Juniper vSRX防火墻 HA配置

Juniper vSRX防火墻HA配置

實(shí)驗(yàn)網(wǎng)絡(luò)拓?fù)浣Y(jié)構(gòu)

實(shí)驗(yàn)?zāi)繕?biāo)

• 完成SRX防火墻的Failover的配置
• 測(cè)試設(shè)備的連通性

實(shí)驗(yàn)配置步驟：

1. 使用網(wǎng)線或者使用Esxi或者VM的網(wǎng)絡(luò)將兩臺(tái)vSRX防火墻的ge-0/0/1和ge-0/0/2口互聯(lián)起來(lái)，ge-0/0/1接口作為Control Link，ge-0/0/2接口作為Fabric Link
2. 將防火墻還原到只設(shè)置了root密碼的狀態(tài)，兩臺(tái)設(shè)備的root密碼保持一致
3. 使用set chassis cluster cluster-id 2 node 0 reboot命令將第一臺(tái)防火墻配置為集群2的第一臺(tái)設(shè)備并重啟設(shè)備
4. 使用set chassis cluster cluster-id 2 node 1 reboot命令將第二臺(tái)防火墻配置為集群2的第二臺(tái)設(shè)備并重啟設(shè)備
5. 設(shè)備重啟完成后，需要在node0設(shè)備上進(jìn)行以下配置來(lái)解決管理接口的地址沖突

   set groups node0 system host-name Mylab-FW1

   set groups node0 interfaces fxp0 unit 0 family inet address 100.100.100.1/24

   set groups node1 system host-name Mylab-FW2

   set groups node1 interfaces fxp0 unit 0 family inet address 100.100.100.2/24

   set apply-groups ${node}

   commit and quit

   #這個(gè)時(shí)候防火墻的名稱分別變?yōu)镸ylab-FW1和Mylab-FW2

6. 下面我們進(jìn)行Redundancy Group的配置

   #使用cluster reth-count明確聲明需要配置幾個(gè)RG組

   set chassis cluster reth-count 2

   set chassis cluster redundancy-group 0 node 0 priority 100

   set chassis cluster redundancy-group 0 node 1 priority 99

   set chassis cluster redundancy-group 1 node 0 priority 100

   set chassis cluster redundancy-group 1 node 1 priority 99

   #配置Fabric Link

   set interfaces fab0 fabric-options member-interfaces ge-0/0/2

   set interfaces fab1 fabric-options member-interfaces ge-7/0/2

   #注意vSRX在完成Cluster之后，備用主機(jī)的接口為主用設(shè)備接口+7

7. 配置Redundant Interface

   #配置冗余接口

   set interfaces ge-0/0/3 gigether-options redundant-parent reth0

   set interfaces ge-0/0/4 gigether-options redundant-parent reth2

   set interfaces ge-7/0/3 gigether-options redundant-parent reth0

   set interfaces ge-7/0/4 gigether-options redundant-parent reth2

   set interfaces reth0 redundant-ether-options redundancy-group 1

   set interfaces reth0 unit 0 family inet address 10.1.1.10/24

   set interfaces reth2 redundant-ether-options redundancy-group 1

   set interfaces reth2 unit 0 family inet address 202.100.1.10/24

8. 檢查HA的狀態(tài)

1. 如果需要恢復(fù)到遠(yuǎn)程的獨(dú)立使用狀態(tài)

   #首先關(guān)閉集群后重啟

   set chassis cluster disable reboot

   #使用load factory-default恢復(fù)至出廠設(shè)置

   load factory-default

   set system root-authentication plain-text-password

   commit