JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)課件

1、Juniper_SRX1400_產(chǎn)品配置維護(hù)手冊(cè)2022/7/23JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè) 目 錄一、SRX 1400產(chǎn)品介紹二、JUNOS 基本命令介紹三、SRX 1400配置介紹及演示四、SRX 1400日常維護(hù)JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè) 目 錄一、SRX 1400產(chǎn)品介紹二、JUNOS 基本命令介紹三、SRX 1400配置介紹及演示四、SRX 1400日常維護(hù)JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)SRX 1400 機(jī)箱式設(shè)計(jì)(3U)4個(gè)插槽最大 1塊IOC ; 1塊NSPC ; 1塊RE ; 1塊SYSIOC(GE or XGE)固定接口(SY

2、SIOC)GE型號(hào) 6-10/100/1000,6SFPXGE型號(hào) 6-10/100/1000,3SFP,3SFP+模塊化接口16-10/100/1000;16-SFP;2-XFP多核架構(gòu)2電源冗余(1+1)性能 防火墻吞吐率 (大包) 10 Gbps并發(fā)連接數(shù) 1.5Million*最少需配1NSPC或1SPC+1NPCJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)SRX 1400 CardsNetwork Processing Card (NPC)Single Network Processor (NP) subsystem - 10Gig throughputServices Proces

3、sing Card (SPC)Single HD-CPU subsystem / 10Gig throughputNetwork Services Processing Card (NSPC)1 GHz, 4 GB memory/CPU / 10Gig throughputRouting Engine (RE)1.2Ghz processor /w 1GB memory Complete separation of control / data planesIncludes CPP (central PFE controller) and CB (control board)I/O Cards

4、 (IOC)3 versions at FRS:2-port 10GE-XFP (SR, LR, ER)16-port GE-SFP (SX, LX, LH, T)16-port 10/100/1000 Copper10Gig full-duplex throughput (oversubscribed)JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè) 目 錄一、SRX 1400產(chǎn)品介紹二、JUNOS 基本命令介紹(演示)三、SRX 1400配置介紹及演示四、SRX 1400組網(wǎng)討論JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)內(nèi)容JUNOS基礎(chǔ)知識(shí)基本命令介紹基本配置JuniperSRX1400產(chǎn)

5、品配置維護(hù)手冊(cè)操作模式shell模式$用戶(hù)模式配置模式#cli/exitstart shellconfigure/editexitJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)配置模式配置模式提示符號(hào)是 “#“ 在 模式下鍵入config 進(jìn)入配置模式#提示符還由用戶(hù)名和主機(jī)名共同組成如: userhost#JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)配置模式你編輯的配置文件叫 candidate配置文件配置修改不是馬上生效，必須通過(guò)commit命令提交之后才生效commit提交之后, candidate配置變成active配置文件，然后新的candidate會(huì)被再次創(chuàng)建JuniperSRX14

6、00產(chǎn)品配置維護(hù)手冊(cè)基本命令-show使用 show 命令來(lái)查看candidate配置文件在哪一層就顯示哪一層的配置在最外層就顯示所有配置可以在最外層直接指定需要顯示的層次#show system#show interfaces#show interfaces fxp1#show routing-options#show protocolsJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)set 命令 使用 set 增加或者改變配置set 參數(shù)有些是增加，有些是覆蓋#set system host-name Denver 覆蓋#set interface fxp0 unit 0 family ine

7、t address /24 增加#set routing-options router-id 覆蓋set用法有兩種：(1)一種是用edit進(jìn)入?yún)?shù)層進(jìn)行修改(2)一種是在最外層直接寫(xiě)完所有層次參數(shù)如下面的例子：JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)set 命令方法一： abSRX# edit system edit systemlabSRX# edit login edit system loginlabSRX# edit user lab edit system login user lablabSRX# set uid 2002 edit system

