Juniper ISG1000 MIP后 从公网咋就是Ping不通MIP地址呢？（但MIP地址上可以上网）

loveoov

1. set vrouter trust-vr sharable
   
2. set vrouter "untrust-vr"
   
3. exit
   
4. set vrouter "trust-vr"
   
5. unset auto-route-export
   
6. exit
   
7. set auth-server "Local" id 0
   
8. set auth-server "Local" server-name "Local"
   
9. set auth default auth server "Local"
   
10. set auth radius accounting port 1646
    
11. set admin name "netscreen"
    
12. set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn"
    
13. set admin auth timeout 10
    
14. set admin auth server "Local"
    
15. set admin privilege read-write
    
16. set admin format dos
    
17. set zone "Trust" vrouter "trust-vr"
    
18. set zone "Untrust" vrouter "trust-vr"
    
19. set zone "DMZ" vrouter "trust-vr"
    
20. set zone "VLAN" vrouter "trust-vr"
    
21. set zone id 1000 "internet"
    
22. set zone "Untrust-Tun" vrouter "trust-vr"
    
23. set zone "Trust" tcp-rst
    
24. set zone "Untrust" block
    
25. unset zone "Untrust" tcp-rst
    
26. set zone "DMZ" tcp-rst
    
27. set zone "VLAN" block
    
28. unset zone "VLAN" tcp-rst
    
29. unset zone "internet" tcp-rst
    
30. set zone "Untrust" screen tear-drop
    
31. set zone "Untrust" screen syn-flood
    
32. set zone "Untrust" screen ping-death
    
33. set zone "Untrust" screen ip-filter-src
    
34. set zone "Untrust" screen land
    
35. set zone "V1-Untrust" screen tear-drop
    
36. set zone "V1-Untrust" screen syn-flood
    
37. set zone "V1-Untrust" screen ping-death
    
38. set zone "V1-Untrust" screen ip-filter-src
    
39. set zone "V1-Untrust" screen land
    
40. set interface "ethernet1/1" zone "Untrust"
    
41. set interface "ethernet1/1.1" tag 111 zone "Trust"
    
42. set interface "ethernet1/2" zone "Trust"
    
43. set interface "tunnel.1" zone "Trust"
    
44. unset interface vlan1 ip
    
45. set interface mgt ip 192.168.1.1/24
    
46. set interface ethernet1/1 ip 61.1.1.1/30
    
47. set interface ethernet1/1 route
    
48. set interface ethernet1/2 ip 10.20.29.1/30
    
49. set interface ethernet1/2 nat
    
50. set interface tunnel.1 ip unnumbered interface ethernet1/1
    
51. unset interface vlan1 bypass-others-ipsec
    
52. unset interface vlan1 bypass-non-ip
    
53. set interface ethernet1/1 ip manageable
    
54. set interface ethernet1/2 ip manageable
    
55. set interface ethernet1/1 manage ping
    
56. set interface ethernet1/1 manage telnet
    
57. set interface ethernet1/1 manage snmp
    
58. set interface ethernet1/1 manage web
    
59. set interface "ethernet1/1" mip 71.1.1.1 host 10.20.36.8 netmask 255.255.255.255 vr "trust-vr"
    
60. unset flow no-tcp-seq-check
    
61. set flow tcp-syn-check
    
62. set pki authority default scep mode "auto"
    
63. set pki x509 default cert-path partial
    
64. set address "Trust" "10.20.0.0/16" 10.20.0.0 255.255.0.0
    
65. set address "Trust" "10.20.0.0/24" 10.20.0.0 255.255.255.0
    
66. set address "Trust" "10.20.40.0/21" 10.20.40.0 255.255.248.0
    
67. set address "Trust" "AAA-Self-Portal" 10.20.36.8 255.255.255.255
    
68. set address "Trust" "FOR AAA" 71.1.1.1 255.255.255.255
    
69. set ike respond-bad-spi 1
    
70. unset ike ikeid-enumeration
    
71. unset ike dos-protection
    
72. unset ipsec access-session enable
    
73. set ipsec access-session maximum 5000
    
74. set ipsec access-session upper-threshold 0
    
75. set ipsec access-session lower-threshold 0
    
76. set ipsec access-session dead-p2-sa-timeout 0
    
77. unset ipsec access-session log-error
    
78. unset ipsec access-session info-exch-connected
    
79. unset ipsec access-session use-error-log
    
80. set icap av-vendor-id symantec-5
    
81. set url protocol websense
    
82. exit
    
83. set policy id 10 from "Untrust" to "Trust"  "Any" "MIP(71.1.1.1)" "PING" permit log
    
84. set policy id 10
    
85. exit
    
86. set policy id 4 from "Untrust" to "Trust"  "Any" "Any" "ANY" permit log
    
87. exit
    
88. set policy id 6 from "Trust" to "Untrust"  "10.20.40.0/21" "Any" "ANY" permit log
    
89. set policy id 6
    
90. exit
    
91. set policy id 8 from "Untrust" to "Trust"  "Any" "MIP(71.1.1.1)" "ANY" permit log
    
92. set policy id 8
    
93. exit
    
94. set policy id 7 from "Untrust" to "Trust"  "Any" "FOR AAA" "ANY" nat dst ip 10.20.36.8 permit log
    
95. set policy id 7
    
96. exit
    
97. set policy id 9 from "Trust" to "Untrust"  "AAA-Self-Portal" "Any" "ANY" permit log
    
98. set policy id 9
    
99. exit
    
100. set nsmgmt bulkcli reboot-timeout 60
     
101. set ssh version v2
     
102. set config lock timeout 5
     
103. set snmp port listen 161
     
104. set snmp port trap 162
     
105. set vrouter "untrust-vr"
     
106. set route 71.1.1.1/32 vrouter "trust-vr" preference 20
     
107. exit
     
108. set vrouter "trust-vr"
     
109. unset add-default-route
     
110. set route 0.0.0.0/0 interface ethernet1/1 gateway 61.1.1.2 preference 20
     
111. exit
     
112. set vrouter "untrust-vr"
     
113. exit
     
114. set vrouter "trust-vr"
     
115. exit

复制代码

PC---交换机-----ISG1000---CISCO路由器（外网）
我这样配置MIP之后，在PC上登陆iphost.info后显示自己的IP是71.1.1.1，并且能够上网，路由没问题
但问题就是为什么从外网ping不通这个地址 "71.1.1.1" 呢？(该PC内网可以Ping通)

cflmumu

我看了一下你的防火墙配置，发现一个问题，你所说的MIP（71.1.1.1)中 71.1.1.1 是个公网IP（美国 宾夕法尼亚州），在外网ping 71.1.1.1的时候，恐怕数据包根本就不会跑到你的防火墙1口，那还哪里来的MIP转换了呢？
我不太清楚你内网的拓扑结构，不知道为什么会有个公网地址在内网。还有你的外网IP 61.1.1.2（印度）。好奇怪的IP。
有需要加我QQ 619360977  大家一起讨论。

cflmumu

解决了 添加了一条 10.20.36.0/24  interface ethernet1/2 gateway 10.20.29.2 的路由  原来中间有个路由器  需要添加个gateway