Juniper SRX セキュリティポリシーの設定

security {
    policies {
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}

set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any
set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit

#送信元 IP
set security policies from-zone "zone1" to-zone "zone2" policy "policy-name" match source-address "source-address"

#宛先 IP
set security policies from-zone "zone1" to-zone "zone2" policy "policy-name" match destination-address "dest-address"

#アプリケーション
set security policies from-zone "zone1" to-zone "zone2" policy "policy-name" match application "appli-name"

#アクション
set security policies from-zone "zone1" to-zone "zone2" policy "policy-name" then "action"

set security address-book addbook address address01 10.1.10.0/24
set security address-book addbook address address02 10.1.20.0/24
set security address-book addbook address-set address_set01 address address01
set security address-book addbook address-set address_set01 address address02
set security address-book addbook attach zone trust

security {
    address-book {
        addbook {
            address address01 10.1.10.0/24;
            address address02 10.1.20.0/24;
            address-set address_set01 {
                address address01;
                address address02;
            }
            attach {
                zone trust;
            }
        }
    }
}

set applications application tcp_19999 protocol tcp
set applications application tcp_19999 source-port 1024-65535
set applications application tcp_19999 destination-port 19999
set applications application tcp_19999 inactivity-timeout 3600

applications {
    application tcp_19999 {
        protocol tcp;
        source-port 1024-65535;
        destination-port 19999;
        inactivity-timeout 3600;
    }
}

set applications application-set appset01 application tcp_19999
set applications application-set appset01 application tcp_29999

applications {
    application tcp_19999 {
        (略)
    }
    application tcp_29999 {
        (略)
    }
    application-set appset01 {
        application tcp_19999;
        application tcp_29999;
    }
}