route add net 210.x.x.0 gateway 134.64.2.1（內(nèi)網(wǎng)pix地址）的靜態(tài)路由了，還是不通.

guozhongyan

自己頂，拜托大家樂！

guozhongyan

把netscreen的配置改為\r\nset policy id 2 from \"Untrust\" to \"Trust\"  \"Any\" \"Any\" \"any\" Permit\r\nset policy id 3 from \"Trust\" to \"Untrust\"  \"Any\" \"Any\" \"any\" Permit\r\n\r\n測試機(jī)能ping出到公網(wǎng)，而業(yè)務(wù)機(jī)還是不行！