故障處理icbc策略保護(hù)方法

1、 第5頁 共5頁主題： ICBC策略保護(hù)方法20140730時(shí)間：2014年07月30日 撰寫： Juniper工程師 尹巨成概要： 用protect命令來保護(hù)特定的配置不被誤刪除（如policy）labSRX100# show policy trust-to-untrust match source-address any; destination-address any; application any; then permit; policy 1111 match source-address ; destination-address ; application junos-ftp;

2、then permit; policy 2222 match source-address /24; destination-address /24; application junos-ftp junos-tftp ; then permit; edit security policies from-zone trust to-zone untrustlabSRX100# protect policy 1111 edit security policies from-zone trust to-zone untrustlabSRX100# show policy trust-to-untru

3、st match source-address any; destination-address any; application any; then permit; protect: policy 1111 match source-address ; destination-address ; application junos-ftp; then permit; policy 2222 match source-address /24; destination-address /24; application junos-ftp junos-tftp ; then permit; edi

4、t security policies from-zone trust to-zone untrustlabSRX100# delete policy 1111 warning: security policies from-zone trust to-zone untrust policy 1111 is protected, security policies from-zone trust to-zone untrust policy 1111 cannot be deletededit security policies from-zone trust to-zone untrustl

5、abSRX100# unprotect policy 1111 edit security policies from-zone trust to-zone untrustlabSRX100# delete policy 1111 edit security policies from-zone trust to-zone untrust對于protect policy，也不能添加新內(nèi)容labSRX# show security policies | display set set security policies from-zone trust to-zone untrust policy

6、 trust-to-untrust match source-address anyset security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address anyset security policies from-zone trust to-zone untrust policy trust-to-untrust match application anyset security policies from-zone trust to-zone untrus

7、t policy trust-to-untrust then permitset security policies from-zone trust to-zone untrust policy 2222 match source-address /24set security policies from-zone trust to-zone untrust policy 2222 match destination-address /24set security policies from-zone trust to-zone untrust policy 2222 match applic

8、ation junos-ftpset security policies from-zone trust to-zone untrust policy 2222 match application junos-tftpset security policies from-zone trust to-zone untrust policy 2222 then permitprotect security policies from-zone trust to-zone untrust policy 2222set security policies from-zone untrust to-zo

9、ne trust policy untrust-to-trust match source-address anyset security policies from-zone untrust to-zone trust policy untrust-to-trust match destination-address anyset security policies from-zone untrust to-zone trust policy untrust-to-trust match application anyset security policies from-zone untru

10、st to-zone trust policy untrust-to-trust then permitset security policies from-zone untrust to-zone trust policy 111 match source-address /32set security policies from-zone untrust to-zone trust policy 111 match destination-address /32set security policies from-zone untrust to-zone trust policy 111

11、match application junos-ftpset security policies from-zone untrust to-zone trust policy 111 then permitset security policies from-zone trust to-zone trust policy 11111 match source-address anyset security policies from-zone trust to-zone trust policy 11111 match destination-address anyset security p

12、olicies from-zone trust to-zone trust policy 11111 match application anyset security policies from-zone trust to-zone trust policy 11111 then permiteditlabSRX# set security policies from-zone trust to-zone untrust policy 2222 match application junos-telnet warning: security policies from-zone trust to-zon