[{"data":1,"prerenderedAt":3221},["ShallowReactive",2],{"blog-\u002Fen\u002Fblog\u002Fconfiguration-regles-securite-sous-junos":3,"blog-\u002Fen\u002Fblog\u002Fconfiguration-regles-securite-sous-junos-surround":3092,"blog-\u002Fen\u002Fblog\u002Fconfiguration-regles-securite-sous-junos-certifications":3147},{"id":4,"title":5,"body":6,"categories":3077,"cover":3079,"cover_contain":262,"credly_badge_id":3080,"date":3081,"description":3082,"extension":3083,"meta":3084,"navigation":262,"path":3085,"related_certifications":3086,"seo":3088,"slug":3089,"stem":3090,"__hash__":3091},"blog\u002Fen\u002Fblog\u002Fconfiguration-regles-securite-sous-junos.md","Configuring Security Rules on JunOS",{"type":7,"value":8,"toc":3066},"minimark",[9,14,18,22,25,31,35,46,56,80,87,90,128,134,141,168,173,183,188,194,199,212,216,219,232,235,948,951,1088,1092,1095,1104,1107,1133,1136,1161,1164,1186,1213,1216,1257,1297,1337,1340,1358,1362,1365,1400,1435,1470,1473,1501,1504,1569,1626,1683,1686,1754,1757,1762,1918,1923,2073,2076,2226,2229,2307,2310,2315,2431,2436,2544,2549,2658,2663,2770,2777,2815,2820,2935,2940,3052,3055,3059,3062],[10,11,13],"h2",{"id":12},"real-world-use-case","Real-world use case",[15,16,17],"p",{},"You need to segment the network flows of a Juniper infrastructure: here's how to configure effective security rules under JunOS.",[10,19,21],{"id":20},"juniper-firefly-perimeter","Juniper Firefly Perimeter",[15,23,24],{},"The evolution of IT systems toward virtualization requires adapting the approach to protecting virtual resources. Juniper's Firefly Perimeter solution addresses this exact need, mirroring the security of SRX gateways. It offers compatibility with VMware and KVM hypervisors:",[15,26,27],{},[28,29,30],"em",{},"The price is relatively low for Firefly Perimeter, around €500 without options, compared to Brocade Vyatta v5400 at €1800 (public price).",[10,32,34],{"id":33},"downloading-firefly-perimeter","Downloading Firefly Perimeter",[15,36,37,38,45],{},"There are two download scenarios: either your license is valid and tied to your account, or you simply want to try the product with a sixty-day evaluation version. Each of these options requires a ",[39,40,44],"a",{"href":41,"rel":42},"https:\u002F\u002Ftools.juniper.net\u002Fentitlement\u002FsetupAccountInfo.do",[43],"nofollow","valid Juniper account",".",[47,48,49],"ul",{},[50,51,52],"li",{},[53,54,55],"strong",{},"First case: valid license tied to the account",[15,57,58,59,62,63,45,68,71,72,75,76,79],{},"Once in my account, I go to the ",[53,60,61],{},"All products"," tab, which contains a link named ",[39,64,67],{"href":65,"rel":66},"https:\u002F\u002Fwww.juniper.net\u002Fsupport\u002Fdownloads\u002F",[43],"Download Software",[69,70],"br",{},"\nA list appears, I select ",[53,73,74],{},"By"," series then ",[53,77,78],{},"Firefly Perimeter",":",[15,81,82],{},[83,84],"img",{"alt":85,"src":86},"","\u002Fimages\u002Fblog\u002Fconfiguration-regles-securite-sous-junos\u002F027f3ce9a9.png",[15,88,89],{},"I use the VMware appliance dated November 1, 2014:",[91,92,96],"pre",{"className":93,"code":94,"language":95,"meta":85,"style":85},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","Firefly VMware Appliance MD5 SHA112.1X47-D15ova227,153,92021 Nov 2014\n","bash",[97,98,99],"code",{"__ignoreMap":85},[100,101,104,108,112,115,118,121,124],"span",{"class":102,"line":103},"line",1,[100,105,107],{"class":106},"sBMFI","Firefly",[100,109,111],{"class":110},"sfazB"," VMware",[100,113,114],{"class":110}," Appliance",[100,116,117],{"class":110}," MD5",[100,119,120],{"class":110}," SHA112.1X47-D15ova227,153,92021",[100,122,123],{"class":110}," Nov",[100,125,127],{"class":126},"sbssI"," 2014\n",[15,129,130,131],{},"If an error appears, it's because you're not authorized to download the package ",[28,132,133],{},"(so download it via the product sheet below).",[47,135,136],{},[50,137,138],{},[53,139,140],{},"Second case: invalid license, need for an evaluation version",[15,142,143,144,149,150,155,156,158,159,164,165,79],{},"Head to the ",[39,145,148],{"href":146,"rel":147},"https:\u002F\u002Fwww.juniper.net\u002Ffr\u002Ffr\u002Fproducts-services\u002Fsecurity\u002Ffirefly-perimeter\u002F#overview",[43],"Firefly Perimeter product page"," then click the ",[39,151,154],{"href":152,"rel":153},"https:\u002F\u002Fwww.juniper.net\u002Ffr\u002Ffr\u002Fproducts-services\u002Fsecurity\u002Ffirefly-perimeter\u002F#evaluation",[43],"Evaluation"," tab of Firefly Perimeter.",[69,157],{},"\nThe choice will fall on ",[39,160,163],{"href":161,"rel":162},"http:\u002F\u002Fwww.juniper.net\u002Fsupport\u002Fdownloads\u002F?p=junosvfirefly-eval",[43],"OVA file (for the Firefly Perimeter VMware appliance)"," then click ",[53,166,167],{},"Software",[15,169,170],{},[83,171],{"alt":85,"src":172},"\u002Fimages\u002Fblog\u002Fconfiguration-regles-securite-sous-junos\u002F7e324f2d61.png",[15,174,175,176,179,180,45],{},"The appliance will be deployed via the vSphere client software on Windows, in: ",[53,177,178],{},"Files"," and ",[53,181,182],{},"Deploy OVF Template",[184,185,187],"h3",{"id":186},"setting-up-the-network-infrastructure","Setting up the network infrastructure",[15,189,190,191,193],{},"The virtual infrastructure will have access to the internet via an IP block provided by OVH, and will consist of 3 distinct LAN networks.",[69,192],{},"\nHere's an example of the desired setup with a diagram and a single WAN IP:",[15,195,196],{},[83,197],{"alt":85,"src":198},"\u002Fimages\u002Fblog\u002Fconfiguration-regles-securite-sous-junos\u002F0521d702d2.png",[15,200,201,204,205],{},[28,202,203],{},"More information on the official website:"," ",[39,206,209],{"href":207,"rel":208},"http:\u002F\u002Fwww.juniper.net\u002Ftechpubs\u002Fen_US\u002Ffirefly12.1x47\u002Finformation-products\u002Fpathway-pages\u002Fsecurity-virtual-perimeter-kvm-gs-guide-pwp.pdf",[43],[28,210,211],{},"documentation.",[10,213,215],{"id":214},"first-contact-with-firefly-perimeter","First contact with Firefly Perimeter",[15,217,218],{},"To start, we'll simply use the following command:",[91,220,222],{"className":93,"code":221,"language":95,"meta":85,"style":85},"root@% config-wizard\n",[97,223,224],{"__ignoreMap":85},[100,225,226,229],{"class":102,"line":103},[100,227,228],{"class":106},"root@%",[100,230,231],{"class":110}," config-wizard\n",[15,233,234],{},"Follow the guide:",[91,236,238],{"className":93,"code":237,"language":95,"meta":85,"style":85},"Enter host name : firefly-kassianoff\n\nPlease enter root password:\nRetype root password:\n\nWould you like to configure domain name? [yes,no] (no): no\n Enter domain name: X.X.X.X\n\nWould you like to configure name server? [yes, no] (no):\n Enter IP address for the name server : 213.186.33.99\n\nWould you like to configure alternative name server? [yes, no] (no): yes\n Enter IP address for the name server: 213.186.33.199\n\nConfigure the following network interfaces\n\nIdentifier      Interface\n    1           ge-0\u002F0\u002F0\n    2           ge-0\u002F0\u002F1\n    3           ge-0\u002F0\u002F2\n    4           ge-0\u002F0\u002F3\n\nWould you like to configure any of the above interfaces? [yes,no] (yes): 1\n\nEnter one or more identifiers from the above interfaces separated by commas.\nFor example, 1,2,3\n\nPlease select interface identifiers: 1\n\n  Configure IP on interface ge-0\u002F0\u002F0\n\n    IP address for this interface: 178.30.70.49               # fictional IP block at 178.30.70.48\u002F29\n    Subnet mask bit length for this interface [1-32]: 29\n\nWould you like to configure default gateway? [yes, no] (no): yes\n    Enter IP address for the default gateway: 178.30.70.54\n\nWould you like to create a new user account? [yes,no] (no): no\n\nNo new user was configured.