## Last changed: 2011-06-24 21:38:04 PDT
version 10.4R2.7;
system {
    services {
        dhcp {
            pool 10.0.0.1/20 {
                address-range low 10.0.0.10 high 10.0.0.254;
                router {
                    10.0.0.2;
                }
                server-identifier 10.0.0.1;
            }
            pool 10.0.16.0/20 {
                address-range low 10.0.16.10 high 10.0.16.254;
                router {
                    10.0.16.2;
                }
                server-identifier 10.0.16.1;
            }
            pool 10.0.32.0/20 {
                address-range low 10.0.32.10 high 10.0.32.254;
                router {
                    10.0.32.2;
                }
                server-identifier 10.0.32.1;
            }
        }
    }
}
interfaces {
    ge-0/0/1 {
        vlan-tagging;
        unit 16 {
            description Servers;
            vlan-id 16;
            family inet {
                address 10.0.16.1/20;
            }
        }
        unit 32 {
            description Dev;
            vlan-id 32;
            family inet {
                address 10.0.32.1/20;
            }
        }
        unit 100 {
            description vlan-trust;
            vlan-id 100;
            family inet {
                address 10.0.0.1/20;
            }
        }
    }
    fe-0/0/7 {
        unit 0 {
            family inet {
                address 192.168.1.251/24;
            }
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 192.168.1.254;
    }
}
security {
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
            rule-set dev-to-untrust {
                from zone dev-zone;
                to zone untrust;
                rule dev-source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    zones {
        security-zone untrust {
            screen untrust-screen;
            host-inbound-traffic {
                system-services {
                    all;
                }
            }
            interfaces {
                fe-0/0/7.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            ssh;
                            ike;
                            https;
                        }
                    }
                }
            }
        }
        security-zone servers-zone {
            interfaces {
                ge-0/0/1.16 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            dhcp;
                        }
                    }
                }
            }
        }
        security-zone dev-zone {
            interfaces {
                ge-0/0/1.32 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            dhcp;
                        }
                    }
                }
            }
        }
        security-zone trust {
            interfaces {
                ge-0/0/1.100 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            dhcp;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone dev-zone to-zone untrust {
            policy dev-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone servers-zone to-zone dev-zone {
            policy ssh-to-dev {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone dev-zone to-zone servers-zone {
            policy ssh-to-servers {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}