juniper SRX650

goshnash

小弟初次接觸SRX650,想請問NAT的設置
set security nat proxy-arp interface ge-0/0/0.0 address 1.1.1.100---將接口ge-0/0/0.0(接口ip1.1.1.100) 設為arp代理
set security nat destination pool dnat-pool-1 address 10.1.1.100/32----create一個名稱為dnat-pool-1的pool,pool內只有一個ip10.1.1.100/32
set security nat destination rule-set dst-nat from zone untrust-----這行不太懂??
set security nat destination rule-set dst-nat rule rule1 match destination-address 1.1.1.100/32 設置條件rule1,match des為1.1.1.100
set security nat destination rule-set dst-nat rule rule1 match destination-port 80 設置條件rule1,match des為1.1.1.100並使用80port
set security nat destination rule-set dst-nat rule rule1 then destination-nat pool dnat-pool-1----符合上述兩條件則將源為any des為1.1.1.100 nat為10.1.1.100
set security zones security-zone trust address-book address webserver 10.1.1.100---不懂?
set security zones security-zone trust address-book address-set servergroup address webserver ---不懂?
set security policies from-zone untrust to-zone trust policy static-nat match source-address any destination-address servergroup application junos-http---不懂?
set security policies from-zone untrust to-zone trust policy static-nat then permit---不懂?

想請大家幫我看一下,我解釋的內容是否正確,以及我不懂的地方能否幫解答
感謝!!!