\n\nWould you like to configure SNMP Network Management? [yes,no] (no): no\n\nSNMP Network Management was not configured\n\nWould you like to review configuration commands? [yes,no] (no): yes\n\nWould you like to commit the initial configuration and exit? [yes,no]: yes\n",[97,239,240,257,264,279,289,294,328,342,347,374,401,406,433,454,459,476,481,490,499,508,517,526,531,566,571,607,619,624,641,646,662,667,690,714,719,744,766,771,803,808,824,829,857,862,881,886,913,918],{"__ignoreMap":85},[100,241,242,245,248,251,254],{"class":102,"line":103},[100,243,244],{"class":106},"Enter",[100,246,247],{"class":110}," host",[100,249,250],{"class":110}," name",[100,252,253],{"class":110}," :",[100,255,256],{"class":110}," firefly-kassianoff\n",[100,258,260],{"class":102,"line":259},2,[100,261,263],{"emptyLinePlaceholder":262},true,"\n",[100,265,267,270,273,276],{"class":102,"line":266},3,[100,268,269],{"class":106},"Please",[100,271,272],{"class":110}," enter",[100,274,275],{"class":110}," root",[100,277,278],{"class":110}," password:\n",[100,280,282,285,287],{"class":102,"line":281},4,[100,283,284],{"class":106},"Retype",[100,286,275],{"class":110},[100,288,278],{"class":110},[100,290,292],{"class":102,"line":291},5,[100,293,263],{"emptyLinePlaceholder":262},[100,295,297,300,303,306,309,312,315,318,322,325],{"class":102,"line":296},6,[100,298,299],{"class":106},"Would",[100,301,302],{"class":110}," you",[100,304,305],{"class":110}," like",[100,307,308],{"class":110}," to",[100,310,311],{"class":110}," configure",[100,313,314],{"class":110}," domain",[100,316,317],{"class":110}," name?",[100,319,321],{"class":320},"sTEyZ"," [yes,no] (",[100,323,324],{"class":106},"no",[100,326,327],{"class":320},"): no\n",[100,329,331,334,336,339],{"class":102,"line":330},7,[100,332,333],{"class":106}," Enter",[100,335,314],{"class":110},[100,337,338],{"class":110}," name:",[100,340,341],{"class":110}," X.X.X.X\n",[100,343,345],{"class":102,"line":344},8,[100,346,263],{"emptyLinePlaceholder":262},[100,348,350,352,354,356,358,360,362,365,368,371],{"class":102,"line":349},9,[100,351,299],{"class":106},[100,353,302],{"class":110},[100,355,305],{"class":110},[100,357,308],{"class":110},[100,359,311],{"class":110},[100,361,250],{"class":110},[100,363,364],{"class":110}," server?",[100,366,367],{"class":320}," [yes, ",[100,369,370],{"class":110},"no]",[100,372,373],{"class":320}," (no):\n",[100,375,377,379,382,385,388,391,393,396,398],{"class":102,"line":376},10,[100,378,333],{"class":106},[100,380,381],{"class":110}," IP",[100,383,384],{"class":110}," address",[100,386,387],{"class":110}," for",[100,389,390],{"class":110}," the",[100,392,250],{"class":110},[100,394,395],{"class":110}," server",[100,397,253],{"class":110},[100,399,400],{"class":126}," 213.186.33.99\n",[100,402,404],{"class":102,"line":403},11,[100,405,263],{"emptyLinePlaceholder":262},[100,407,409,411,413,415,417,419,422,424,426,428,430],{"class":102,"line":408},12,[100,410,299],{"class":106},[100,412,302],{"class":110},[100,414,305],{"class":110},[100,416,308],{"class":110},[100,418,311],{"class":110},[100,420,421],{"class":110}," alternative",[100,423,250],{"class":110},[100,425,364],{"class":110},[100,427,367],{"class":320},[100,429,370],{"class":110},[100,431,432],{"class":320}," (no): yes\n",[100,434,436,438,440,442,444,446,448,451],{"class":102,"line":435},13,[100,437,333],{"class":106},[100,439,381],{"class":110},[100,441,384],{"class":110},[100,443,387],{"class":110},[100,445,390],{"class":110},[100,447,250],{"class":110},[100,449,450],{"class":110}," server:",[100,452,453],{"class":126}," 213.186.33.199\n",[100,455,457],{"class":102,"line":456},14,[100,458,263],{"emptyLinePlaceholder":262},[100,460,462,465,467,470,473],{"class":102,"line":461},15,[100,463,464],{"class":106},"Configure",[100,466,390],{"class":110},[100,468,469],{"class":110}," following",[100,471,472],{"class":110}," network",[100,474,475],{"class":110}," interfaces\n",[100,477,479],{"class":102,"line":478},16,[100,480,263],{"emptyLinePlaceholder":262},[100,482,484,487],{"class":102,"line":483},17,[100,485,486],{"class":106},"Identifier",[100,488,489],{"class":110},"      Interface\n",[100,491,493,496],{"class":102,"line":492},18,[100,494,495],{"class":106},"    1",[100,497,498],{"class":110},"           ge-0\u002F0\u002F0\n",[100,500,502,505],{"class":102,"line":501},19,[100,503,504],{"class":106},"    2",[100,506,507],{"class":110},"           ge-0\u002F0\u002F1\n",[100,509,511,514],{"class":102,"line":510},20,[100,512,513],{"class":106},"    3",[100,515,516],{"class":110},"           ge-0\u002F0\u002F2\n",[100,518,520,523],{"class":102,"line":519},21,[100,521,522],{"class":106},"    4",[100,524,525],{"class":110},"           ge-0\u002F0\u002F3\n",[100,527,529],{"class":102,"line":528},22,[100,530,263],{"emptyLinePlaceholder":262},[100,532,534,536,538,540,542,544,547,550,552,555,558,560,563],{"class":102,"line":533},23,[100,535,299],{"class":106},[100,537,302],{"class":110},[100,539,305],{"class":110},[100,541,308],{"class":110},[100,543,311],{"class":110},[100,545,546],{"class":110}," any",[100,548,549],{"class":110}," of",[100,551,390],{"class":110},[100,553,554],{"class":110}," above",[100,556,557],{"class":110}," interfaces?",[100,559,321],{"class":320},[100,561,562],{"class":106},"yes",[100,564,565],{"class":320},"): 1\n",[100,567,569],{"class":102,"line":568},24,[100,570,263],{"emptyLinePlaceholder":262},[100,572,574,576,579,582,585,588,591,593,595,598,601,604],{"class":102,"line":573},25,[100,575,244],{"class":106},[100,577,578],{"class":110}," one",[100,580,581],{"class":110}," or",[100,583,584],{"class":110}," more",[100,586,587],{"class":110}," identifiers",[100,589,590],{"class":110}," from",[100,592,390],{"class":110},[100,594,554],{"class":110},[100,596,597],{"class":110}," interfaces",[100,599,600],{"class":110}," separated",[100,602,603],{"class":110}," by",[100,605,606],{"class":110}," commas.\n",[100,608,610,613,616],{"class":102,"line":609},26,[100,611,612],{"class":106},"For",[100,614,615],{"class":110}," example,",[100,617,618],{"class":110}," 1,2,3\n",[100,620,622],{"class":102,"line":621},27,[100,623,263],{"emptyLinePlaceholder":262},[100,625,627,629,632,635,638],{"class":102,"line":626},28,[100,628,269],{"class":106},[100,630,631],{"class":110}," select",[100,633,634],{"class":110}," interface",[100,636,637],{"class":110}," identifiers:",[100,639,640],{"class":126}," 1\n",[100,642,644],{"class":102,"line":643},29,[100,645,263],{"emptyLinePlaceholder":262},[100,647,649,652,654,657,659],{"class":102,"line":648},30,[100,650,651],{"class":106},"  Configure",[100,653,381],{"class":110},[100,655,656],{"class":110}," on",[100,658,634],{"class":110},[100,660,661],{"class":110}," ge-0\u002F0\u002F0\n",[100,663,665],{"class":102,"line":664},31,[100,666,263],{"emptyLinePlaceholder":262},[100,668,670,673,675,677,680,683,686],{"class":102,"line":669},32,[100,671,672],{"class":106},"    IP",[100,674,384],{"class":110},[100,676,387],{"class":110},[100,678,679],{"class":110}," this",[100,681,682],{"class":110}," interface:",[100,684,685],{"class":126}," 178.30.70.49",[100,687,689],{"class":688},"sHwdD","               # fictional IP block at 178.30.70.48\u002F29\n",[100,691,693,696,699,702,705,707,709,711],{"class":102,"line":692},33,[100,694,695],{"class":106},"    Subnet",[100,697,698],{"class":110}," mask",[100,700,701],{"class":110}," bit",[100,703,704],{"class":110}," length",[100,706,387],{"class":110},[100,708,679],{"class":110},[100,710,634],{"class":110},[100,712,713],{"class":320}," [1-32]: 29\n",[100,715,717],{"class":102,"line":716},34,[100,718,263],{"emptyLinePlaceholder":262},[100,720,722,724,726,728,730,732,735,738,740,742],{"class":102,"line":721},35,[100,723,299],{"class":106},[100,725,302],{"class":110},[100,727,305],{"class":110},[100,729,308],{"class":110},[100,731,311],{"class":110},[100,733,734],{"class":110}," default",[100,736,737],{"class":110}," gateway?",[100,739,367],{"class":320},[100,741,370],{"class":110},[100,743,432],{"class":320},[100,745,747,750,752,754,756,758,760,763],{"class":102,"line":746},36,[100,748,749],{"class":106},"    Enter",[100,751,381],{"class":110},[100,753,384],{"class":110},[100,755,387],{"class":110},[100,757,390],{"class":110},[100,759,734],{"class":110},[100,761,762],{"class":110}," gateway:",[100,764,765],{"class":126}," 178.30.70.54\n",[100,767,769],{"class":102,"line":768},37,[100,770,263],{"emptyLinePlaceholder":262},[100,772,774,776,778,780,782,785,788,791,794,797,799,801],{"class":102,"line":773},38,[100,775,299],{"class":106},[100,777,302],{"class":110},[100,779,305],{"class":110},[100,781,308],{"class":110},[100,783,784],{"class":110}," create",[100,786,787],{"class":110}," a",[100,789,790],{"class":110}," new",[100,792,793],{"class":110}," user",[100,795,796],{"class":110}," account?",[100,798,321],{"class":320},[100,800,324],{"class":106},[100,802,327],{"class":320},[100,804,806],{"class":102,"line":805},39,[100,807,263],{"emptyLinePlaceholder":262},[100,809,811,814,816,818,821],{"class":102,"line":810},40,[100,812,813],{"class":106},"No",[100,815,790],{"class":110},[100,817,793],{"class":110},[100,819,820],{"class":110}," was",[100,822,823],{"class":110}," configured.