关于netscreen问题

xujian200412

这是我netscreen208的配置,现在ping 134.134.33.58ping不通了,本来是可以的突然不行了,检查半天也不知道是什么原因,麻烦各位帮忙看看\r\nns208-> get config\r\nTotal Config size 2280:\r\nset clock timezone 0\r\nset vrouter trust-vr sharable\r\nunset vrouter \"trust-vr\" auto-route-export\r\nset auth-server \"Local\" id 0\r\nset auth-server \"Local\" server-name \"Local\"\r\nset auth default auth server \"Local\"\r\nset admin name \"netscreen\"\r\nset admin password \"nKVUM2rwMUzPcrkG5sWIHdCtqkAibn\"\r\nset admin auth timeout 10\r\nset admin auth server \"Local\"\r\nset admin format dos\r\nset zone \"Trust\" vrouter \"trust-vr\"\r\nset zone \"Untrust\" vrouter \"trust-vr\"\r\nset zone \"DMZ\" vrouter \"trust-vr\"\r\nset zone \"VLAN\" vrouter \"trust-vr\"\r\nset zone \"Trust\" tcp-rst \r\nset zone \"Untrust\" block \r\nunset zone \"Untrust\" tcp-rst \r\nset zone \"MGT\" block \r\nset zone \"DMZ\" tcp-rst \r\nset zone \"VLAN\" block \r\n--- more --- \r\nset zone \"VLAN\" tcp-rst \r\nset zone \"Untrust\" screen tear-drop\r\nset zone \"Untrust\" screen syn-flood\r\nset zone \"Untrust\" screen ping-death\r\nset zone \"Untrust\" screen ip-filter-src\r\nset zone \"Untrust\" screen land\r\nset zone \"V1-Untrust\" screen tear-drop\r\nset zone \"V1-Untrust\" screen syn-flood\r\nset zone \"V1-Untrust\" screen ping-death\r\nset zone \"V1-Untrust\" screen ip-filter-src\r\nset zone \"V1-Untrust\" screen land\r\nset interface \"ethernet1\" zone \"Trust\"\r\nset interface \"ethernet2\" zone \"DMZ\"\r\nset interface \"ethernet3\" zone \"Untrust\"\r\nunset interface vlan1 ip\r\nset interface ethernet1 ip 10.1.1.208/24\r\nset interface ethernet1 nat\r\nset interface ethernet3 ip 134.134.33.57/26\r\nset interface ethernet3 route\r\nunset interface vlan1 bypass-others-ipsec\r\nunset interface vlan1 bypass-non-ip\r\nset interface ethernet1 ip manageable\r\n--- more --- \r\nset interface ethernet3 ip manageable\r\nset interface ethernet3 manage telnet\r\nset interface \"ethernet3\" mip 134.134.33.58 host 10.1.1.52 netmask 255.255.255.255 vrouter \"trust-vr\"\r\nset hostname ns208\r\nset ike respond-bad-spi 1\r\nset policy id 1 name \"NAT-src\" from \"Trust\" to \"Untrust\"  \"Any\" \"Any\" \"ANY\" nat src permit \r\nset policy id 2 name \"97-to-app2\" from \"Untrust\" to \"Trust\"  \"Any\" \"Any\" \"ANY\" permit \r\nset pki authority default scep mode \"auto\"\r\nset pki x509 default cert-path partial\r\nset ssh version v2\r\nset config lock timeout 5\r\nset snmp port listen 161\r\nset snmp port trap 162\r\nset vrouter \"untrust-vr\"\r\nset route  0.0.0.0/0 interface ethernet3 gateway 134.134.33.1\r\nexit\r\nset vrouter \"trust-vr\"\r\nunset add-default-route\r\nset route 0.0.0.0/0 vrouter \"untrust-vr\"\r\nexit

untrust

是不是修改了policy之后不通?\r\n我看少了一条从untrust 到mip的policy

xujian200412

原帖由 untrust 于 2006-9-25 21:32 发表\r\n是不是修改了policy之后不通?\r\n我看少了一条从untrust 到mip的policy

\r\n\r\n\r\n突然不行的,也不知道什么原因,我做了\r\nset policy id 2 name \"97-to-app2\" from \"Untrust\" to \"Trust\"  \"Any\" \"Any\" \"ANY\" permit \r\n还需要单独做条untrust到mip的policy吗?

untrust

如果你作了mip\r\n在web作policy from untrust to trust时,在选择destination address时会出现Global Mip类似的\r\n加上这个policy就行了