当前位置：首页 > news >正文

在JUNIPER MX960中查询流量的策略

news 2026/8/4 9:00:54

在juniperMX960设备中查询哪些地址能够访问指定网段

错误示范：
show configuration | match 10.192 | display set

set firewall filter AFstaticip-authen term 1 from source-address 10.192.0.0/24
set firewall filter anfang term 0 from destination-address 10.192.0.1/32
set firewall filter anfang term 0 from destination-address 10.192.0.8/32
set firewall filter anfang term 0 from destination-address 10.192.0.9/32
set firewall filter anfang term 0 from destination-address 10.192.0.10/32
set firewall filter anfang term 0 from destination-address 10.192.0.14/32
set firewall filter anfang term 0 from destination-address 10.192.0.19/32
set firewall filter anfang term 0 from destination-address 10.192.0.42/32
set firewall filter anfang term 0 from destination-address 10.192.0.254/32
set routing-options static route 10.192.0.0/24 next-hop 10.255.0.34
set routing-options static route 10.192.4.0/24 next-hop 10.255.0.34
set routing-options static route 10.192.5.0/24 next-hop 10.255.0.34
set routing-options static route 10.192.6.0/24 next-hop 10.255.0.34
set routing-options static route 10.192.7.0/24 next-hop 10.255.0.34
set routing-options static route 10.192.8.0/24 next-hop 10.255.0.34
set routing-options static route 10.192.9.0/24 next-hop 10.255.0.34
set routing-options static route 10.192.10.0/24 next-hop 10.255.0.34

正确示范：
先找路由，通过路由确定接口
show route 10.192.0.1

inet.0: 28132 destinations, 28137 routes (28132 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.192.0.0/24 *[Static/5] 8w3d 14:36:23
> to 10.255.0.34 via ge-12/1/5.0

drcom-static.inet.0: 416 destinations, 416 routes (416 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0 *[Static/5] 8w3d 14:36:28
> to 10.255.0.41 via ae12.3906

redirect.inet.0: 416 destinations, 416 routes (416 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0 *[Static/5] 2w0d 23:38:25
> to 10.211.220.9 via ge-0/0/4.0

{master:member1-re0}

在接口下查找相关配置
show configuration interfaces ge-12/1/5
description S127-anfang;
unit 0 {
family inet {
filter {
input AFstaticip-authen;
output anfang;
}
address 10.255.0.33/29;
}
}

找到相关的filter，在filter中确定input方向的流量相关配置

show configuration firewall filter AFstaticip-authen
interface-specific;
term accept {
from {
destination-address {
172.16.0.0/12; ### 数据中心网段
210.45.144.0/20; ### 图书馆网段
121.251.64.0/20; ### 学院楼网段
10.0.0.0/8; ### 校园内网网段
192.168.0.0/16;
}
}
then accept;
}
在这个term中accept几乎全校网段；这是input方向；即相当于全校网段都可以访问10.192.0.1网段；

在filter中确定output方向的流量相关配置
show configuration firewall filter anfang
term 0 {
from {
destination-address {
10.192.0.1/32;
10.255.0.34/32;
10.192.0.8/32;
10.192.0.9/32;
10.192.0.10/32;
10.192.0.14/32;
10.192.0.19/32;
10.192.0.42/32;
10.192.0.254/32;
}
}
then accept;
}