\n",[100,825,827],{"class":102,"line":826},41,[100,828,263],{"emptyLinePlaceholder":262},[100,830,832,834,836,838,840,842,845,848,851,853,855],{"class":102,"line":831},42,[100,833,299],{"class":106},[100,835,302],{"class":110},[100,837,305],{"class":110},[100,839,308],{"class":110},[100,841,311],{"class":110},[100,843,844],{"class":110}," SNMP",[100,846,847],{"class":110}," Network",[100,849,850],{"class":110}," Management?",[100,852,321],{"class":320},[100,854,324],{"class":106},[100,856,327],{"class":320},[100,858,860],{"class":102,"line":859},43,[100,861,263],{"emptyLinePlaceholder":262},[100,863,865,868,870,873,875,878],{"class":102,"line":864},44,[100,866,867],{"class":106},"SNMP",[100,869,847],{"class":110},[100,871,872],{"class":110}," Management",[100,874,820],{"class":110},[100,876,877],{"class":110}," not",[100,879,880],{"class":110}," configured\n",[100,882,884],{"class":102,"line":883},45,[100,885,263],{"emptyLinePlaceholder":262},[100,887,889,891,893,895,897,900,903,906,908,910],{"class":102,"line":888},46,[100,890,299],{"class":106},[100,892,302],{"class":110},[100,894,305],{"class":110},[100,896,308],{"class":110},[100,898,899],{"class":110}," review",[100,901,902],{"class":110}," configuration",[100,904,905],{"class":110}," commands?",[100,907,321],{"class":320},[100,909,324],{"class":106},[100,911,912],{"class":320},"): yes\n",[100,914,916],{"class":102,"line":915},47,[100,917,263],{"emptyLinePlaceholder":262},[100,919,921,923,925,927,929,932,934,937,939,942,945],{"class":102,"line":920},48,[100,922,299],{"class":106},[100,924,302],{"class":110},[100,926,305],{"class":110},[100,928,308],{"class":110},[100,930,931],{"class":110}," commit",[100,933,390],{"class":110},[100,935,936],{"class":110}," initial",[100,938,902],{"class":110},[100,940,941],{"class":110}," and",[100,943,944],{"class":110}," exit?",[100,946,947],{"class":320}," [yes,no]: yes\n",[15,949,950],{},"The summary of the commands is as follows:",[91,952,954],{"className":93,"code":953,"language":95,"meta":85,"style":85},"set system host-name firefly-kassianoff\nset system root-authenfication encrypted-password-value \"*******\"\nset system name-server 8.8.8.8\nset interfaces ge-0\u002F0\u002F0 unit 0 family inet address 178.30.70.49\u002F29\nset system services web-management http\nset system services telnet\nset system services ssh\nset routing-options tatic route 0.0.0.0\u002F0 next-hop 178.30.70.54\n",[97,955,956,970,992,1004,1030,1045,1056,1067],{"__ignoreMap":85},[100,957,958,962,965,968],{"class":102,"line":103},[100,959,961],{"class":960},"s2Zo4","set",[100,963,964],{"class":110}," system",[100,966,967],{"class":110}," host-name",[100,969,256],{"class":110},[100,971,972,974,976,979,982,986,989],{"class":102,"line":259},[100,973,961],{"class":960},[100,975,964],{"class":110},[100,977,978],{"class":110}," root-authenfication",[100,980,981],{"class":110}," encrypted-password-value",[100,983,985],{"class":984},"sMK4o"," \"",[100,987,988],{"class":110},"*******",[100,990,991],{"class":984},"\"\n",[100,993,994,996,998,1001],{"class":102,"line":266},[100,995,961],{"class":960},[100,997,964],{"class":110},[100,999,1000],{"class":110}," name-server",[100,1002,1003],{"class":126}," 8.8.8.8\n",[100,1005,1006,1008,1010,1013,1016,1019,1022,1025,1027],{"class":102,"line":281},[100,1007,961],{"class":960},[100,1009,597],{"class":110},[100,1011,1012],{"class":110}," ge-0\u002F0\u002F0",[100,1014,1015],{"class":110}," unit",[100,1017,1018],{"class":126}," 0",[100,1020,1021],{"class":110}," family",[100,1023,1024],{"class":110}," inet",[100,1026,384],{"class":110},[100,1028,1029],{"class":110}," 178.30.70.49\u002F29\n",[100,1031,1032,1034,1036,1039,1042],{"class":102,"line":291},[100,1033,961],{"class":960},[100,1035,964],{"class":110},[100,1037,1038],{"class":110}," services",[100,1040,1041],{"class":110}," web-management",[100,1043,1044],{"class":110}," http\n",[100,1046,1047,1049,1051,1053],{"class":102,"line":296},[100,1048,961],{"class":960},[100,1050,964],{"class":110},[100,1052,1038],{"class":110},[100,1054,1055],{"class":110}," telnet\n",[100,1057,1058,1060,1062,1064],{"class":102,"line":330},[100,1059,961],{"class":960},[100,1061,964],{"class":110},[100,1063,1038],{"class":110},[100,1065,1066],{"class":110}," ssh\n",[100,1068,1069,1071,1074,1077,1080,1083,1086],{"class":102,"line":344},[100,1070,961],{"class":960},[100,1072,1073],{"class":110}," routing-options",[100,1075,1076],{"class":110}," tatic",[100,1078,1079],{"class":110}," route",[100,1081,1082],{"class":110}," 0.0.0.0\u002F0",[100,1084,1085],{"class":110}," next-hop",[100,1087,765],{"class":126},[10,1089,1091],{"id":1090},"base-configuration","Base configuration",[15,1093,1094],{},"We now move on to the proper configuration for it to work:",[91,1096,1098],{"className":93,"code":1097,"language":95,"meta":85,"style":85},"configure\n",[97,1099,1100],{"__ignoreMap":85},[100,1101,1102],{"class":102,"line":103},[100,1103,1097],{"class":106},[15,1105,1106],{},"Let's add the external interface to the internet security zone:",[91,1108,1110],{"className":93,"code":1109,"language":95,"meta":85,"style":85},"set security zones security-zone internet interfaces ge-0\u002F0\u002F0.0\n",[97,1111,1112],{"__ignoreMap":85},[100,1113,1114,1116,1119,1122,1125,1128,1130],{"class":102,"line":103},[100,1115,961],{"class":960},[100,1117,1118],{"class":110}," security",[100,1120,1121],{"class":110}," zones",[100,1123,1124],{"class":110}," security-zone",[100,1126,1127],{"class":110}," internet",[100,1129,597],{"class":110},[100,1131,1132],{"class":110}," ge-0\u002F0\u002F0.0\n",[15,1134,1135],{},"Let's allow the system's SSH service traffic in the internet zone:",[91,1137,1139],{"className":93,"code":1138,"language":95,"meta":85,"style":85},"set security zones security-zone internet host-inbound-traffic system-services ssh\n",[97,1140,1141],{"__ignoreMap":85},[100,1142,1143,1145,1147,1149,1151,1153,1156,1159],{"class":102,"line":103},[100,1144,961],{"class":960},[100,1146,1118],{"class":110},[100,1148,1121],{"class":110},[100,1150,1124],{"class":110},[100,1152,1127],{"class":110},[100,1154,1155],{"class":110}," host-inbound-traffic",[100,1157,1158],{"class":110}," system-services",[100,1160,1066],{"class":110},[15,1162,1163],{},"From the outside, we'll therefore have SSH access, but don't forget to fine-tune a few settings:",[91,1165,1167],{"className":93,"code":1166,"language":95,"meta":85,"style":85},"set system services ssh protocol-version v2\n",[97,1168,1169],{"__ignoreMap":85},[100,1170,1171,1173,1175,1177,1180,1183],{"class":102,"line":103},[100,1172,961],{"class":960},[100,1174,964],{"class":110},[100,1176,1038],{"class":110},[100,1178,1179],{"class":110}," ssh",[100,1181,1182],{"class":110}," protocol-version",[100,1184,1185],{"class":110}," v2\n",[91,1187,1189],{"className":93,"code":1188,"language":95,"meta":85,"style":85},"set system services ssh rate-limit 3 connection-limit 3\n",[97,1190,1191],{"__ignoreMap":85},[100,1192,1193,1195,1197,1199,1201,1204,1207,1210],{"class":102,"line":103},[100,1194,961],{"class":960},[100,1196,964],{"class":110},[100,1198,1038],{"class":110},[100,1200,1179],{"class":110},[100,1202,1203],{"class":110}," rate-limit",[100,1205,1206],{"class":126}," 3",[100,1208,1209],{"class":110}," connection-limit",[100,1211,1212],{"class":126}," 3\n",[15,1214,1215],{},"Configuring the LAN interfaces spread across their respective zones:",[91,1217,1219],{"className":93,"code":1218,"language":95,"meta":85,"style":85},"set interfaces ge-0\u002F0\u002F1 description web\nset interfaces ge-0\u002F0\u002F1 unit 0 family inet address 192.168.10.1\u002F29\n",[97,1220,1221,1236],{"__ignoreMap":85},[100,1222,1223,1225,1227,1230,1233],{"class":102,"line":103},[100,1224,961],{"class":960},[100,1226,597],{"class":110},[100,1228,1229],{"class":110}," ge-0\u002F0\u002F1",[100,1231,1232],{"class":110}," description",[100,1234,1235],{"class":110}," web\n",[100,1237,1238,1240,1242,1244,1246,1248,1250,1252,1254],{"class":102,"line":259},[100,1239,961],{"class":960},[100,1241,597],{"class":110},[100,1243,1229],{"class":110},[100,1245,1015],{"class":110},[100,1247,1018],{"class":126},[100,1249,1021],{"class":110},[100,1251,1024],{"class":110},[100,1253,384],{"class":110},[100,1255,1256],{"class":110}," 192.168.10.1\u002F29\n",[91,1258,1260],{"className":93,"code":1259,"language":95,"meta":85,"style":85},"set interfaces ge-0\u002F0\u002F2 description management\nset interfaces ge-0\u002F0\u002F2 unit 0 family inet address 192.168.20.1\u002F29\n",[97,1261,1262,1276],{"__ignoreMap":85},[100,1263,1264,1266,1268,1271,1273],{"class":102,"line":103},[100,1265,961],{"class":960},[100,1267,597],{"class":110},[100,1269,1270],{"class":110}," ge-0\u002F0\u002F2",[100,1272,1232],{"class":110},[100,1274,1275],{"class":110}," management\n",[100,1277,1278,1280,1282,1284,1286,1288,1290,1292,1294],{"class":102,"line":259},[100,1279,961],{"class":960},[100,1281,597],{"class":110},[100,1283,1270],{"class":110},[100,1285,1015],{"class":110},[100,1287,1018],{"class":126},[100,1289,1021],{"class":110},[100,1291,1024],{"class":110},[100,1293,384],{"class":110},[100,1295,1296],{"class":110}," 192.168.20.1\u002F29\n",[91,1298,1300],{"className":93,"code":1299,"language":95,"meta":85,"style":85},"set interfaces ge-0\u002F0\u002F3 description openvpn\nset interfaces ge-0\u002F0\u002F3 unit 0 family inet address 