SRX的目标NAT，怎么把tcp和udp分开

763622044

SRX中做目标NAT时，先做pool  时set pool name address 192.168.1.11 port 23但是怎么区分是tcp还是udp的23呢？没有相关命令呢？

suis

做nat的pool指的是ip地址范围 跟端口无关吧

416454823

目的NAT转换的时候只要带端口号就行了，但是策略放行的时候要注意是UDP协议还是TCP协议端口号。比如下面这个配置：
set security policies from-zone untrust to-zone trust policy untrust-to-S240 match source-address any
set security policies from-zone untrust to-zone trust policy untrust-to-S240 match destination-address S240
set security policies from-zone untrust to-zone trust policy untrust-to-S240 match application TCP-554
set security policies from-zone untrust to-zone trust policy untrust-to-S240 match application UDP-554
set security policies from-zone untrust to-zone trust policy untrust-to-S240 then permit

set applications application TCP-554 protocol tcp
set applications application TCP-554 destination-port 554
set applications application UDP-554 protocol udp
set applications application UDP-554 destination-port 554