8、login user lablabSRX# 方法一配置繁瑣，但是簡(jiǎn)單明了不容易出錯(cuò)，適合入門(mén)者使用方法二：set system login user lab uid 2002方法二操作簡(jiǎn)單，命令輸入量少，并且可以直接粘貼 ，適合熟練者使用JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)基本命令-commit使用 commit 命令來(lái)使修改后的內(nèi)容生效commit - 檢查配置語(yǔ)法并且激活修改后的內(nèi)容commit check - 僅僅進(jìn)行語(yǔ)法檢查，不真正激活配置commit and-quit 如果提交成功就退出commit confirmed next pageJuniperSRX1400產(chǎn)品配置維

9、護(hù)手冊(cè)基本命令-rollback使用 rollback 命令來(lái)恢復(fù)commit以前的配置rollback只是將配置恢復(fù)到Candidat配置erollback 或者 rollback 0 恢復(fù)上次commit之前的配置rollback 1 上兩次commit之前的配置總共可以恢復(fù)49份配置，rollback后面可以0-49rollback ? 可以顯示每次commit的時(shí)間，確定恢復(fù)那份配置run file show /config/juniper.conf.n.gzn為1-3，可以查看需要恢復(fù)配置的內(nèi)容，對(duì)應(yīng)于rollback 1-3run file show /config/juniper

10、.conf.gz對(duì)應(yīng)rollback 0run file show /var/db/config/juniper.conf.n.gzn為4-49，可以查看需要恢復(fù)配置的內(nèi)容，對(duì)應(yīng)于rollback 4-49JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)配置文件比較Show differences between candidate configuration file andActive configuration“Rollback” configurationAny saved configuration file# show | compare rollback number# show |

11、 compare filenameConfiguration mode onlyLike Unix diffJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)加載配置文件Configuration information can come from an ASCII file prepared offlineSyntaxload (replace | merge | override) filename只改變candidate 配置需要 commit 來(lái)生效Use the load command toOverride 覆蓋已經(jīng)存在的配置要覆蓋整個(gè)配置，使用override 選項(xiàng)merge 新的配置

12、語(yǔ)句合并到已經(jīng)存在的配置文件中replace 用新的配置替代已經(jīng)存在的配置JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)JUNOS Software Version?CLI commands to display installed packagesshow versionJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè) 目 錄一、SRX 1400產(chǎn)品介紹二、JUNOS 基本命令介紹三、SRX 1400配置介紹及演示 Zone Security Policies Network Address Translation High Availability Clustering 四、SRX 1400日常

13、維護(hù)JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)ZonesJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Juniper Networks DeviceRouting Instance 1Routing Instance 2Routing InstanceF.T.F.T.Forwarding TableZone AZone BZone CZone DZonesInterfacesInterfaces、zones、routing instances之間的關(guān)系示意圖JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Zone TypesZone TypesUser-Defined (can be config

14、ured)System-Defined (cannot be configured)SecurityFunctionaljunos-globalNullJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Zone Configuration ProcedureSteps:Define a security or a functional zoneAdd logical interfaces to the zoneOptionally, add services and protocols that must be permitted into the services gateway through

15、the interface belonging to the zoneIf this step is omitted, no traffic destined for the services gateway is permittedJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Security PoliciesJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Security Policy DefinedWhat is a security policy?定義策略組合用于SRX，使其能根據(jù)策略來(lái)決定zone之間的數(shù)據(jù)傳輸What should I do if a packet comes in ma

16、tching Criterion A?JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Transit Traffic ExaminationSRX設(shè)備會(huì)根據(jù)security policies 來(lái)判斷數(shù)據(jù)傳輸?shù)霓D(zhuǎn)發(fā) Does a security policy match the traffic?Apply default policynoPacket inApply policy actions yesJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Default Security PoliciesSystem-default security policy: deny all traffic thr

17、ough the SRX-series services gatewayYou can change the default policy to permit all trafficFactory-default configuration has three security policies:Trust to trust: permit allTrust to untrust: permit allUntrust to trust: deny allX123System-default security policies behaviorDeny ALL transit traffic F