192.168.30.1\u002F29\n",[97,1301,1302,1316],{"__ignoreMap":85},[100,1303,1304,1306,1308,1311,1313],{"class":102,"line":103},[100,1305,961],{"class":960},[100,1307,597],{"class":110},[100,1309,1310],{"class":110}," ge-0\u002F0\u002F3",[100,1312,1232],{"class":110},[100,1314,1315],{"class":110}," openvpn\n",[100,1317,1318,1320,1322,1324,1326,1328,1330,1332,1334],{"class":102,"line":259},[100,1319,961],{"class":960},[100,1321,597],{"class":110},[100,1323,1310],{"class":110},[100,1325,1015],{"class":110},[100,1327,1018],{"class":126},[100,1329,1021],{"class":110},[100,1331,1024],{"class":110},[100,1333,384],{"class":110},[100,1335,1336],{"class":110}," 192.168.30.1\u002F29\n",[15,1338,1339],{},"Detail regarding the public interface:",[91,1341,1343],{"className":93,"code":1342,"language":95,"meta":85,"style":85},"set interfaces ge-0\u002F0\u002F0 description WAN-01\n",[97,1344,1345],{"__ignoreMap":85},[100,1346,1347,1349,1351,1353,1355],{"class":102,"line":103},[100,1348,961],{"class":960},[100,1350,597],{"class":110},[100,1352,1012],{"class":110},[100,1354,1232],{"class":110},[100,1356,1357],{"class":110}," WAN-01\n",[10,1359,1361],{"id":1360},"security-configuration","Security configuration",[15,1363,1364],{},"Creating the different zones: Web, Management, and Openvpn",[91,1366,1368],{"className":93,"code":1367,"language":95,"meta":85,"style":85},"set security zones security-zone web\nset security zones security-zone web interfaces ge-0\u002F0\u002F1\n",[97,1369,1370,1382],{"__ignoreMap":85},[100,1371,1372,1374,1376,1378,1380],{"class":102,"line":103},[100,1373,961],{"class":960},[100,1375,1118],{"class":110},[100,1377,1121],{"class":110},[100,1379,1124],{"class":110},[100,1381,1235],{"class":110},[100,1383,1384,1386,1388,1390,1392,1395,1397],{"class":102,"line":259},[100,1385,961],{"class":960},[100,1387,1118],{"class":110},[100,1389,1121],{"class":110},[100,1391,1124],{"class":110},[100,1393,1394],{"class":110}," web",[100,1396,597],{"class":110},[100,1398,1399],{"class":110}," ge-0\u002F0\u002F1\n",[91,1401,1403],{"className":93,"code":1402,"language":95,"meta":85,"style":85},"set security zones security-zone management\nset security zones security-zone management interfaces ge-0\u002F0\u002F2\n",[97,1404,1405,1417],{"__ignoreMap":85},[100,1406,1407,1409,1411,1413,1415],{"class":102,"line":103},[100,1408,961],{"class":960},[100,1410,1118],{"class":110},[100,1412,1121],{"class":110},[100,1414,1124],{"class":110},[100,1416,1275],{"class":110},[100,1418,1419,1421,1423,1425,1427,1430,1432],{"class":102,"line":259},[100,1420,961],{"class":960},[100,1422,1118],{"class":110},[100,1424,1121],{"class":110},[100,1426,1124],{"class":110},[100,1428,1429],{"class":110}," management",[100,1431,597],{"class":110},[100,1433,1434],{"class":110}," ge-0\u002F0\u002F2\n",[91,1436,1438],{"className":93,"code":1437,"language":95,"meta":85,"style":85},"set security zones security-zone openvpn\nset security zones security-zone openvpn interfaces ge-0\u002F0\u002F3\n",[97,1439,1440,1452],{"__ignoreMap":85},[100,1441,1442,1444,1446,1448,1450],{"class":102,"line":103},[100,1443,961],{"class":960},[100,1445,1118],{"class":110},[100,1447,1121],{"class":110},[100,1449,1124],{"class":110},[100,1451,1315],{"class":110},[100,1453,1454,1456,1458,1460,1462,1465,1467],{"class":102,"line":259},[100,1455,961],{"class":960},[100,1457,1118],{"class":110},[100,1459,1121],{"class":110},[100,1461,1124],{"class":110},[100,1463,1464],{"class":110}," openvpn",[100,1466,597],{"class":110},[100,1468,1469],{"class":110}," ge-0\u002F0\u002F3\n",[15,1471,1472],{},"Adding the external address to the pool:",[91,1474,1476],{"className":93,"code":1475,"language":95,"meta":85,"style":85},"set security nat source pool wan-01 address 178.30.70.49\u002F32\n",[97,1477,1478],{"__ignoreMap":85},[100,1479,1480,1482,1484,1487,1490,1493,1496,1498],{"class":102,"line":103},[100,1481,961],{"class":960},[100,1483,1118],{"class":110},[100,1485,1486],{"class":110}," nat",[100,1488,1489],{"class":110}," source",[100,1491,1492],{"class":110}," pool",[100,1494,1495],{"class":110}," wan-01",[100,1497,384],{"class":110},[100,1499,1500],{"class":110}," 178.30.70.49\u002F32\n",[15,1502,1503],{},"Setting up Source NAT for:",[91,1505,1507],{"className":93,"code":1506,"language":95,"meta":85,"style":85},"set security nat source rule-set 1 rule 1-1 match source-address 192.168.10.0\u002F29\nset security nat source rule-set 1 rule 1-1 then source-nat pool wan-01\n",[97,1508,1509,1540],{"__ignoreMap":85},[100,1510,1511,1513,1515,1517,1519,1522,1525,1528,1531,1534,1537],{"class":102,"line":103},[100,1512,961],{"class":960},[100,1514,1118],{"class":110},[100,1516,1486],{"class":110},[100,1518,1489],{"class":110},[100,1520,1521],{"class":110}," rule-set",[100,1523,1524],{"class":126}," 1",[100,1526,1527],{"class":110}," rule",[100,1529,1530],{"class":110}," 1-1",[100,1532,1533],{"class":110}," match",[100,1535,1536],{"class":110}," source-address",[100,1538,1539],{"class":110}," 192.168.10.0\u002F29\n",[100,1541,1542,1544,1546,1548,1550,1552,1554,1556,1558,1561,1564,1566],{"class":102,"line":259},[100,1543,961],{"class":960},[100,1545,1118],{"class":110},[100,1547,1486],{"class":110},[100,1549,1489],{"class":110},[100,1551,1521],{"class":110},[100,1553,1524],{"class":126},[100,1555,1527],{"class":110},[100,1557,1530],{"class":110},[100,1559,1560],{"class":110}," then",[100,1562,1563],{"class":110}," source-nat",[100,1565,1492],{"class":110},[100,1567,1568],{"class":110}," wan-01\n",[91,1570,1572],{"className":93,"code":1571,"language":95,"meta":85,"style":85},"set security nat source rule-set 1 rule 1-2 match source-address 192.168.20.0\u002F29\nset security nat source rule-set 1 rule 1-2 then source-nat pool wan-01\n",[97,1573,1574,1600],{"__ignoreMap":85},[100,1575,1576,1578,1580,1582,1584,1586,1588,1590,1593,1595,1597],{"class":102,"line":103},[100,1577,961],{"class":960},[100,1579,1118],{"class":110},[100,1581,1486],{"class":110},[100,1583,1489],{"class":110},[100,1585,1521],{"class":110},[100,1587,1524],{"class":126},[100,1589,1527],{"class":110},[100,1591,1592],{"class":110}," 1-2",[100,1594,1533],{"class":110},[100,1596,1536],{"class":110},[100,1598,1599],{"class":110}," 192.168.20.0\u002F29\n",[100,1601,1602,1604,1606,1608,1610,1612,1614,1616,1618,1620,1622,1624],{"class":102,"line":259},[100,1603,961],{"class":960},[100,1605,1118],{"class":110},[100,1607,1486],{"class":110},[100,1609,1489],{"class":110},[100,1611,1521],{"class":110},[100,1613,1524],{"class":126},[100,1615,1527],{"class":110},[100,1617,1592],{"class":110},[100,1619,1560],{"class":110},[100,1621,1563],{"class":110},[100,1623,1492],{"class":110},[100,1625,1568],{"class":110},[91,1627,1629],{"className":93,"code":1628,"language":95,"meta":85,"style":85},"set security nat source rule-set 1 rule 1-3 match source-address 192.168.30.0\u002F29\nset security nat source rule-set 1 rule 1-3 then source-nat pool wan-01\n",[97,1630,1631,1657],{"__ignoreMap":85},[100,1632,1633,1635,1637,1639,1641,1643,1645,1647,1650,1652,1654],{"class":102,"line":103},[100,1634,961],{"class":960},[100,1636,1118],{"class":110},[100,1638,1486],{"class":110},[100,1640,1489],{"class":110},[100,1642,1521],{"class":110},[100,1644,1524],{"class":126},[100,1646,1527],{"class":110},[100,1648,1649],{"class":110}," 1-3",[100,1651,1533],{"class":110},[100,1653,1536],{"class":110},[100,1655,1656],{"class":110}," 192.168.30.0\u002F29\n",[100,1658,1659,1661,1663,1665,1667,1669,1671,1673,1675,1677,1679,1681],{"class":102,"line":259},[100,1660,961],{"class":960},[100,1662,1118],{"class":110},[100,1664,1486],{"class":110},[100,1666,1489],{"class":110},[100,1668,1521],{"class":110},[100,1670,1524],{"class":126},[100,1672,1527],{"class":110},[100,1674,1649],{"class":110},[100,1676,1560],{"class":110},[100,1678,1563],{"class":110},[100,1680,1492],{"class":110},[100,1682,1568],{"class":110},[15,1684,1685],{},"Also, a simpler and faster way:",[91,1687,1689],{"className":93,"code":1688,"language":95,"meta":85,"style":85},"set security nat source rule-set 1 rule 1-1 match source-address [ 192.168.10.0\u002F29 192.168.20.0\u002F29 192.168.30.0\u002F29 ]\nset security nat source rule-set 1 rule 1-1 then source-nat pool wan-01\n",[97,1690,1691,1728],{"__ignoreMap":85},[100,1692,1693,1695,1697,1699,1701,1703,1705,1707,1709,1711,1713,1716,1719,1722,1725],{"class":102,"line":103},[100,1694,961],{"class":960},[100,1696,1118],{"class":110},[100,1698,1486],{"class":110},[100,1700,1489],{"class":110},[100,1702,1521],{"class":110},[100,1704,1524],{"class":126},[100,1706,1527],{"class":110},[100,1708,1530],{"class":110},[100,1710,1533],{"class":110},[100,1712,1536],{"class":110},[100,1714,1715],{"class":320}," [ ",[100,1717,1718],{"class":110},"192.168.10.0\u002F29",[100,1720,1721],{"class":110}," 