root@j240-1# show
## Last changed: 2016-10-31 15:44:09 UTC
version 12.1X46-D40.2;
system {
host-name j240-1;
root-authentication {
encrypted-password "$1$vbgtIA4H$8z3x1v2jXh2OaZmDAKP1s/"; ## SECRET-DATA
}
name-server {
208.67.222.222;
208.67.220.220;
}
login {
user admin {
uid 2000;
class super-user;
authentication {
encrypted-password "$1$4V/Tj70v$OgFPqLJjyFJpuU572za5h0"; ## SECRET-DATA
}
}
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
https {
system-generated-certificate;
interface vlan.10;
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
file traffic-log {
any any;
match RT_FLOW_SESSION;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
autoupdate {
url
https://ae1.juniper.net/junos/key_retrieval; }
}
}
interfaces {
traceoptions {
file interface.log size 100k world-readable;
}
ge-0/0/0 {
speed 1g;
unit 0 {
family ethernet-switching {
vlan {
members vlan-10;
}
}
}
}
ip-0/0/0 {
unit 1 {
tunnel {
source 10.0.0.1;
destination 10.0.0.2;
}
family inet {
address 10.1.0.1/30;
}
}
}
ge-0/0/1 {
speed 1g;
unit 0 {
family ethernet-switching {
vlan {
members vlan-100;
}
}
}
}
ge-0/0/2 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/3 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/4 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/5 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/6 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/7 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/8 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/9 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/10 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-200;
}
}
}
}
ge-0/0/11 {
unit 0 {
family ethernet-switching {
vlan {
members vlan-200;
}
}
}
}
ge-0/0/12 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/13 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/14 {
unit 0 {
family ethernet-switching;
}
}
ge-0/0/15 {
unit 0 {
family inet {
address 10.2.0.249/30;
}
}
}
lo0 {
unit 1 {
family inet {
address 10.0.0.1/32;
}
}
}
st0 {
unit 0 {
family inet;
}
}
vlan {
unit 10 {
family inet {
address 192.168.77.1/24;
}
}
unit 100 {
family inet {
address X.X.X.30/28;
}
}
unit 200 {
family inet {
address 10.10.0.1/24;
}
}
}
}
forwarding-options {
port-mirroring {
input {
rate 1;
run-length 20;
}
family inet {
output {
interface ge-0/0/15.0 {
next-hop 192.168.0.254;
}
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop X.X.X.17;
route 10.0.0.2/32 next-hop st0.0;
}
router-id 10.0.0.1;
}
protocols {
ospf {
traceoptions {
file ospf.log size 100k world-readable;
flag all;
}
area 0.0.0.0 {
interface ip-0/0/0.1;
}
area 10.0.0.1 {
interface vlan.10;
}
area 0.0.0.100 {
interface ge-0/0/15.0 {
hello-interval 3;
dead-interval 9;
authentication {
md5 100 key "$9$dfsoZUDkqPQUjHm5FAt"; ## SECRET-DATA
}
}
peer-interface ge-0/0/15.0 {
hello-interval 3;
dead-interval 9;
}
}
}
stp {
disable;
}
}
security {
ike {
traceoptions {
file ike.log size 100k files 2 world-readable;
flag database;
flag all;
}
proposal ike-prop-mikrotik {
description mikrotik_gre_ipsec;
authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm sha1;
encryption-algorithm aes-128-cbc;
lifetime-seconds 1800;
}
policy ike-policy {
mode main;
proposals ike-prop-mikrotik;
pre-shared-key ascii-text "$9$xnhNwY4aZjk.oa69tu1I7-Vbw2"; ## SECRET-DATA
}
gateway ike-gw-ml {
ike-policy ike-policy;
address 10.10.0.2;
dead-peer-detection {
always-send;
interval 10;
threshold 5;
}
no-nat-traversal;
local-identity inet 10.10.0.1;
external-interface vlan.200;
}
}
ipsec {
traceoptions {
flag all;
}
proposal ipsec-proposal {
protocol esp;
authentication-algorithm hmac-md5-96;