18、actory-default security policies behaviortrust zone untrust zoneJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Policy Components Summaryfrom-zone and to-zone contextMatching criteriaMatching criteriaActionActionedit security policiesfrom-zone zone-name to-zone zone-name policy name1 match source-address address-name1; desti

19、nation-address address-name1; application application-name1; then ; policy name2 match source-address address-name2; destination-address address-name2; application application-name2; then ; JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)High Availability ClusteringJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)High Availability Characteristics Over

20、viewHA provides:Active-passive control and data plane redundancyStateful session failover:NATALGIPsecAuthenticationSynchronization:ConfigurationSession stateChassis clusterJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Chassis Cluster Components OverviewChassis cluster components:Clustered services gateways are grouped by a

21、 cluster-id idNodes within a cluster are identified by a node idRedundancy groupsChassis cluster interfaces:fxp1fxp0fab rethJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)cluster-id DetailsSet using cluster-id id cluster-id values range from 115A router can belong to only one cluster at any given timeIf cluster-id = 0, HA c

22、onfiguration is ignoredServices gateway within a cluster is set by a node idChange in cluster-id id and node id requires services gateway reboot:userhost# set chassis cluster cluster-id 1 node 0 warning: A reboot is required for chassis cluster to be enabledJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)node id Detailsnode

23、id uniquely identifies the services gateway within a clusterRanges from 01 Determines offset of the FPC slot value in the interface name of a services gatewayuserhost set chassis cluster cluster-id id node id reboot Successfully enabled chassis cluster. Going to reboot now.JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Chas

24、sis Cluster InterfacesrethRedundant interface characteristics:A new ethernet pseudo-interface, called rethBundles two physical interfaces (children), one from each member of the clusterMember interfaces inherit properties of reth, as configured by the userMember interfaces can be in either active or

25、 passive mode, but not in bothThe failover properties of the member interfaces are inherited from the RG-1 configurationreth interface has a virtual MAC addressBased on cluster and interface IDJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Chassis Cluster Interfacesfxp0fxp0 interfaceUsed for out-of-band managementAllows acc

26、ess to each node of a clusterIt is good practice for each node to have a unique IP address for fxp0 interfacerequires groups configurationJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Chassis Cluster Interfacesfxp1fxp1 interfaceConfigured SPC ports used for chassis cluster control planege-0/0/10 and ge-0/0/11 on SYSIOCJUNO

27、S software assigns an internal IP address to fxp1Trivial Network Protocol runs on the interfaceJUNOS software transmits heartbeat signals to determine the health of the control linkif the number of missed heartbeats reaches the configured threshold, the system fails overIf fxp1 fails, JUNOS software

28、 disables the secondary nodeNode configuration files are automatically synchronized over fxp1JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Chassis Cluster Interfacesfabfabn = 2 Gigabit Ethernet or 10 GigabitEthernet, used for HA data plane Fabric interface is formed n reflects the node ID and starts from 0Two nodes of a cl

29、uster must have fabn on the same LANfab interface specifics:interface does not support filters, policies, logical interfaces, or servicesMember interfaces must be of the same typeJumbo frames are supportedFragmentation is not supportedJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Chassis Cluster Interface SummaryfabnNode 0

30、Node 1Clusterfxp1fxp0fxp0rethmrethmControl planeData planeManagementManagementRedundant interfacesa.b.c /24JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Monitoring Cluster Statisticsusernode0-host show chassis cluster statistics Initial hold: 10 Reth Information: reth status redundancy-group reth0 down not configured reth1

31、 up 1 Services Synchronized: Service-name Rtos-sent Rtos-received Translation Context 0 0 Incoming NAT 0 0 Resource Manager 5 0 Session-create 0 0 Session-close 0 0 Session-change 0 0 Gate-create 0 0 Session-Ageout-refresh-request 0 0 Session-Ageout-refresh-reply 0 0 VPN 0 0 Firewall User Authentica

32、tion 0 0 MGCP Alg 0 0 .Interface Monitoring: Interface Weight Status Redundancy-group ge-12/0/0 100 up 1 ge-0/0/0 100 up 1 chassis-cluster interfaces: Control link: up 6606 heart beats sent 13729 heart beats received 1200 ms interval 5 thresholdchassis-cluster interfaces: Fabric link: up 15505 heart