192.168.20.0\u002F29",[100,1723,1724],{"class":110}," 192.168.30.0\u002F29",[100,1726,1727],{"class":110}," ]\n",[100,1729,1730,1732,1734,1736,1738,1740,1742,1744,1746,1748,1750,1752],{"class":102,"line":259},[100,1731,961],{"class":960},[100,1733,1118],{"class":110},[100,1735,1486],{"class":110},[100,1737,1489],{"class":110},[100,1739,1521],{"class":110},[100,1741,1524],{"class":126},[100,1743,1527],{"class":110},[100,1745,1530],{"class":110},[100,1747,1560],{"class":110},[100,1749,1563],{"class":110},[100,1751,1492],{"class":110},[100,1753,1568],{"class":110},[15,1755,1756],{},"Setting up Destination NAT for:",[47,1758,1759],{},[50,1760,1761],{},"External access from 178.30.70.49:80 to 192.168.10.1:80",[91,1763,1765],{"className":93,"code":1764,"language":95,"meta":85,"style":85},"set security nat destination pool Web-80 address 192.168.10.2\u002F32 port 80\nset security nat destination rule-set 1 from interface ge-0\u002F0\u002F0.0\nset security nat destination rule-set 1 rule 1-1 match destination-address 178.30.70.49\u002F32\nset security nat destination rule-set 1 rule 1-1 match destination-port 80\nset security nat destination rule-set 1 rule 1-1 match protocol tcp\nset security nat destination rule-set 1 rule 1-1 then destination-nat pool Web-80\n",[97,1766,1767,1794,1814,1839,1864,1890],{"__ignoreMap":85},[100,1768,1769,1771,1773,1775,1778,1780,1783,1785,1788,1791],{"class":102,"line":103},[100,1770,961],{"class":960},[100,1772,1118],{"class":110},[100,1774,1486],{"class":110},[100,1776,1777],{"class":110}," destination",[100,1779,1492],{"class":110},[100,1781,1782],{"class":110}," Web-80",[100,1784,384],{"class":110},[100,1786,1787],{"class":110}," 192.168.10.2\u002F32",[100,1789,1790],{"class":110}," port",[100,1792,1793],{"class":126}," 80\n",[100,1795,1796,1798,1800,1802,1804,1806,1808,1810,1812],{"class":102,"line":259},[100,1797,961],{"class":960},[100,1799,1118],{"class":110},[100,1801,1486],{"class":110},[100,1803,1777],{"class":110},[100,1805,1521],{"class":110},[100,1807,1524],{"class":126},[100,1809,590],{"class":110},[100,1811,634],{"class":110},[100,1813,1132],{"class":110},[100,1815,1816,1818,1820,1822,1824,1826,1828,1830,1832,1834,1837],{"class":102,"line":266},[100,1817,961],{"class":960},[100,1819,1118],{"class":110},[100,1821,1486],{"class":110},[100,1823,1777],{"class":110},[100,1825,1521],{"class":110},[100,1827,1524],{"class":126},[100,1829,1527],{"class":110},[100,1831,1530],{"class":110},[100,1833,1533],{"class":110},[100,1835,1836],{"class":110}," destination-address",[100,1838,1500],{"class":110},[100,1840,1841,1843,1845,1847,1849,1851,1853,1855,1857,1859,1862],{"class":102,"line":281},[100,1842,961],{"class":960},[100,1844,1118],{"class":110},[100,1846,1486],{"class":110},[100,1848,1777],{"class":110},[100,1850,1521],{"class":110},[100,1852,1524],{"class":126},[100,1854,1527],{"class":110},[100,1856,1530],{"class":110},[100,1858,1533],{"class":110},[100,1860,1861],{"class":110}," destination-port",[100,1863,1793],{"class":126},[100,1865,1866,1868,1870,1872,1874,1876,1878,1880,1882,1884,1887],{"class":102,"line":291},[100,1867,961],{"class":960},[100,1869,1118],{"class":110},[100,1871,1486],{"class":110},[100,1873,1777],{"class":110},[100,1875,1521],{"class":110},[100,1877,1524],{"class":126},[100,1879,1527],{"class":110},[100,1881,1530],{"class":110},[100,1883,1533],{"class":110},[100,1885,1886],{"class":110}," protocol",[100,1888,1889],{"class":110}," tcp\n",[100,1891,1892,1894,1896,1898,1900,1902,1904,1906,1908,1910,1913,1915],{"class":102,"line":296},[100,1893,961],{"class":960},[100,1895,1118],{"class":110},[100,1897,1486],{"class":110},[100,1899,1777],{"class":110},[100,1901,1521],{"class":110},[100,1903,1524],{"class":126},[100,1905,1527],{"class":110},[100,1907,1530],{"class":110},[100,1909,1560],{"class":110},[100,1911,1912],{"class":110}," destination-nat",[100,1914,1492],{"class":110},[100,1916,1917],{"class":110}," Web-80\n",[47,1919,1920],{},[50,1921,1922],{},"External access from 178.30.70.49:443 to 192.168.10.1:443",[91,1924,1926],{"className":93,"code":1925,"language":95,"meta":85,"style":85},"set security nat destination pool Web-443 address 192.168.10.2\u002F32 port 443\nset security nat destination rule-set 2 from interface ge-0\u002F0\u002F0.0\nset security nat destination rule-set 2 rule 2-1 match destination-address 178.30.70.49\u002F32\nset security nat destination rule-set 2 rule 2-1 match destination-port 443\nset security nat destination rule-set 2 rule 2-1 match protocol tcp\nset security nat destination rule-set 2 rule 2-1 then destination-nat pool Web-443\n",[97,1927,1928,1952,1973,1998,2022,2046],{"__ignoreMap":85},[100,1929,1930,1932,1934,1936,1938,1940,1943,1945,1947,1949],{"class":102,"line":103},[100,1931,961],{"class":960},[100,1933,1118],{"class":110},[100,1935,1486],{"class":110},[100,1937,1777],{"class":110},[100,1939,1492],{"class":110},[100,1941,1942],{"class":110}," Web-443",[100,1944,384],{"class":110},[100,1946,1787],{"class":110},[100,1948,1790],{"class":110},[100,1950,1951],{"class":126}," 443\n",[100,1953,1954,1956,1958,1960,1962,1964,1967,1969,1971],{"class":102,"line":259},[100,1955,961],{"class":960},[100,1957,1118],{"class":110},[100,1959,1486],{"class":110},[100,1961,1777],{"class":110},[100,1963,1521],{"class":110},[100,1965,1966],{"class":126}," 2",[100,1968,590],{"class":110},[100,1970,634],{"class":110},[100,1972,1132],{"class":110},[100,1974,1975,1977,1979,1981,1983,1985,1987,1989,1992,1994,1996],{"class":102,"line":266},[100,1976,961],{"class":960},[100,1978,1118],{"class":110},[100,1980,1486],{"class":110},[100,1982,1777],{"class":110},[100,1984,1521],{"class":110},[100,1986,1966],{"class":126},[100,1988,1527],{"class":110},[100,1990,1991],{"class":110}," 2-1",[100,1993,1533],{"class":110},[100,1995,1836],{"class":110},[100,1997,1500],{"class":110},[100,1999,2000,2002,2004,2006,2008,2010,2012,2014,2016,2018,2020],{"class":102,"line":281},[100,2001,961],{"class":960},[100,2003,1118],{"class":110},[100,2005,1486],{"class":110},[100,2007,1777],{"class":110},[100,2009,1521],{"class":110},[100,2011,1966],{"class":126},[100,2013,1527],{"class":110},[100,2015,1991],{"class":110},[100,2017,1533],{"class":110},[100,2019,1861],{"class":110},[100,2021,1951],{"class":126},[100,2023,2024,2026,2028,2030,2032,2034,2036,2038,2040,2042,2044],{"class":102,"line":291},[100,2025,961],{"class":960},[100,2027,1118],{"class":110},[100,2029,1486],{"class":110},[100,2031,1777],{"class":110},[100,2033,1521],{"class":110},[100,2035,1966],{"class":126},[100,2037,1527],{"class":110},[100,2039,1991],{"class":110},[100,2041,1533],{"class":110},[100,2043,1886],{"class":110},[100,2045,1889],{"class":110},[100,2047,2048,2050,2052,2054,2056,2058,2060,2062,2064,2066,2068,2070],{"class":102,"line":296},[100,2049,961],{"class":960},[100,2051,1118],{"class":110},[100,2053,1486],{"class":110},[100,2055,1777],{"class":110},[100,2057,1521],{"class":110},[100,2059,1966],{"class":126},[100,2061,1527],{"class":110},[100,2063,1991],{"class":110},[100,2065,1560],{"class":110},[100,2067,1912],{"class":110},[100,2069,1492],{"class":110},[100,2071,2072],{"class":110}," Web-443\n",[15,2074,2075],{},"External access via 178.30.70.49:1194 to 192.168.10.1:1194",[91,2077,2079],{"className":93,"code":2078,"language":95,"meta":85,"style":85},"set security nat destination pool Openvpn-1194 address 192.168.30.2\u002F32 port 1194\nset security nat destination rule-set 3 from interface ge-0\u002F0\u002F0.0\nset security nat destination rule-set 3 rule 3-1 match destination-address 178.30.70.49\u002F32\nset security nat destination rule-set 3 rule 3-1 match destination-port 1194\nset security nat destination rule-set 3 rule 3-1 match protocol tcp\nset security nat destination rule-set 3 rule 3-1 then destination-nat pool Openvpn-1194\n",[97,2080,2081,2106,2126,2151,2175,2199],{"__ignoreMap":85},[100,2082,2083,2085,2087,2089,2091,2093,2096,2098,2101,2103],{"class":102,"line":103},[100,2084,961],{"class":960},[100,2086,1118],{"class":110},[100,2088,1486],{"class":110},[100,2090,1777],{"class":110},[100,2092,1492],{"class":110},[100,2094,2095],{"class":110}," Openvpn-1194",[100,2097,384],{"class":110},[100,2099,2100],{"class":110}," 192.168.30.2\u002F32",[100,2102,1790],{"class":110},[100,2104,2105],{"class":126}," 1194\n",[100,2107,2108,2110,2112,2114,2116,2118,2120,2122,2124],{"class":102,"line":259},[100,2109,961],{"class":960},[100,2111,1118],{"class":110},[100,2113,1486],{"class":110},[100,2115,1777],{"class":110},[100,2117,1521],{"class":110},[100,2119,1206],{"class":126},[100,2121,590],{"class":110},[100,2123,634],{"class":110},[100,2125,1132],{"class":110},[100,2127,2128,2130,2132,2134,2136,2138,2140,2142,2145,2147,2149],{"class":102,"line":266},[100,2129,961],{"class":960},[100,2131,1118],{"class":110},[100,2133,1486],{"class":110},[100,2135,1777],{"class":110},[100,2137,1521],{"class":110},[100,2139,1206],{"class":126},[100,2141,1527],{"class":110},[100,2143,2144],{"class":110}," 