Cem Kemal Erbaş Network, Siber Güvenlik ve Teknik Rehberler
🌐 Juniper NAT Yapılandırma ve İzleme Komutları (Security NAT)
📌 NAT Gösterim (Show) Komutları
| Açıklama | Komut |
|---|---|
| NAT yapılandırmalarını görüntüle | show security nat veya `show security nat |
| Tüm Source NAT kurallarını göster | show security nat source rule all |
| Source NAT havuzlarını görüntüle | show security nat source pool all |
| Source NAT özet bilgisi | show security nat source summary |
| Static NAT (1:1) kuralları | show security nat static rule all |
| Destination NAT kuralları | show security nat destination rule all |
| Destination NAT havuzları | show security nat destination pool all |
| Destination NAT özeti | show security nat destination summary |
| Persistent NAT tablosu | show security nat source persistent-nat-table summary |
| Tüm aktif session’ları göster | show security flow session veya `show security flow session |
| ALG durumunu kontrol et | show security alg status |
| DNS doctoring’i devre dışı bırak | set security alg dns doctoring none |
🔧 Source NAT (1:N) Yapılandırması
➤ Interface Based Source NAT
Kullanım: Tüm trafiği çıkış arayüz IP’si ile NAT’lamak
set security nat source rule-set 1 from zone trust
set security nat source rule-set 1 to zone untrust
set security nat source rule-set 1 rule 1A match source-address 0.0.0.0/0
set security nat source rule-set 1 rule 1A then source-nat interface
➤ Pool Based Source NAT (NAPT)
Kullanım: Belirli bir iç IP bloğunu dış NAT IP havuzuna çevirmek
# NAT havuzu tanımı
set security nat source pool src_nat_pool_napt address 100.100.100.20/32 to 100.100.100.29/32
# NAT kural seti
set security nat source rule-set src_nat_napt from zone trust
set security nat source rule-set src_nat_napt to zone untrust
# NAT kuralı
set security nat source rule-set src_nat_napt rule napt_1 match source-address 192.168.1.0/24
set security nat source rule-set src_nat_napt rule napt_1 then source-nat pool src_nat_pool_napt
# Proxy ARP ayarı
set security nat proxy-arp interface ge-0/0/0.0 address 100.100.100.20/32 to 100.100.100.29/32
Çoklu kaynak IP ile tek kural:
set security nat source rule-set src_nat_napt rule snat_1 match source-address 192.168.10.5/32
set security nat source rule-set src_nat_napt rule snat_1 match source-address 192.168.11.5/32
set security nat source rule-set src_nat_napt rule snat_1 match destination-address 0.0.0.0/0
set security nat source rule-set src_nat_napt rule snat_1 then source-nat pool snat_pool_1
🔄 Static NAT (1:1)
Kullanım: Dış IP ile iç sunucuyu 1:1 eşleştirme
set security nat static rule-set untrust_to_trust rule RULE-NAME1 match destination-address 203.xx.xx.xx/32
set security nat static rule-set untrust_to_trust rule RULE-NAME1 then static-nat prefix 192.168.0.10/32
# Proxy ARP
set security nat proxy-arp interface vlan.XXX address 203.xx.xx.xx/32
📥 Destination NAT (1:1 ve 1:N)
➤ Destination NAT (1:1)
Amaç: Dış IP → İç IP yönlendirmesi
set security nat destination pool SVR_A address 10.1.1.5/32
set security nat destination rule-set 1 from zone untrust
set security nat destination rule-set 1 rule 1A match destination-address 100.0.0.1/32
set security nat destination rule-set 1 rule 1A then destination-nat pool SVR_A
➤ Destination NAT (1:N) – Port Bazlı NAT
Amaç: Dış IP + Farklı portlar → Farklı iç sunucular
# NAT havuzları
set security nat destination pool SVR_A address 10.1.1.5/32 port 80
set security nat destination pool SVR_B address 10.1.1.6/32 port 80
# NAT kuralları
set security nat destination rule-set 1 from zone untrust
set security nat destination rule-set 1 rule 1A match destination-address 100.0.0.1/32
set security nat destination rule-set 1 rule 1A match destination-port 80
set security nat destination rule-set 1 rule 1A then destination-nat pool SVR_A
set security nat destination rule-set 1 rule 1B match destination-address 100.0.0.1/32
set security nat destination rule-set 1 rule 1B match destination-port 8080
set security nat destination rule-set 1 rule 1B then destination-nat pool SVR_BCem Kemal Erbaş sitesinden daha fazla şey keşfedin
Subscribe to get the latest posts sent to your email.
