Juniper設(shè)備防火墻運(yùn)維要點(diǎn)

防火墻運(yùn)維要點(diǎn)設(shè)備管理訪問控制ManagementrequeststerminateontheunitAsasecuritydevice,theNetScreenmustqualifyallmanagementrequestsMatchthemanagementaddressofthearrivinginterfaceMatchtheIPaddressofa‘trusted’sourceMatchanallowedservicetypeMatchusername/password

SrcDstMgt.RequestAddrAddr(ie.Ping)ManagementServiceFilterInterfacemanage-ipMgt.AddressAllowedservicesAuthenticationUsername/passwordmanager-ipTrustedSource管理地址數(shù)據(jù)接口地址專用管理端口數(shù)據(jù)接口管理地址HA配置下管理可管理主/備機(jī)主/備地址不同數(shù)據(jù)接口地址可管理數(shù)據(jù)接口管理地址檢查接口配置Network>Interfacesns208->getinterfaceA-Active,I-Inactive,U-Up,D-Down,R-ReadyInterfacesinvsysRoot:NameIPAddressZoneMACVLANStateVSDeth1/24Private0010.db1d.1be0-U-eth2/0V1-DMZ0010.db1d.1be4-D-eth3/0V1-Untrust0010.db1d.1be5-D-eth4/0Private0010.db1d.1be6-D-eth5/0Untrust0010.db1d.1be7-D-eth6/0Null0010.db1d.1be8-D-eth7/24Public0010.db1d.1be9-U-eth8/24External0010.db1d.1bea-U-vlan1/0VLAN0010.db1d.1bef1D-

檢查路由-CLI查看路由ns208->getrouteC-Connected,S-Static,A-Auto-Exported,I-ImportediB-IBGP,eB-EBGP,R-RIP,O-OSPF,E1-OSPFexternaltype1E2-OSPFexternaltype2trust-vr(8entries)======================IDIP-PrefixInterfaceGatewayPPrefMtrVsys------------------------------------------------------------------------------9/0eth854S201Root*8/24eth754S201Root7/24eth254S201Root*2/24eth1C00Root*3/24eth2C00Root<outputomitted>查看去某個IP路由getrouteipxxxxxCPU利用率系統(tǒng)管理(task)會話管理(flow)DI,ALG(flow)getpercpuCNZUHFW01->getpercpuAverageSystemUtilization:1%Last1minute:2%,Last5minutes:2%,Last15minutes:2%CNZUHFW01->getpercpualldetailAverageSystemUtilization:1%(flow1task1)Last60seconds:59:2(11)58:2(11)57:2(11)56:2(11)55:2(11)54:2(11)53:2(11)52:2(11)51:2(11)50:2(11)49:2(11)48:2(11)47:2(11)46:2(11)45:2(11)44:2(11)內(nèi)存利用率內(nèi)存在系統(tǒng)啟動時已預(yù)分配.每個模塊會占用相對固定的內(nèi)存空間.內(nèi)存占用率不會發(fā)生太大的變化.數(shù)據(jù)轉(zhuǎn)發(fā)在ASIC芯片完成,不影響內(nèi)存利用率當(dāng)前會話數(shù)web介面顯示當(dāng)前在線會話數(shù)命令行模式下當(dāng)前會話數(shù)alloc443最大支持會話數(shù)max64064會話創(chuàng)建失敗統(tǒng)計.,allocfailed0CNZUHFW01->getsessinfalloc443/max64064,allocfailed0,mcastalloc0,diallocfailed0totalreserved0,freesessionsinsharedpool63621會話數(shù)性能每秒新建會話getpersessionCNZUHFW01->getpersessdeLast60seconds:0:41:42:283:74:55:66:357:48:59:410:2911:412:413:414:2815:516:517:518:3019:820:621:722:3023:524:525:526:2827:828:429:330:2831:432:733:434:3035:436:837:638:3039:640:541:442:3143:644:845:446:3047:548:449:550:2951:552:553:654:3155:556:457:558:2859:5日志管理事件、配置、流量日志日志分級-unsetlogmodulesystemlevelwarningdestinationsyslogSyslog/NSM外發(fā)存儲可通過MGT或業(yè)務(wù)接口外傳日志,源地址為MGTIP或manage-ipNSRPpriority－優(yōu)先級

（default100低值主用）Preempt－搶占模式

（defaultdisable，非同步配置）HA心跳線－twointerface（低接口號主用）狀態(tài)監(jiān)控－monitorinterface（非同步配置）NSRPSwitch－主備切換（主用設(shè)備上執(zhí)行）

execnsrpvsd-group0modebackupConfigSyn－主備配置同步（備用設(shè)備上執(zhí)行）

execnsrpsynglobal-configsave/reset/ignoresaveaction/confirmreset

execnsrpsynglobal-configchecksumGetconfig|innsrpGetnsrp運(yùn)維監(jiān)控Getperformancecpudetail－CPU負(fù)載Getsessioninfo－并發(fā)會話Getperformancesessiondetail－每秒新建Getmemory－內(nèi)存使用Get