3-1",[100,2146,1533],{"class":110},[100,2148,1836],{"class":110},[100,2150,1500],{"class":110},[100,2152,2153,2155,2157,2159,2161,2163,2165,2167,2169,2171,2173],{"class":102,"line":281},[100,2154,961],{"class":960},[100,2156,1118],{"class":110},[100,2158,1486],{"class":110},[100,2160,1777],{"class":110},[100,2162,1521],{"class":110},[100,2164,1206],{"class":126},[100,2166,1527],{"class":110},[100,2168,2144],{"class":110},[100,2170,1533],{"class":110},[100,2172,1861],{"class":110},[100,2174,2105],{"class":126},[100,2176,2177,2179,2181,2183,2185,2187,2189,2191,2193,2195,2197],{"class":102,"line":291},[100,2178,961],{"class":960},[100,2180,1118],{"class":110},[100,2182,1486],{"class":110},[100,2184,1777],{"class":110},[100,2186,1521],{"class":110},[100,2188,1206],{"class":126},[100,2190,1527],{"class":110},[100,2192,2144],{"class":110},[100,2194,1533],{"class":110},[100,2196,1886],{"class":110},[100,2198,1889],{"class":110},[100,2200,2201,2203,2205,2207,2209,2211,2213,2215,2217,2219,2221,2223],{"class":102,"line":296},[100,2202,961],{"class":960},[100,2204,1118],{"class":110},[100,2206,1486],{"class":110},[100,2208,1777],{"class":110},[100,2210,1521],{"class":110},[100,2212,1206],{"class":126},[100,2214,1527],{"class":110},[100,2216,2144],{"class":110},[100,2218,1560],{"class":110},[100,2220,1912],{"class":110},[100,2222,1492],{"class":110},[100,2224,2225],{"class":110}," Openvpn-1194\n",[15,2227,2228],{},"Declaring our different addresses in the address book:",[91,2230,2232],{"className":93,"code":2231,"language":95,"meta":85,"style":85},"set security address-book global address wan-01 178.30.70.49\u002F32\nset security address-book global address server-web 192.168.10.2\u002F32\nset security adress-book global address server-management 192.168.20.2\u002F32\nset security address-book global address server-openvpn 192.168.30.2\u002F32\n",[97,2233,2234,2252,2270,2289],{"__ignoreMap":85},[100,2235,2236,2238,2240,2243,2246,2248,2250],{"class":102,"line":103},[100,2237,961],{"class":960},[100,2239,1118],{"class":110},[100,2241,2242],{"class":110}," address-book",[100,2244,2245],{"class":110}," global",[100,2247,384],{"class":110},[100,2249,1495],{"class":110},[100,2251,1500],{"class":110},[100,2253,2254,2256,2258,2260,2262,2264,2267],{"class":102,"line":259},[100,2255,961],{"class":960},[100,2257,1118],{"class":110},[100,2259,2242],{"class":110},[100,2261,2245],{"class":110},[100,2263,384],{"class":110},[100,2265,2266],{"class":110}," server-web",[100,2268,2269],{"class":110}," 192.168.10.2\u002F32\n",[100,2271,2272,2274,2276,2279,2281,2283,2286],{"class":102,"line":266},[100,2273,961],{"class":960},[100,2275,1118],{"class":110},[100,2277,2278],{"class":110}," adress-book",[100,2280,2245],{"class":110},[100,2282,384],{"class":110},[100,2284,2285],{"class":110}," server-management",[100,2287,2288],{"class":110}," 192.168.20.2\u002F32\n",[100,2290,2291,2293,2295,2297,2299,2301,2304],{"class":102,"line":281},[100,2292,961],{"class":960},[100,2294,1118],{"class":110},[100,2296,2242],{"class":110},[100,2298,2245],{"class":110},[100,2300,384],{"class":110},[100,2302,2303],{"class":110}," server-openvpn",[100,2305,2306],{"class":110}," 192.168.30.2\u002F32\n",[15,2308,2309],{},"Setting up the inter-zone security policies:",[47,2311,2312],{},[50,2313,2314],{},"Internet to Web",[91,2316,2318],{"className":93,"code":2317,"language":95,"meta":85,"style":85},"set security policies from-zone internet to-zone web policy nat-dest-web match source-address any\nset security policies from-zone internet to-zone web policy nat-dest-web match destination-address server-web\nset security policies from-zone internet to-zone web policy nat-dest-web match application any\nset security policies from-zone internet to-zone web policy nat-dest-web then permit\n",[97,2319,2320,2352,2379,2406],{"__ignoreMap":85},[100,2321,2322,2324,2326,2329,2332,2334,2337,2339,2342,2345,2347,2349],{"class":102,"line":103},[100,2323,961],{"class":960},[100,2325,1118],{"class":110},[100,2327,2328],{"class":110}," policies",[100,2330,2331],{"class":110}," from-zone",[100,2333,1127],{"class":110},[100,2335,2336],{"class":110}," to-zone",[100,2338,1394],{"class":110},[100,2340,2341],{"class":110}," policy",[100,2343,2344],{"class":110}," nat-dest-web",[100,2346,1533],{"class":110},[100,2348,1536],{"class":110},[100,2350,2351],{"class":110}," any\n",[100,2353,2354,2356,2358,2360,2362,2364,2366,2368,2370,2372,2374,2376],{"class":102,"line":259},[100,2355,961],{"class":960},[100,2357,1118],{"class":110},[100,2359,2328],{"class":110},[100,2361,2331],{"class":110},[100,2363,1127],{"class":110},[100,2365,2336],{"class":110},[100,2367,1394],{"class":110},[100,2369,2341],{"class":110},[100,2371,2344],{"class":110},[100,2373,1533],{"class":110},[100,2375,1836],{"class":110},[100,2377,2378],{"class":110}," server-web\n",[100,2380,2381,2383,2385,2387,2389,2391,2393,2395,2397,2399,2401,2404],{"class":102,"line":266},[100,2382,961],{"class":960},[100,2384,1118],{"class":110},[100,2386,2328],{"class":110},[100,2388,2331],{"class":110},[100,2390,1127],{"class":110},[100,2392,2336],{"class":110},[100,2394,1394],{"class":110},[100,2396,2341],{"class":110},[100,2398,2344],{"class":110},[100,2400,1533],{"class":110},[100,2402,2403],{"class":110}," application",[100,2405,2351],{"class":110},[100,2407,2408,2410,2412,2414,2416,2418,2420,2422,2424,2426,2428],{"class":102,"line":281},[100,2409,961],{"class":960},[100,2411,1118],{"class":110},[100,2413,2328],{"class":110},[100,2415,2331],{"class":110},[100,2417,1127],{"class":110},[100,2419,2336],{"class":110},[100,2421,1394],{"class":110},[100,2423,2341],{"class":110},[100,2425,2344],{"class":110},[100,2427,1560],{"class":110},[100,2429,2430],{"class":110}," permit\n",[47,2432,2433],{},[50,2434,2435],{},"Web to Internet",[91,2437,2439],{"className":93,"code":2438,"language":95,"meta":85,"style":85},"set security policies from-zone web to-zone internet policy nat-dest-internet match source-address server-web\nset security policies from-zone web to-zone internet policy nat-dest-internet match destination-address any\nset security policies from-zone web to-zone internet policy nat-dest-internet match application any\nset security policies from-zone web to-zone internet policy nat-dest-internet then permit\n",[97,2440,2441,2468,2494,2520],{"__ignoreMap":85},[100,2442,2443,2445,2447,2449,2451,2453,2455,2457,2459,2462,2464,2466],{"class":102,"line":103},[100,2444,961],{"class":960},[100,2446,1118],{"class":110},[100,2448,2328],{"class":110},[100,2450,2331],{"class":110},[100,2452,1394],{"class":110},[100,2454,2336],{"class":110},[100,2456,1127],{"class":110},[100,2458,2341],{"class":110},[100,2460,2461],{"class":110}," nat-dest-internet",[100,2463,1533],{"class":110},[100,2465,1536],{"class":110},[100,2467,2378],{"class":110},[100,2469,2470,2472,2474,2476,2478,2480,2482,2484,2486,2488,2490,2492],{"class":102,"line":259},[100,2471,961],{"class":960},[100,2473,1118],{"class":110},[100,2475,2328],{"class":110},[100,2477,2331],{"class":110},[100,2479,1394],{"class":110},[100,2481,2336],{"class":110},[100,2483,1127],{"class":110},[100,2485,2341],{"class":110},[100,2487,2461],{"class":110},[100,2489,1533],{"class":110},[100,2491,1836],{"class":110},[100,2493,2351],{"class":110},[100,2495,2496,2498,2500,2502,2504,2506,2508,2510,2512,2514,2516,2518],{"class":102,"line":266},[100,2497,961],{"class":960},[100,2499,1118],{"class":110},[100,2501,2328],{"class":110},[100,2503,2331],{"class":110},[100,2505,1394],{"class":110},[100,2507,2336],{"class":110},[100,2509,1127],{"class":110},[100,2511,2341],{"class":110},[100,2513,2461],{"class":110},[100,2515,1533],{"class":110},[100,2517,2403],{"class":110},[100,2519,2351],{"class":110},[100,2521,2522,2524,2526,2528,2530,2532,2534,2536,2538,2540,2542],{"class":102,"line":281},[100,2523,961],{"class":960},[100,2525,1118],{"class":110},[100,2527,2328],{"class":110},[100,2529,2331],{"class":110},[100,2531,1394],{"class":110},[100,2533,2336],{"class":110},[100,2535,1127],{"class":110},[100,2537,2341],{"class":110},[100,2539,2461],{"class":110},[100,2541,1560],{"class":110},[100,2543,2430],{"class":110},[47,2545,2546],{},[50,2547,2548],{},"Internet to Openvpn",[91,2550,2552],{"className":93,"code":2551,"language":95,"meta":85,"style":85},"set security policies from-zone internet to-zone openvpn policy nat-dest-openvpn match source-address any\nset security policies from-zone internet to-zone openvpn policy nat-dest-openvpn match destination-address server-openvpn\nset security policies from-zone internet to-zone openvpn policy nat-dest-openvpn match