encryption-algorithm aes-128-cbc;
lifetime-seconds 1800;
}
policy ipsec-policy {
perfect-forward-secrecy {
keys group2;
}
proposals ipsec-proposal;
}
vpn ml {
bind-interface st0.0;
ike {
gateway ike-gw-ml;
no-anti-replay;
proxy-identity {
local 10.0.0.1/32;
remote 10.0.0.2/32;
service any;
}
ipsec-policy ipsec-policy;
}
establish-tunnels immediately;
}
}
address-book {
global {
address test 192.168.77.151/32;
address network77 192.168.77.0/24;
address ml 172.16.1.0/24;
address vpn-gate 10.0.0.1/32;
}
}
flow {
traceoptions {
file flow.log size 100k files 2 world-readable;
flag basic-datapath;
}
}
inactive: screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
pool test {
address {
X.X.X.30/32;
}
}
pool PBX {
address {
X.X.X.21/32;
}
}
rule-set NAT {
from zone trust;
to zone untrust;
rule NAT-PBX {
match {
source-address 192.168.77.122/32;
}
then {
source-nat {
pool {
PBX;
persistent-nat {
permit target-host;
inactivity-timeout 7200;
}
}
}
}
}
rule NAT-all {
match {
source-address 192.168.77.0/24;
}
then {
source-nat {
interface;
}
}
}
rule nat-ntp {
match {
source-address 10.2.0.254/32;
}
then {
source-nat {
interface;
}
}
}
}
}
static {
rule-set static {
from zone untrust;
rule 1 {
match {
destination-address X.X.X.30/32;
destination-port 10111;
}
then {
static-nat {
prefix {
192.168.77.11/32;
mapped-port 10101;
}
}
}
}
rule 2 {
match {
destination-address X.X.X.30/32;
destination-port 10121;
}
then {
static-nat {
prefix {
192.168.77.12/32;
mapped-port 10101;
}
}
}
}
rule 3 {
match {
destination-address X.X.X.30/32;
destination-port 10131;
}
then {
static-nat {
prefix {
192.168.77.13/32;
mapped-port 10101;
}
}
}
}
rule 4 {
match {
destination-address X.X.X.30/32;
destination-port 10141;
}
then {
static-nat {
prefix {
192.168.77.14/32;
mapped-port 10141;
}
}
}
}
rule 5 {
match {
destination-address X.X.X.30/32;
destination-port 10151;
}
then {
static-nat {
prefix {
192.168.77.15/32;
mapped-port 10101;
}
}
}
}
}
}
proxy-arp {
interface vlan.100 {
address {
X.X.X.21/32;
}
}
}
}
policies {
traceoptions {
file policy.log size 100k files 2 world-readable;
flag all;
}
from-zone trust to-zone untrust {
policy internet-access {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone trust {
policy 123 {
match {
source-address any;
destination-address network77;
application any;
source-identity any;
}
then {
permit;
count;
}
}
}
from-zone trust to-zone trust {
policy allowall {
match {
source-address [ network77 ml ];
destination-address [ network77 ml ];
application any;
}
then {
permit;
}
}
}
inactive: from-zone trust to-zone vpn {
policy allow-any {
match {
source-address network77;
destination-address ml;
application any;
}
then {
permit;
}
}
}
inactive: from-zone vpn to-zone trust {
policy allow-any {
match {
source-address ml;
destination-address network77;
application any;
}
then {
permit;
}
}
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
vlan.10;
ge-0/0/15.0;
lo0.1;
st0.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
ip-0/0/0.1;
}
}
security-zone untrust {
inactive: screen untrust-screen;
host-inbound-traffic {
system-services {
ike;
ping;
}
protocols {
ospf;
}
}
interfaces {
vlan.100;
vlan.200;
}
}
inactive: security-zone vpn {
host-inbound-traffic {
system-services {
any-service;
}
protocols {
all;
}
}
interfaces {
st0.0;
lo0.1;
vlan.200;
ip-0/0/0.1;
}
}
}
}
firewall {
filter port-mirror {
term 1 {
then {
port-mirror;
accept;
}
}
term 2 {
then accept;
}
}
}
vlans {
vlan-10 {
vlan-id 10;
l3-interface vlan.10;
}
vlan-100 {
vlan-id 100;
l3-interface vlan.100;
}
vlan-200 {
vlan-id 200;
l3-interface vlan.200;
}
}
[edit]
root@j240-1#