Juniper防火墻HA配置詳解_雙主(L2透明模式)(精)

1、Juniper HA 雙主（L2 透明模式配置實(shí)際環(huán)境中防火墻做雙主是不太可能實(shí)現(xiàn)全互聯(lián)結(jié)構(gòu)，juniper 防火墻標(biāo)配都 是4 個(gè)物理以太網(wǎng)端口，全互聯(lián)架構(gòu)需要防火墻增加額外的以太網(wǎng)接口（這樣會(huì)增加用戶成本，或者在物理接口上使用子接口（這樣配置的復(fù)雜性增加許多，最主要的是 用戶的網(wǎng)絡(luò)中大多沒有像全互聯(lián)模式那樣多的設(shè)備。因此雙主多數(shù)實(shí)現(xiàn)在相對(duì)冗余的網(wǎng)絡(luò)環(huán)境中。圖中服務(wù)器交換機(jī)與核心交換機(jī)間采用 OSPF 動(dòng)態(tài)路由器協(xié)議, 自動(dòng)完成雙鏈路的流量負(fù)載均衡。具體實(shí)際環(huán)境如下：FW-A FW-B 核心-1 核心-2 E1/1E1/1E1/4E1/4HAZone: v1-U ntrustZone: v1

2、-trustE1/3E1/3服務(wù)器交換機(jī)服務(wù)器服務(wù)器172.16.40.254172.17.1.1172.1721172.1722Zone: v1-trust Zone: v1-U ntrust172.17.1.21.1.1.11.1.1.2Via n100 主Via n200 從Via n200 主Via n100 從防火墻 A 上執(zhí)行的命令set host name ISG1000-Aset in terface mgt ip 172.16.12.1/24set int mgt man ageset in terface ethernet1/4 zo ne HAset nsrp clust

3、er id 1set nsrp rto-mirror syncset nsrp rto-mirror sessi on ageout-ackun set nsrp vsd-group id 0set nsrp vsd-group id 1 priority 1set nsrp vsd-group id 1 preemptset nsrp vsd-group id 1 preempt hold-dow n 10 set nsrp vsd-group id 2 priority 255set nsrp vsd-group id 2 preempt hold-dow n 10 防火墻 B 上執(zhí)行的命

4、令set host name ISG1000-Bset in terface mgt ip 172.16.12.2/24set int mgt man ageset in terface ethernet1/4 zone HAset nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror sessi on ageout-ackset nsrp rto-mirror sessi on non-vsiun set nsrp vsd-group id 0set nsrp vsd-group id 1 priority 255set n

5、srp vsd-group id 1 preempt hold-dow n 10 set nsrp vsd-group id 2 priority 1set nsrp vsd-group id 2 preemptset nsrp vsd-group id 2 preempt hold-dow n 10任意一個(gè)防火墻上執(zhí)行的命令即可set vla n group n ame v100set vlan group v100 100set via n group v100 vsd id 1set via n group n ame v200set vlan group v200 200set via

6、 n group v200 vsd id 2set vian port ethernet1/3 group v100 zone V1-trust set vian port ethernet1/1 groupv100 zone V1-un trust set via n port ether net1/3 group v200 zone V1-trust set via n portethernet1/1 group v200 zone V1- un trustset poiicy from V1-trust to V1-un trust any any any permit set poiicy from V1-un trust to V1-trust any an