application any\nset security policies from-zone internet to-zone openvpn policy nat-dest-openvpn then permit\n",[97,2553,2554,2581,2608,2634],{"__ignoreMap":85},[100,2555,2556,2558,2560,2562,2564,2566,2568,2570,2572,2575,2577,2579],{"class":102,"line":103},[100,2557,961],{"class":960},[100,2559,1118],{"class":110},[100,2561,2328],{"class":110},[100,2563,2331],{"class":110},[100,2565,1127],{"class":110},[100,2567,2336],{"class":110},[100,2569,1464],{"class":110},[100,2571,2341],{"class":110},[100,2573,2574],{"class":110}," nat-dest-openvpn",[100,2576,1533],{"class":110},[100,2578,1536],{"class":110},[100,2580,2351],{"class":110},[100,2582,2583,2585,2587,2589,2591,2593,2595,2597,2599,2601,2603,2605],{"class":102,"line":259},[100,2584,961],{"class":960},[100,2586,1118],{"class":110},[100,2588,2328],{"class":110},[100,2590,2331],{"class":110},[100,2592,1127],{"class":110},[100,2594,2336],{"class":110},[100,2596,1464],{"class":110},[100,2598,2341],{"class":110},[100,2600,2574],{"class":110},[100,2602,1533],{"class":110},[100,2604,1836],{"class":110},[100,2606,2607],{"class":110}," server-openvpn\n",[100,2609,2610,2612,2614,2616,2618,2620,2622,2624,2626,2628,2630,2632],{"class":102,"line":266},[100,2611,961],{"class":960},[100,2613,1118],{"class":110},[100,2615,2328],{"class":110},[100,2617,2331],{"class":110},[100,2619,1127],{"class":110},[100,2621,2336],{"class":110},[100,2623,1464],{"class":110},[100,2625,2341],{"class":110},[100,2627,2574],{"class":110},[100,2629,1533],{"class":110},[100,2631,2403],{"class":110},[100,2633,2351],{"class":110},[100,2635,2636,2638,2640,2642,2644,2646,2648,2650,2652,2654,2656],{"class":102,"line":281},[100,2637,961],{"class":960},[100,2639,1118],{"class":110},[100,2641,2328],{"class":110},[100,2643,2331],{"class":110},[100,2645,1127],{"class":110},[100,2647,2336],{"class":110},[100,2649,1464],{"class":110},[100,2651,2341],{"class":110},[100,2653,2574],{"class":110},[100,2655,1560],{"class":110},[100,2657,2430],{"class":110},[47,2659,2660],{},[50,2661,2662],{},"Openvpn to Internet",[91,2664,2666],{"className":93,"code":2665,"language":95,"meta":85,"style":85},"set security policies from-zone openvpn to-zone internet policy nat-dest-internet match source-address server-openvpn\nset security policies from-zone openvpn to-zone internet policy nat-dest-internet match destination-address any\nset security policies from-zone openvpn to-zone internet policy nat-dest-internet match application any\nset security policies from-zone openvpn to-zone internet policy nat-dest-internet then permit\n",[97,2667,2668,2694,2720,2746],{"__ignoreMap":85},[100,2669,2670,2672,2674,2676,2678,2680,2682,2684,2686,2688,2690,2692],{"class":102,"line":103},[100,2671,961],{"class":960},[100,2673,1118],{"class":110},[100,2675,2328],{"class":110},[100,2677,2331],{"class":110},[100,2679,1464],{"class":110},[100,2681,2336],{"class":110},[100,2683,1127],{"class":110},[100,2685,2341],{"class":110},[100,2687,2461],{"class":110},[100,2689,1533],{"class":110},[100,2691,1536],{"class":110},[100,2693,2607],{"class":110},[100,2695,2696,2698,2700,2702,2704,2706,2708,2710,2712,2714,2716,2718],{"class":102,"line":259},[100,2697,961],{"class":960},[100,2699,1118],{"class":110},[100,2701,2328],{"class":110},[100,2703,2331],{"class":110},[100,2705,1464],{"class":110},[100,2707,2336],{"class":110},[100,2709,1127],{"class":110},[100,2711,2341],{"class":110},[100,2713,2461],{"class":110},[100,2715,1533],{"class":110},[100,2717,1836],{"class":110},[100,2719,2351],{"class":110},[100,2721,2722,2724,2726,2728,2730,2732,2734,2736,2738,2740,2742,2744],{"class":102,"line":266},[100,2723,961],{"class":960},[100,2725,1118],{"class":110},[100,2727,2328],{"class":110},[100,2729,2331],{"class":110},[100,2731,1464],{"class":110},[100,2733,2336],{"class":110},[100,2735,1127],{"class":110},[100,2737,2341],{"class":110},[100,2739,2461],{"class":110},[100,2741,1533],{"class":110},[100,2743,2403],{"class":110},[100,2745,2351],{"class":110},[100,2747,2748,2750,2752,2754,2756,2758,2760,2762,2764,2766,2768],{"class":102,"line":281},[100,2749,961],{"class":960},[100,2751,1118],{"class":110},[100,2753,2328],{"class":110},[100,2755,2331],{"class":110},[100,2757,1464],{"class":110},[100,2759,2336],{"class":110},[100,2761,1127],{"class":110},[100,2763,2341],{"class":110},[100,2765,2461],{"class":110},[100,2767,1560],{"class":110},[100,2769,2430],{"class":110},[15,2771,2772,2773,2776],{},"We notice that the ",[53,2774,2775],{},"match application"," condition contains specific applications, and in my case that doesn't suit me. So we need to create our different applications, which we'll then use between the Management and Openvpn zones, for example:",[91,2778,2780],{"className":93,"code":2779,"language":95,"meta":85,"style":85},"set applications application tcp22 destination-port 22\nset applications application tcp5900 destination-port 5900\n",[97,2781,2782,2799],{"__ignoreMap":85},[100,2783,2784,2786,2789,2791,2794,2796],{"class":102,"line":103},[100,2785,961],{"class":960},[100,2787,2788],{"class":110}," applications",[100,2790,2403],{"class":110},[100,2792,2793],{"class":110}," tcp22",[100,2795,1861],{"class":110},[100,2797,2798],{"class":126}," 22\n",[100,2800,2801,2803,2805,2807,2810,2812],{"class":102,"line":259},[100,2802,961],{"class":960},[100,2804,2788],{"class":110},[100,2806,2403],{"class":110},[100,2808,2809],{"class":110}," tcp5900",[100,2811,1861],{"class":110},[100,2813,2814],{"class":126}," 5900\n",[47,2816,2817],{},[50,2818,2819],{},"Management to Openvpn",[91,2821,2823],{"className":93,"code":2822,"language":95,"meta":85,"style":85},"set security policies from-zone management to-zone openvpn policy nat-dest-openvpn match source-address server-management\nset security policies from-zone management to-zone openvpn policy nat-dest-openvpn match destination-address server-openvpn\nset security policies from-zone management to-zone openvpn policy nat-dest-openvpn match application [ tcp22 tcp5900 ]\nset security policies from-zone management to-zone openvpn policy nat-dest-openvpn then permit\n",[97,2824,2825,2852,2878,2911],{"__ignoreMap":85},[100,2826,2827,2829,2831,2833,2835,2837,2839,2841,2843,2845,2847,2849],{"class":102,"line":103},[100,2828,961],{"class":960},[100,2830,1118],{"class":110},[100,2832,2328],{"class":110},[100,2834,2331],{"class":110},[100,2836,1429],{"class":110},[100,2838,2336],{"class":110},[100,2840,1464],{"class":110},[100,2842,2341],{"class":110},[100,2844,2574],{"class":110},[100,2846,1533],{"class":110},[100,2848,1536],{"class":110},[100,2850,2851],{"class":110}," server-management\n",[100,2853,2854,2856,2858,2860,2862,2864,2866,2868,2870,2872,2874,2876],{"class":102,"line":259},[100,2855,961],{"class":960},[100,2857,1118],{"class":110},[100,2859,2328],{"class":110},[100,2861,2331],{"class":110},[100,2863,1429],{"class":110},[100,2865,2336],{"class":110},[100,2867,1464],{"class":110},[100,2869,2341],{"class":110},[100,2871,2574],{"class":110},[100,2873,1533],{"class":110},[100,2875,1836],{"class":110},[100,2877,2607],{"class":110},[100,2879,2880,2882,2884,2886,2888,2890,2892,2894,2896,2898,2900,2902,2904,2907,2909],{"class":102,"line":266},[100,2881,961],{"class":960},[100,2883,1118],{"class":110},[100,2885,2328],{"class":110},[100,2887,2331],{"class":110},[100,2889,1429],{"class":110},[100,2891,2336],{"class":110},[100,2893,1464],{"class":110},[100,2895,2341],{"class":110},[100,2897,2574],{"class":110},[100,2899,1533],{"class":110},[100,2901,2403],{"class":110},[100,2903,1715],{"class":320},[100,2905,2906],{"class":110},"tcp22",[100,2908,2809],{"class":110},[100,2910,1727],{"class":110},[100,2912,2913,2915,2917,2919,2921,2923,2925,2927,2929,2931,2933],{"class":102,"line":281},[100,2914,961],{"class":960},[100,2916,1118],{"class":110},[100,2918,2328],{"class":110},[100,2920,2331],{"class":110},[100,2922,1429],{"class":110},[100,2924,2336],{"class":110},[100,2926,1464],{"class":110},[100,2928,2341],{"class":110},[100,2930,2574],{"class":110},[100,2932,1560],{"class":110},[100,2934,2430],{"class":110},[47,2936,2937],{},[50,2938,2939],{},"Openvpn to Management",[91,2941,2943],{"className":93,"code":2942,"language":95,"meta":85,"style":85},"set security policies from-zone openvpn to-zone management policy nat-dest-management match source-address server-openvpn\nset security policies from-zone openvpn to-zone management policy nat-dest-management match destination-address server-management\nset security policies from-zone openvpn to-zone management policy nat-dest-management match application [tcp22 tcp5900]\nset security policies from-zone openvpn to-zone management policy nat-dest-management then