33、beat packets sent on fabric-link interface 13728 heartbeat packets received on fabric-link interfaceJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)Manual Failoverusernode0-host show chassis cluster status redundancy-group 1 Cluster: 1, Redundancy-Group: 1 Device name Priority Status Preempt Manual failover node0 200 Primary

34、 No No node1 100 Secondary No No usernode0-host request chassis cluster failover redundancy-group 1 node 1node1:Initiated manual failover for redundancy group 1usernode0-host show chassis cluster status redundancy-group 1 Cluster: 1, Redundancy-Group: 1 Device name Priority Status Preempt Manual fai

35、lover node0 200 Secondary No Yes node1 255 Primary No YesVerify status:Initiate failover:JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè) 目 錄一、SRX 1400產(chǎn)品介紹二、JUNOS 基本命令介紹三、SRX 1400配置介紹及演示四、SRX 1400日常維護(hù)JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)使用故障檢查資源冷卻系統(tǒng)故障檢查日常性能檢查應(yīng)急預(yù)案JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)CLI命令行使用故障檢查資源對(duì)于SRX的硬件、軟件、路由協(xié)議、網(wǎng)絡(luò)連接性的控制和故障檢查、，JUNOS的CLI命

36、令行是主要的使用工具。CLI命令行可以顯示路由表信息，路由協(xié)議的信息，使用ping和traceroute工具體現(xiàn)的網(wǎng)絡(luò)連接信息?？梢酝ㄟ^(guò)連接路由引擎上的CONSOLE、ETHERNET、AUX口進(jìn)入CLI命令行接口。關(guān)于使用CLI顯示端口和機(jī)箱產(chǎn)生的告警信息，請(qǐng)參閱“硬件和端口告警信息”。JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)LED 下面描述的LED位于各個(gè)組件上，用于顯示各個(gè)組件的狀態(tài)。 Craft Interface LED：SRX 1400前面板由一個(gè)Craft 面板指示系統(tǒng)狀態(tài)，Craft面板上包括路由引擎狀態(tài)指示燈，電源狀態(tài)指示燈，風(fēng)扇狀態(tài)指示燈和告警指示燈等等 Compone

37、nt LED：SRX 1400的各個(gè)系統(tǒng)組件還有自己?jiǎn)为?dú)的狀態(tài)指示燈，比如IOC上的每個(gè)端口都有一個(gè)LED指示端口狀態(tài)使用故障檢查資源JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)硬件和端口告警信息當(dāng)路由引擎檢測(cè)到一個(gè)告警的時(shí)候，會(huì)將前面板上相應(yīng)的紅色或者黃色的告警LED點(diǎn)亮?？梢栽诿钚兄惺褂胹how chassis alarms顯示詳細(xì)的告警描述。uerhost show chassis alarms這里將描述兩類(lèi)告警消息：機(jī)箱告警（Chassis alarms）指示機(jī)箱組件的告警信息，例如冷卻系統(tǒng)或者電源系統(tǒng)，詳情請(qǐng)查閱下面的表格。端口告警（Interface alarms）指示某個(gè)端口的

38、問(wèn)題，詳情請(qǐng)查閱下面的表格。下面的兩個(gè)表格中的信息為使用命令show chassis alarms輸出的結(jié)果。表格 36：機(jī)箱告警消息 使用故障檢查資源JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)冷卻系統(tǒng)故障檢查冷卻系統(tǒng)故障檢查冷卻系統(tǒng)包含安裝在機(jī)箱側(cè)面的風(fēng)扇盤(pán)來(lái)保證SRX工作在一個(gè)可以接受的溫度環(huán)境下。要檢查風(fēng)扇盤(pán)，執(zhí)行下面的步驟：通過(guò)CLI命令行檢查電源模塊狀態(tài)。通過(guò)下面的命令，觀察輸出的Status域的狀態(tài)：rootFW02 show chassis environment Class Item Status MeasurementFans Left Fan 1 OK Spinning

