远程基本配置

root@SRX1# show | display set 

set version 12.1X44.4

set system host-name SRX1

set system time-zone Asia/Shanghai

set system root-authentication encrypted-password "$1$0m2EDDUB$hW0MnI7hQFLfmFmROx02B1"

set system name-server 114.114.114.114

set system services ssh

set system services web-management http

set system ntp server 62.201.225.9

set interfaces ge-0/0/0 unit 0 family inet address 192.168.130.212/24

set interfaces ge-0/0/1 unit 0 family inet address 1.1.1.254/24

set routing-options static route 0.0.0.0/0 next-hop 192.168.130.2

set security nat source rule-set NAT-Policy from zone trust

set security nat source rule-set NAT-Policy to zone untrust

set security nat source rule-set NAT-Policy rule Trust-Untrust-Interface-NAT match source-address 1.1.1.0/24

set security nat source rule-set NAT-Policy rule Trust-Untrust-Interface-NAT then source-nat interface

set security policies from-zone trust to-zone untrust policy Permit-ALL match source-address any

set security policies from-zone trust to-zone untrust policy Permit-ALL match destination-address any

set security policies from-zone trust to-zone untrust policy Permit-ALL match application any

set security policies from-zone trust to-zone untrust policy Permit-ALL then permit

set security zones security-zone untrust host-inbound-traffic system-services ping

set security zones security-zone untrust host-inbound-traffic system-services ssh

set security zones security-zone untrust host-inbound-traffic system-services http

set security zones security-zone untrust interfaces ge-0/0/0.0

set security zones security-zone trust host-inbound-traffic system-services ping

set security zones security-zone trust host-inbound-traffic system-services ssh

set security zones security-zone trust host-inbound-traffic system-services http

set security zones security-zone trust interfaces ge-0/0/1.0

set security nat static rule-set static-nat from zone untrust

set security nat static rule-set static-nat rule rule1 match destination-address 192.168.130.199/32

set security nat static rule-set static-nat rule rule1 then static-nat prefix 1.1.1.1/32

set security nat proxy-arp interface ge-0/0/0.0 address 192.168.130.199/32

set security zones security-zone trust address-book address test 1.1.1.1/32

set security zones security-zone trust address-book address-set 1.1.1.1 address test

set applications application 3389 protocol tcp

set applications application 3389 destination-port 3389

set applications application-set 3389-3389 application 3389

set security policies from-zone untrust to-zone trust policy 1 match source-address any

set security policies from-zone untrust to-zone trust policy 1 match destination-address test

set security policies from-zone untrust to-zone trust policy 1 match application 3389-3389

set security policies from-zone untrust to-zone trust policy 1 then permit

===========================================================================================

root@SRX2> show interfaces terse | match g  查看接口配置

root@SRX2# show | display set    查看Set格式的配置

root@SRX2# show | compare  查看待提交配置与当前运行配置的差别

root@SRX2> clear system commit  清除未被提交的配置

root@SRX2> show system uptime  查看系统时钟

root@SRX2# commit at "2016-09-30 13:48:00"    在指定时间保存配置

root@SRX2# commit comment "Only test"  为提交的配置进行说明

root@SRX2> show system commit  查看提交配置的说明（包含有提交的配置说明）

root@SRX2# rollback ?   查看可恢复的配置

root@SRX2# rollback 9   恢复某一配置，需commit配置才生效

root@SRX2# commit confirmed  确认提交配置命令（十分钟内不对配置进行确认，自动恢复配置到提交之前）

root@SRX2# commit and-quit 确认并且退出

root@SRX2# set system host-name My-SRX  设置主机名

root@SRX2# set system name-server 114.114.114.114  设置DNS

root@SRX2> show system uptime  查看时间

root@SRX2# set system time-zone Asia/Shanghai  设置时区

root@SRX2> set date 200808080808.08  手动设置时间

root@SRX2# set system ntp server 3.asia.pool.ntp.org  设置NTP

root@SRX2> show ntp associations  查看NTP

root@SRX2> show ntp status  查看NTP

root@SRX2> request system reboot  重启系统

root@SRX2> request system power-off  关闭系统

root@SRX2# set system root-authentication plain-text-password  修改root密码

root@SRX2# set system login user zqb class super-user authentication plain-text-password   设置远程登录密码

恢复root密码

Loading /boot/defaults/loader.conf 

/kernel text=0x894aa0 data=0x4d050+0x100b2c syms=[0x4+0x92cf0+0x4+0xd1487]

/boot/modules/libmbpool.ko text=0xd9c data=0x100 

/boot/modules/if_em_vjx.ko text=0xb794 data=0x5ec+0x204 /

Hit [Enter] to boot immediately, or space bar for command prompt.

================

此时按空格键

OK boot -s

================

进入单用户模式

System watchdog timer disabled

Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery

================

进入密码恢复模式

Starting CLI ... 

root@SRX2> 

root@SRX2# set system services ssh root-login deny  禁止ssh的root登录

root@SRX2# set system services ssh  启用SSH

root@SRX2# set system services web-management http     启动web管理

root@SRX2> show version  查看版本

root@SRX2> show system license 查看授权信息

root@SRX2> request system license add terminal  加载授权信息(回车+Ctrl+D结束)

root@SRX2> show cli history  查看历史命令

root@SRX2> show system processes extensive  查看系统利用率

root@SRX2> restart chassis-control gracefully 重启系统进程

set security zones security-zone trust address-book address 1.1.1.1 1.1.1.1/32

set security zones security-zone trust address-book address 1.1.1.2 1.1.1.2/32

set security zones security-zone trust address-book address-set Inside address 1.1.1.1

set security zones security-zone trust address-book address-set Inside address 1.1.1.2

set applications application 3389 protocol tcp

set applications application 3389 destination-port 3389

set applications application-set 3389-3389 application 3389

set schedulers scheduler test-scheduler daily start-time 09:00 stop-time 18:00

set schedulers scheduler test-scheduler sunday exclude

set schedulers scheduler test-scheduler saturday exclude

set schedulers scheduler one-time start-date 2016-10-18.09:00 stop-date 2016-10-18.18:00

set security policies from-zone trust to-zone untrust policy Permit-ALL scheduler-name test-scheduler

set security nat static rule-set static-nat from zone untrust

set security nat static rule-set static-nat rule rule1 match destination-address 192.168.130.199/32

set security nat static rule-set static-nat rule rule1 then static-nat prefix 1.1.1.1/32

set security nat proxy-arp interface ge-0/0/0.0 address 192.168.130.199/32

set security zones security-zone trust address-book address test 1.1.1.1/32

set security zones security-zone trust address-book address-set 1.1.1.1 address test

set applications application 3389 protocol tcp

set applications application 3389 destination-port 3389

set applications application-set 3389-3389 application 3389

set security policies from-zone untrust to-zone trust policy 1 match source-address any

set security policies from-zone untrust to-zone trust policy 1 match destination-address test

set security policies from-zone untrust to-zone trust policy 1 match application 3389-3389

set security policies from-zone untrust to-zone trust policy 1 then permit

      本文转自开源殿堂 51CTO博客，原文链接：http://blog.51cto.com/kaiyuandiantang/1924561，如需转载请自行联系原作者