## Last changed: 2023-02-16 12:10:37 GMT version 21.2R3-S3.5; system { host-name SRX340; root-authentication { encrypted-password ""; ## SECRET-DATA } services { ssh; netconf { ssh; } dhcp-local-server { group jdhcp-group { interface fxp0.0; } } web-management { http { interface [ ge-0/0/0.0 fxp0.0 ]; } https { port 4894; system-generated-certificate; interface [ ge-0/0/0.0 fxp0.0 ]; } } } time-zone GMT; name-server { 194.72.6.57; 194.73.82.242; } name-resolution { no-resolve-on-input; } syslog { archive size 100k files 3; user * { any emergency; } file interactive-commands { interactive-commands any; } file messages { any notice; authorization info; } } max-configurations-on-flash 5; max-configuration-rollbacks 5; license { autoupdate { url https://ae1.juniper.net/junos/key_retrieval; } } ntp { server 0.uk.pool.ntp.org version 4 prefer; } } security { log { mode stream; format syslog; report; } screen { ids-option untrust-screen { icmp { ping-death; } ip { source-route-option; tear-drop; } tcp { syn-flood { alarm-threshold 1024; attack-threshold 200; source-threshold 1024; destination-threshold 2048; timeout 20; } land; } } } nat { source { rule-set source-nat-DGE { from zone trust; to zone untrust; rule source-nat-DGE { match { source-address 192.168.1.0/24; destination-address 0.0.0.0/0; } then { source-nat { interface; } } } rule source-nat-MNGT-DGE { match { source-address 192.168.2.0/24; destination-address 0.0.0.0/0; } then { source-nat { interface; } } } } } destination { pool dst-pool-MNGT-DGE { routing-instance { default; } address 192.168.2.2/32 port 22; } rule-set dst-DGE { from zone untrust; rule dst-rule-MNGT-DGE { match { source-address 0.0.0.0/0; destination-address x.x.x.y/32; destination-port { 1024; } } then { destination-nat { pool { dst-pool-MNGT-DGE; } } } } } } } policies { from-zone untrust to-zone trust { policy untrust-trust { match { source-address any; destination-address any; application any; dynamic-application any; } then { permit; } } } from-zone trust to-zone untrust { policy trust-to-untrust { match { source-address any; destination-address any; application any; dynamic-application any; } then { permit; log { session-init; session-close; } count; } } } } zones { security-zone trust { address-book { address network_2 192.168.2.0/24; } host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { irb.0 { host-inbound-traffic { system-services { all; } protocols { all; } } } irb.1 { host-inbound-traffic { system-services { all; } protocols { all; } } } } } security-zone untrust { host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { ge-0/0/0.0 { host-inbound-traffic { system-services { all; } protocols { all; } } } } } } } interfaces { ge-0/0/0 { unit 0 { family inet { address x.x.x.y/29 { web-authentication http; } } } } ge-0/0/1 { unit 0 { family ethernet-switching { interface-mode access; vlan { members vlan-trust; } } } } ge-0/0/2 { unit 0 { family ethernet-switching { vlan { members vlan-trust; } } } } ge-0/0/3 { unit 0 { family ethernet-switching { interface-mode access; vlan { members vlan-trust-MGNT; } } } } ge-0/0/4 { unit 0 { family ethernet-switching; } } ge-0/0/5 { unit 0 { family ethernet-switching; } } ge-0/0/6 { unit 0 { family ethernet-switching; } } ge-0/0/7 { unit 0 { family ethernet-switching; } } ge-0/0/8 { unit 0 { family ethernet-switching; } } ge-0/0/9 { unit 0 { family ethernet-switching; } } ge-0/0/10 { unit 0 { family ethernet-switching; } } ge-0/0/11 { unit 0 { family ethernet-switching; } } ge-0/0/12 { unit 0 { family ethernet-switching; } } ge-0/0/13 { unit 0 { family ethernet-switching; } } ge-0/0/14 { unit 0 { family ethernet-switching; } } cl-1/0/0 { dialer-options { pool 1 priority 100; } } dl0 { unit 0 { family inet { negotiate-address; } family inet6 { negotiate-address; } dialer-options { pool 1; dial-string 1234; always-on; } } } fxp0 { unit 0 { family inet { address 192.168.10.1/24; } } } irb { unit 0 { family inet { address 192.168.1.1/24; } } unit 1 { family inet { address 192.168.2.1/24; } } } } access { address-assignment { pool junosDHCPPool1 { family inet { network 192.168.10.0/24; range junosRange { low 192.168.10.2; high 192.168.10.254; } dhcp-attributes { propagate-settings ge-0/0/0.0; } } } } } vlans { vlan-trust { vlan-id 3; l3-interface irb.0; } vlan-trust-MGNT { vlan-id 4; l3-interface irb.1; } } protocols { l2-learning { global-mode switching; } rstp { interface all; } } routing-options { static { route 0.0.0.0/0 next-hop x.x.x.x; } }