Juniper防火墻HA配置詳解

1、Juniper HA雙主（匚2透明模式配置實際環(huán)境中防火墻做雙主是不太可能實現全互聯結構,juniper防火墻標配都是 4個物理以太網端口，全互聯架構需要防火墻增加額外的以太網接口（這樣會增加 用戶成本，或者在物理接口上使用子接口（這樣配置的復雜性增加許多，最主要的是 用戶的網絡中大多沒有像全互聯模式那樣多的設備。因此雙主多數實現在相對冗 余的網絡環(huán)境中。圖中服務器交換機與核心交換機間采用OSPF動態(tài)路由器協(xié)議, 自動完成雙鏈路的流量負載均衡。具體實際環(huán)境如下：E1/4E1/4HAZone: v1-UntrustZone: v1-trustE1/3E1/3服務器交換機服務器服務器172.16.

2、40.254172.17.1.1172.17.2.1172.17.2.2Zone: v1-trust Zone: v1-Untrust172.17.1.21.1.1.11.1.1.2Vlan100 主Vlan200 從Vlan200 主Vlan100 從防火墻A上執(zhí)行的命令set hostname ISG1000-Aset interface mgt ip 172.16.12.1/24set int mgt manageset interface nethernet1/4 zone HAset nsrp cluster id 1set nsrp rto-mirror syncset nsrp

3、rto-mirror session ageout-ackunset nsrp vsd-group id 0set nsrp vsd-group id 1 preempt hold-down 10 set nsrp vsd-group id 2 priority 255set nsrp vsd-group id 2 preempt hold-down 10 防火墻 B 上執(zhí)行的命令set hostname ISG1000-Bset interface mgt ip 172.16.12.2/24set int mgt manageset interface nethernet1/4 zone H

4、Aset nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror session ageout-ackset nsrp rto-mirror session non-vsiunset nsrp vsd-group id 0set nsrp vsd-group id 1 priority 255set nsrp vsd-group id 1 preempt hold-down 10 set nsrp vsd-group id 2 priority 1set nsrp vsd-group id 2 preemptset nsrp v

5、sd-group id 2 preempt hold-down 10任意一個防火墻上執(zhí)行的命令即可set vlan group name v100set vlan group v100 vsd id 1set vlan group name v200set vlan group v200 200set vlan group v200 vsd id 2set vlan port ethernet1/3 group v100 zone Vl-trust set vlan port ethernet1/1 group v100 zone V1-untrust set vlan port ethernet1/3 group v200 zone V1-trust set vlan port ethernet1/1 group v200 zone V1-untrustset policy from V1-trust to V1-untrust any any any permit set policy from V1- untrust to V1-trust any any any