Juniper 防火墻HA配置詳解_雙主(L3 路由器模式)

1、Juniper HA 雙主（L3）模式配置實際環(huán)境中防火墻做雙主是不太可能實現(xiàn)全互聯(lián)結(jié)構(gòu)，juniper 防火墻標配都是4個物理以太網(wǎng)端口，全互聯(lián)架構(gòu)需要防火墻增加額外的以太網(wǎng)接口（這樣會增加用戶成本），或者在物理接口上使用子接口（這樣配置的復(fù)雜性增加許多），最主要的是用戶的網(wǎng)絡(luò)中大多沒有像全互聯(lián)模式那樣多的設(shè)備。因此雙主多數(shù)實現(xiàn)在相對冗余的網(wǎng)絡(luò)環(huán)境中。具體實際環(huán)境如下： FW-A FW-B核心-1核心-2E1/1E1/2E1/2E1/1E1/4E1/4HA TRUNK Zone:Untrust Zone:UntrustZone:trust E1/3E1/3Zone:trust 服務(wù)器交換機服

2、務(wù)器服務(wù)器 防火墻A 上執(zhí)行的命令set hostname ISG1000-Aset interface "ethernet1/4" zone "HA"set interface "loopback.1" zone "Trust"set interface loopback.1 routeset router-id 172.255.255.251 必須web 頁面設(shè)置set nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror session ag

3、eout-ackunset nsrp vsd-group id 0set nsrp vsd-group id 1 priority 1set nsrp vsd-group id 1 preemptset nsrp vsd-group id 1 preempt hold-down 10set nsrp vsd-group id 2 priority 255set nsrp vsd-group id 2 preempt hold-down 10set source-routing enable 可選設(shè)置，命令無法執(zhí)行時，在web 頁面設(shè)置set sibr-routing enable 可選設(shè)置，命

4、令無法執(zhí)行時，在web 頁面設(shè)置set adv-inact-interface 可選設(shè)置，命令無法執(zhí)行時，在web 頁面設(shè)置防火墻B 上執(zhí)行的命令set hostname ISG1000-Bset interface "ethernet1/4" zone "HA"set interface "loopback.1" zone "Trust"set interface loopback.1 routeset router-id 172.255.255.252 命令無法執(zhí)行時，在web 頁面設(shè)置set nsrp clu

5、ster id 1set nsrp rto-mirror syncset nsrp rto-mirror session ageout-ackset nsrp rto-mirror session non-vsiunset nsrp vsd-group id 0set nsrp vsd-group id 1 priority 255set nsrp vsd-group id 1 preempt hold-down 10set nsrp vsd-group id 2 priority 1set nsrp vsd-group id 2 preemptset nsrp vsd-group id 2

6、preempt hold-down 10set nsrp secondary-path ethernet1/2set nsrp vsd-group id 1 monitor zone Trustset nsrp vsd-group id 2 monitor zone Trustset nsrp ha-link probeset source-routing enable 可選設(shè)置，命令無法執(zhí)行時，在web 頁面設(shè)置set sibr-routing enable 可選設(shè)置，命令無法執(zhí)行時，在web 頁面設(shè)置set adv-inact-interface 可選設(shè)置，命令無法執(zhí)行時，在web 頁面設(shè)

7、置任意一個防火墻上執(zhí)行的命令即可set interface id 64 "redundant1" zone "Untrust"set interface "ethernet1/3" zone "Trust"set interface ethernet1/2 group redundant1set interface ethernet1/1 group redundant1set interface ethernet1/3:1 routeset interface ethernet1/3:2 routeset int

8、erface redundant1:1 routeset interface redundant1:2 routeset interface ethernet1/3:1 ip manageableset interface ethernet1/3:2 ip manageableset interface loopback.1 ip manageableset interface redundant1:1 ip manageableset interface redundant1:2 ip manageableset policy id 1 name "trunt-to-untrust

9、" from "Trust" to "Untrust" "Any" "Any" "ANY" permit set policy id 2 name "untrust-to-trust" from "Untrust" to "Trust" "Any" "Any" "ANY" permitset protocol ospf 命令無法執(zhí)行時，在web 頁面設(shè)置set ena

10、ble 命令無法執(zhí)行時，在web 頁面設(shè)置set area 0.0.0.0 range 172.17.1.240 255.255.255.240 advertise set area 0.0.0.0 range 172.17.2.0 255.255.255.0 advertiseset interface ethernet1/3:1 protocol ospf enableset interface ethernet1/3:1 protocol ospf priority 0set interface ethernet1/3:1 protocol ospf cost 1set interfac

11、e ethernet1/3:2 protocol ospf enableset interface ethernet1/3:2 protocol ospf priority 0set interface ethernet1/3:2 protocol ospf cost 1set interface redundant1:1 protocol ospf enableset interface redundant1:1 protocol ospf priority 0set interface redundant1:1 protocol ospf cost 1set interface redun

12、dant1:1 manage pingset interface redundant1:1 manage sshset interface redundant1:1 manage telnetset interface redundant1:1 manage webset interface redundant1:2 protocol ospf enableset interface redundant1:2 protocol ospf priority 0set interface redundant1:2 protocol ospf cost 1set interface redundant1:2 manage pingset interface redundant1:2 manage sshset interface redundant1:2 manage telnetset in