39、at normal speed Left Fan 2 OK Spinning at normal speed Left Fan 3 OK Spinning at normal speed Left Fan 4 OK Spinning at normal speed.如果有風(fēng)扇盤(pán)發(fā)生故障，可以通過(guò)觀察判斷出哪一個(gè)風(fēng)扇除了問(wèn)題。然后再處理。JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)日常性能檢查監(jiān)控RE CPU利用率SRX 1400的路由引擎主要工作是維護(hù)路由協(xié)議和路由表rootFW02 show chassis routing-enginerootFW02 show chassis routin

40、g-engine node0:Routing Engine status: Slot 0: Current state Master Election priority Master (default) DRAM 1023 MB Memory utilization 29 percent CPU utilization: User 2 percent Background 0 percent Kernel 8 percent Interrupt 2 percent Idle 88 percent Model RE-SRX 1400 Start time 2010-01-19 22:15:50

41、CST Uptime 7 days, 16 hours, 45 minutes, 20 seconds Last reboot reason 0 x1:power cycle/failure Load averages: 1 minute 5 minute 15 minute 0.01 0.05 0.07JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)日常性能檢查監(jiān)控SPU利用率由于SRX 1400的會(huì)話(huà)查找，維護(hù)都是SPC負(fù)責(zé)的，因此需要監(jiān)控SPC 板卡的利用率。正常工作狀態(tài)下，SPC的CPU利用率應(yīng)該在60%以下，如出現(xiàn)CPU利用率過(guò)高情況需給予足夠重視，應(yīng)檢查Session使用情況和各類(lèi)告警

42、信息，并檢查網(wǎng)絡(luò)中是否存在攻擊流量。SRX防火墻對(duì)內(nèi)存采用“預(yù)分配”機(jī)制，空載時(shí)內(nèi)存使用率為約50-70%，隨著流量不斷增長(zhǎng)，內(nèi)存的使用率應(yīng)基本保持穩(wěn)定。如果出現(xiàn)內(nèi)存使用率高達(dá)90時(shí)，則需檢查網(wǎng)絡(luò)中是否存在攻擊流量。rootFW02 show security monitoring fpc 6 #”6” 是SPC所在的槽位編號(hào)node0:FPC 6 PIC 0 CPU utilization : 13 % （ SPC 的CPU 利用率） Memory utilization : 64 % （ SPC 的內(nèi)存利用率） Current flow session : 73155 Max flow s

43、ession : 524288 Current CP session : 461767 Max CP session : 2359296node1:JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)日常性能檢查監(jiān)控并發(fā)會(huì)話(huà)數(shù)rootFW02 show security monitoring fpc 6 #”6” 是SPC所在的槽位編號(hào)rootFW02 show security monitoring fpc 6 node0:FPC 6 PIC 0CPU utilization : 13 % Memory utilization : 64 % Current flow session : 73155

44、Max flow session : 524288 Current CP session : 461767 （當(dāng)前并發(fā)為461767） Max CP session : 2359296JuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)日常性能檢查監(jiān)控雙機(jī)狀態(tài)正常情況（優(yōu)先級(jí)為1-255，數(shù)值高則優(yōu)先級(jí)高）rootFW02 show chassis cluster statusCluster ID: 1Node Priority Status Preempt Manual failoverRedundancy group: 0 , Failover count: 3 node0 254 primary

45、 no yes node1 100 secondary no yesRedundancy group: 1 , Failover count: 3 node0 254 primary no no node1 100 secondary no noJuniperSRX1400產(chǎn)品配置維護(hù)手冊(cè)日常性能檢查切換雙機(jī)狀態(tài)方法一： CLI 方式rootFW02request chassis cluster failover node 1 redundancy-group 1 (將nod1變?yōu)間roup 1 的主機(jī))rootFW02request chassis cluster failover reset redundancy-group 1 （ 將nod1 的優(yōu)先級(jí)恢復(fù)為254）