permit\n",[97,2944,2945,2972,2998,3028],{"__ignoreMap":85},[100,2946,2947,2949,2951,2953,2955,2957,2959,2961,2963,2966,2968,2970],{"class":102,"line":103},[100,2948,961],{"class":960},[100,2950,1118],{"class":110},[100,2952,2328],{"class":110},[100,2954,2331],{"class":110},[100,2956,1464],{"class":110},[100,2958,2336],{"class":110},[100,2960,1429],{"class":110},[100,2962,2341],{"class":110},[100,2964,2965],{"class":110}," nat-dest-management",[100,2967,1533],{"class":110},[100,2969,1536],{"class":110},[100,2971,2607],{"class":110},[100,2973,2974,2976,2978,2980,2982,2984,2986,2988,2990,2992,2994,2996],{"class":102,"line":259},[100,2975,961],{"class":960},[100,2977,1118],{"class":110},[100,2979,2328],{"class":110},[100,2981,2331],{"class":110},[100,2983,1464],{"class":110},[100,2985,2336],{"class":110},[100,2987,1429],{"class":110},[100,2989,2341],{"class":110},[100,2991,2965],{"class":110},[100,2993,1533],{"class":110},[100,2995,1836],{"class":110},[100,2997,2851],{"class":110},[100,2999,3000,3002,3004,3006,3008,3010,3012,3014,3016,3018,3020,3022,3025],{"class":102,"line":266},[100,3001,961],{"class":960},[100,3003,1118],{"class":110},[100,3005,2328],{"class":110},[100,3007,2331],{"class":110},[100,3009,1464],{"class":110},[100,3011,2336],{"class":110},[100,3013,1429],{"class":110},[100,3015,2341],{"class":110},[100,3017,2965],{"class":110},[100,3019,1533],{"class":110},[100,3021,2403],{"class":110},[100,3023,3024],{"class":320}," [tcp22 ",[100,3026,3027],{"class":110},"tcp5900]\n",[100,3029,3030,3032,3034,3036,3038,3040,3042,3044,3046,3048,3050],{"class":102,"line":281},[100,3031,961],{"class":960},[100,3033,1118],{"class":110},[100,3035,2328],{"class":110},[100,3037,2331],{"class":110},[100,3039,1464],{"class":110},[100,3041,2336],{"class":110},[100,3043,1429],{"class":110},[100,3045,2341],{"class":110},[100,3047,2965],{"class":110},[100,3049,1560],{"class":110},[100,3051,2430],{"class":110},[15,3053,3054],{},"You just need to do the same thing between the Web and Management zones, it's your turn now!",[10,3056,3058],{"id":3057},"conclusion","Conclusion",[15,3060,3061],{},"This Firefly Perimeter configuration sets up a virtualized security gateway: internet\u002Fweb\u002Fmanagement\u002Fopenvpn zones, source and destination NAT, addresses, and inter-zone security policies. This approach lets you secure several distinct LAN networks behind a single public IP while keeping fine-grained control over allowed traffic. It's a good, economical alternative to physical SRX appliances for anyone wanting to virtualize their perimeter security.",[3063,3064,3065],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}",{"title":85,"searchDepth":259,"depth":259,"links":3067},[3068,3069,3070,3073,3074,3075,3076],{"id":12,"depth":259,"text":13},{"id":20,"depth":259,"text":21},{"id":33,"depth":259,"text":34,"children":3071},[3072],{"id":186,"depth":266,"text":187},{"id":214,"depth":259,"text":215},{"id":1090,"depth":259,"text":1091},{"id":1360,"depth":259,"text":1361},{"id":3057,"depth":259,"text":3058},[3078],"Réseau","\u002Fimages\u002Fblog\u002Fconfiguration-regles-securite-sous-junos\u002F1b4814003c.jpg",null,"2015-03-29","Security rules under junOS are effective, simple, and fast. A hands-on introduction with a real-world example using Firefly Perimeter.","md",{},"\u002Fen\u002Fblog\u002Fconfiguration-regles-securite-sous-junos",[3087],"certificat-junos-associe-jncia-junos",{"title":5,"description":3082},"configuration-regles-securite-sous-junos","en\u002Fblog\u002Fconfiguration-regles-securite-sous-junos","uEFrkQ0fWpvWwacGMUND33gHki8RJVW29gAubpaUpBs",[3093,3101,3107,3113,3119,3126,3132,3139],{"title":3094,"path":3095,"stem":3096,"date":3097,"cover":3098,"categories":3099,"children":-1},"Documentation No. 6","\u002Fen\u002Fblog\u002Fbts-documentation-numero-6","en\u002Fblog\u002Fbts-documentation-numero-6","2015-04-13","\u002Fimages\u002Fblog\u002Fbts-documentation-numero-6\u002Ff2154dde28.jpg",[3100],"BTS",{"title":3102,"path":3103,"stem":3104,"date":3097,"cover":3105,"categories":3106,"children":-1},"Documentation No. 7","\u002Fen\u002Fblog\u002Fbts-documentation-numero-7","en\u002Fblog\u002Fbts-documentation-numero-7","\u002Fimages\u002Fblog\u002Fbts-documentation-numero-7\u002F9b090426be.jpg",[3100],{"title":3108,"path":3109,"stem":3110,"date":3097,"cover":3111,"categories":3112,"children":-1},"Documentation No. 8","\u002Fen\u002Fblog\u002Fbts-documentation-numero-8","en\u002Fblog\u002Fbts-documentation-numero-8","\u002Fimages\u002Fblog\u002Fbts-documentation-numero-8\u002F36bb38ac4a.jpg",[3100],{"title":3114,"path":3115,"stem":3116,"date":3097,"cover":3117,"categories":3118,"children":-1},"Documentation No. 9","\u002Fen\u002Fblog\u002Fbts-documentation-numero-9","en\u002Fblog\u002Fbts-documentation-numero-9","\u002Fimages\u002Fblog\u002Fbts-documentation-numero-9\u002Fa7c04713bd.jpg",[3100],{"title":3120,"path":3121,"stem":3122,"date":3123,"cover":3124,"categories":3125,"children":-1},"VMware vCenter in OVH's vRack","\u002Fen\u002Fblog\u002Fvmware-vcenter-dans-vrack-ovh","en\u002Fblog\u002Fvmware-vcenter-dans-vrack-ovh","2015-03-05","\u002Fimages\u002Fblog\u002Fvmware-vcenter-dans-vrack-ovh\u002F1e5012367c.png",[3078],{"title":3127,"path":3128,"stem":3129,"date":3130,"cover":3131,"categories":3080,"children":-1},"Migrating to KVM with WebVirtMgr","\u002Fen\u002Fblog\u002Fmigration-vers-kvm-avec-webvirtmgr","en\u002Fblog\u002Fmigration-vers-kvm-avec-webvirtmgr","2015-03-02","\u002Fimages\u002Fblog\u002Fmigration-vers-kvm-avec-webvirtmgr\u002F1ecef34685.jpg",{"title":3133,"path":3134,"stem":3135,"date":3136,"cover":3137,"categories":3138,"children":-1},"Configuring a Virtual Chassis under Junos","\u002Fen\u002Fblog\u002Fconfiguration-chassis-virtuel-sous-junos","en\u002Fblog\u002Fconfiguration-chassis-virtuel-sous-junos","2014-12-15","\u002Fimages\u002Fblog\u002Fconfiguration-chassis-virtuel-sous-junos\u002F1b4814003c.jpg",[3078],{"title":3140,"path":3141,"stem":3142,"date":3143,"cover":3144,"categories":3145,"children":-1},"My Feedback on Training at Greta-Viva5 in Valence: Mind-Blowing Anecdotes","\u002Fen\u002Fblog\u002Ftemoignage-formation-greta-viva5-valence-des-anecdotes-hallucinantes","en\u002Fblog\u002Ftemoignage-formation-greta-viva5-valence-des-anecdotes-hallucinantes","2014-12-01","\u002Fimages\u002Fblog\u002Ftemoignage-formation-greta-viva5-valence-des-anecdotes-hallucinantes\u002Fc0ef05db34.jpg",[3146],"Évènement",[3148],{"id":3149,"title":3150,"body":3151,"categories":3210,"cover":3212,"cover_contain":262,"credly_badge_id":3213,"date":3214,"description":3215,"extension":3083,"meta":3216,"navigation":262,"path":3217,"related_certifications":3080,"seo":3218,"slug":3087,"stem":3219,"__hash__":3220},"blog\u002Fen\u002Fblog\u002Fcertificat-junos-associe-jncia-junos.md","Junos Associate (JNCIA-Junos)",{"type":7,"value":3152,"toc":3206},[3153,3155,3158,3161,3198,3201,3203],[10,3154,13],{"id":12},[15,3156,3157],{},"To confidently work on Juniper equipment for clients, I completed this Arrow course and obtained the JNCIA-Junos certification.",[15,3159,3160],{},"The \"Junos Associate (JNCIA-Junos)\" training path is designed for IT professionals in charge of computer networks.\nThe course catalog covers the following modules:",[47,3162,3163,3168,3173,3178,3183,3188,3193],{},[50,3164,3165],{},[53,3166,3167],{},"Networking fundamentals",[50,3169,3170],{},[53,3171,3172],{},"Junos OS fundamentals",[50,3174,3175],{},[53,3176,3177],{},"User interfaces",[50,3179,3180],{},[53,3181,3182],{},"Configuration basics",[50,3184,3185],{},[53,3186,3187],{},"Monitoring and maintaining operations",[50,3189,3190],{},[53,3191,3192],{},"Routing fundamentals",[50,3194,3195],{},[53,3196,3197],{},"Routing policy and firewall filters",[15,3199,3200],{},"The training takes about 3 days.\nYou should then allow around 1h30 for the certification exam itself: Junos Associate (JNCIA-Junos).",[10,3202,3058],{"id":3057},[15,3204,3205],{},"This Arrow course covers networking fundamentals and the Junos OS, from basic configuration to routing and firewall filters. It validates a solid understanding of Juniper network equipment, useful for any professional in charge of network infrastructure administration. A certification that complements skills already acquired on other environments.",{"title":85,"searchDepth":259,"depth":259,"links":3207},[3208,3209],{"id":12,"depth":259,"text":13},{"id":3057,"depth":259,"text":3058},[3211,3078],"Certifications","\u002Fimages\u002Fblog\u002Fcertificat-junos-associe-jncia-junos\u002F773018337d.png","907dbe59-515c-4d6b-9ce1-e40082c63c2e","2023-01-17","Junos Associate (JNCIA-Junos): Arrow course, completed as part of my professional watch in cybersecurity and IT.",{},"\u002Fen\u002Fblog\u002Fcertificat-junos-associe-jncia-junos",{"title":3150,"description":3215},"en\u002Fblog\u002Fcertificat-junos-associe-jncia-junos","xYQ66vuN9RwTPB6jnNJm-LxGXEEPDQ3Buj_X9Dx3_pg",1786644890133]