## Last commit: 2018-02-23 12:22:10 GMT+1 by root version 15.1X49-D120.3; system { host-name srx1; time-zone GMT+1; root-authentication { encrypted-password "***"; ## SECRET-DATA } name-server { 8.8.8.8; 8.8.4.4; } name-resolution { no-resolve-on-input; } services { ssh; telnet; xnm-clear-text; dhcp-local-server { group jweb-default-group { interface irb.0; } group wlan-grop { interface irb.20; } } web-management { https { system-generated-certificate; } } } syslog { archive size 100k files 3; user * { any emergency; } file messages { any notice; authorization info; } file interactive-commands { interactive-commands any; } } max-configurations-on-flash 5; max-configuration-rollbacks 5; license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } ntp { server us.ntp.pool.org; } } chassis { aggregated-devices { ethernet { device-count 1; lacp { system-priority 0; } } } alarm { management-ethernet { link-down ignore; } } } security { log { mode stream; report; } address-book { global { address google-dns1 8.8.8.8/32; address google-dns2 8.8.4.4/32; address NAS01 10.1.10.20/32; address dip-wlan-range 10.1.20.0/24; address-set google-dns { address google-dns1; address google-dns2; } } } utm { feature-profile { web-filtering { juniper-enhanced { profile DIP_Webfilter { category { Enhanced_Adult_Material { action block; } } default block; fallback-settings { default log-and-permit; server-connectivity log-and-permit; timeout log-and-permit; too-many-requests log-and-permit; } } } } } utm-policy dip-wf-policy { web-filtering { http-profile DIP_Webfilter; } } } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; timeout 20; } land; } } } nat { source { rule-set nsw_srcnat { from zone [ Internal WLan ]; to zone Internet; rule nsw-src-interface { match { source-address 0.0.0.0/0; destination-address 0.0.0.0/0; } then { source-nat { interface; } } } } rule-set wlan_srcnat { from zone WLan; to zone Internal; rule wlan-src-interface { match { source-address 10.1.20.0/24; destination-address 10.1.10.0/24; } then { source-nat { off; } } } } } } policies { from-zone Internal to-zone Internet { policy Allow_HTTP { match { source-address any; destination-address any; application [ junos-http junos-https ]; } then { permit; } } policy Allow_DNS { match { source-address any; destination-address google-dns; application junos-dns-udp; } then { permit; } } } from-zone WLan to-zone Internet { policy Allow_HTTP { match { source-address any; destination-address any; application [ junos-http junos-https ]; } then { permit; } } policy Allow_DNS { match { source-address any; destination-address google-dns; application junos-dns-udp; } then { permit; } } } from-zone WLan to-zone Internal { policy Allow_NAS { match { source-address dip-wlan-range; destination-address NAS01; application any; } then { permit; } } } } zones { security-zone Internal { host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { irb.0 { host-inbound-traffic { system-services { ping; dhcp; } } } irb.10 { host-inbound-traffic { system-services { all; } protocols { all; } } } } } security-zone Internet { interfaces { ge-0/0/0.0; } } security-zone WLan { interfaces { irb.20 { host-inbound-traffic { system-services { ping; dhcp; } } } } } } } interfaces { ge-0/0/0 { unit 0 { family inet { address *.*.*.*/30; } } } ge-0/0/1 { unit 0 { family ethernet-switching { interface-mode access; vlan { members vlan0; } } } } ge-0/0/3 { unit 0 { family ethernet-switching { interface-mode access; vlan { members vlan10; } } } } ge-0/0/4 { unit 0 { family ethernet-switching { interface-mode access; vlan { members vlan20; } } } } ge-0/0/5 { unit 0 { family ethernet-switching { interface-mode trunk; vlan { members vlan99; } } } } fxp0 { unit 0 { family inet { address 192.168.1.1/24; } } } irb { unit 0 { family inet { address 192.168.2.1/24; } } unit 2 { family inet { address 10.1.50.1/24; } } unit 10 { family inet { address 10.1.10.1/24; } } unit 20 { family inet { address 10.1.20.1/24; } } unit 99 { family inet { address 10.1.99.1/24; } } } } routing-options { static { route 0.0.0.0/0 next-hop *.*.*.*; } } protocols { l2-learning { global-mode switching; } rstp { interface all; } } access { address-assignment { pool jweb-default-pool { family inet { network 192.168.2.0/24; range jweb-default-range { low 192.168.2.2; high 192.168.2.254; } dhcp-attributes { name-server { 8.8.8.8; 8.8.4.4; } router { 192.168.2.1; } } } } pool wlan-pool { family inet { network 10.1.20.0/24; range wlan-range { low 10.1.20.10; high 10.1.20.250; } dhcp-attributes { name-server { 8.8.8.8; 8.8.4.4; } router { 10.1.20.1; } } } } } } vlans { Server { vlan-id 50; l3-interface irb.2; } vlan0 { vlan-id 2; l3-interface irb.0; } vlan10 { vlan-id 10; l3-interface irb.10; } vlan20 { vlan-id 20; l3-interface irb.20; } vlan99 { vlan-id 99; l3-interface irb.99; } }