Juniper防火墻HA配置詳解-主從(L2透明模式)

1、JuniperHA主雙（L2）透明模式配置實(shí)際環(huán)境中防火墻做主雙是不太可能實(shí)現(xiàn)全互聯(lián)結(jié)構(gòu),uniper防火墻標(biāo)配都是4個物理以太網(wǎng)端口，全互聯(lián)架構(gòu)需要防火墻增加額外的以太網(wǎng)接口（這樣會增加用戶成本），或者在物理接口上使用子接口（這樣配置的復(fù)雜性增加許多），最主要的是用戶的網(wǎng)絡(luò)中大多沒有像全互聯(lián)模式那樣多的設(shè)備。因此主雙多數(shù)實(shí)現(xiàn)在相對冗余的網(wǎng)絡(luò)環(huán)境中。環(huán)境中兩個Cisco4506交換配置為HSRP模式，文檔最后附上HSRP配置。F5的配置請參考我寫的關(guān)于F5鏈路負(fù)載均衡設(shè)備配置手冊。具體實(shí)際環(huán)境如下：CTCNCG0/1.21.114lh1/2Eth1/1Internet區(qū)JuniperISG10

2、00F5-LC鏈路負(fù)載均衡HAJuniperISG1000Eth1/1Ethl/4Eth1/4CTCNCG0/1.21.114lh1/2Eth1/1Internet區(qū)JuniperISG1000F5-LC鏈路負(fù)載均衡HAJuniperISG1000Eth1/1Ethl/4Eth1/4電信路由器網(wǎng)通路由器G0/1G0/1核心交換區(qū)G2/J兩臺核心交換機(jī)作主備gJG2/23G2/23.Cisco4506Cisco4506G-2/24G2/24主備防火墻A上執(zhí)行的命令sethostnameISG1000-Asetinterfacemgtip172.16.12.1/24setinterfaceethe

3、rnet1/4zoneHAsetnsrpclusterid1setnsrprto-mirrorsyncsetnsrpvsd-groupid0priority10setnsrpvsd-groupid0preemptsetnsrpvsd-groupid0monitorinterfaceethernet1/1setnsrpvsd-groupid0monitorinterfaceethernet1/2防火墻B上執(zhí)行的命令sethostnameISG1000-Bsetinterfacemgtip172.16.12.2/24setinterfaceethernet1/4zoneHAsetnsrpclust

4、erid1setnsrprto-mirrorsyncsetnsrpvsd-groupid0priority100setnsrpvsd-groupid0preemptsetnsrpvsd-groupid0monitorinterfaceethernet1/1setnsrpvsd-groupid0monitorinterfaceethernet1/2任意一個防火墻上執(zhí)行的命令即可setinterfaceethernet1/1zoneV1-Trustsetinterfaceethernet1/2zoneV1-Untrustsetpolicyid2fromV1-TrusttoV1-UntrustAny

5、AnyANYpermitsetpolicyid3fromV1-UnTrusttoV1-trustAnyAnyANYpermit最后A和B都必須執(zhí)行的命令execnsrpsyncglobalsave這個實(shí)驗(yàn)環(huán)境中使用的設(shè)備是ISG1000,該產(chǎn)品帶有專用管理接口，方便設(shè)備的管理配置。如果是其他沒有管理接口的型號防火墻請參考下面配置進(jìn)行管理。首先在主防火墻上配置setinterfacevlan1ip192.168.1.254/24管理地址為舉例setinterfacevlan1manage-ip192.168.1.1在從防火墻上配置setinterfacevlan1ip192.168.1.254/

6、24管理地址為舉例setinterfacevlan1manage-ip192.168.1.2在任意一個防火墻上配置即可setinterfacevlan1ipmanageablesetinterfacevlan1ipmanagsetzoneV1-UntrustmanagesetzoneV1-trustmanage最后在兩臺防火墻上均需要執(zhí)行的命令setinterfacevlan1nsrpmanagezoneV1-Untrustsetinterfacevlan1nsrpmanagezoneV1-trust此處附上4506的hsrp的配置方便大家測試，配置中主4506還添加了上游F5鏈路中斷后的檢測

7、配置（SLA）,有興趣的朋友自己看配置研究吧。主4506配置spanning-treevlan1-2,40priority0ipsla1icmp-echo172.16.1.2frequency5ipslaschedule1lifeforeverstart-timenowtrack1ipsla1reachabilityvtpmodetransparentvlan2-4,10interfacePort-channel2switchportswitchportmodetrunkinterfaceGigabitEthernet1/3descriptionConnecttoServer_Switch_3

8、750Gswitch1port51switchportmodetrunkinterfaceGigabitEthernet2/1descriptionConnecttoCore_FWISG1000-1proteth1/1switchportaccessvlan2interfaceGigabitEthernet2/2descriptionConnecttoBanGong-Switchport21switchportmodetrunkinterfaceGigabitEthernet2/23switchportmodetrunkchannel-group2modedesirableinterfaceG

9、igabitEthernet2/24switchportmodetrunkchannel-group2modedesirableinterfaceVlan2ipaddress172.16.1.251255.255.255.0standby2ip172.16.1.1standby2priority99standby2preemptstandby2track1decrement30interfaceVlan3ipaddress192.168.10.251255.255.255.0standby3ip192.168.10.254standby3priority99standby3preemptsta

10、ndby3track1decrement30interfaceVlan4ipaddress192.168.11.251255.255.255.0standby4ip192.168.11.254standby4priority99standby4preemptstandby4track1decrement30interfaceVlan10ipaddress10.0.4.251255.255.255.0standby10ip10.0.4.254standby10priority99standby10preemptstandby10track1decrement30iproute0.0.0.00.0

11、.0.0172.16.1.2從4506配置spanning-treevlan1-2,40priority4096vtpmodetransparentvlan2-4,10interfacePort-channel2switchportswitchportmodetrunkinterfaceGigabitEthernet1/3descriptionConnecttoServer_Switch_3750Gswitch1port52switchportmodetrunkinterfaceGigabitEthernet2/1descriptionConnecttoCore_FWISG1000-2prot

12、eth1/1switchportaccessvlan2interfaceGigabitEthernet2/2descriptionConnecttoBanGong-Switchport22switchportmodetrunkinterfaceGigabitEthernet2/23switchportmodetrunkchannel-group2modedesirableinterfaceGigabitEthernet2/24switchportmodetrunkchannel-group2modedesirableinterfaceVlan2ipaddress172.16.1.252255.255.255.0standby2ip172.16.1.1standby2priority90standby2preemptinterfaceVlan3ipaddress192.168.10.252255.255.255.0standby3ip192.168.10.254standby3priority90standby3preemptinterfaceVlan4ipaddress192.168.11.252255.