Juniper 防火墙HA配置详解_主从

1、Juniper HA主双（12）透明模式配置实际环境中防火墙做主双是不太可能实现全互联结构，juniper防火墙标配都 是4个物理以太网端口，全互联架构需要防火墙增加额外的以太网接口（这样会 增加用户成本），或者在物理接口上使用子接口（这样配置的复杂性增加许多）， 最主要的是用户的网络中大多没有像全互联模式那样多的设备。因此主双多数实 现在相对冗余的网络环境中。环境中两个Cisco4506交换配置为HSRP模式，文 档最后附上HSRP配置。F5的配置请参考我写的关于F5链路负载均衡设备配置 手册。具体实际环境如下：F5-LC链路负载均衡Juniper ISG 1000Eth1/1Juniper

2、 ISGCisco 4506防火墙A上执行的命令set hostname ISG1000-Aset interface mgt ip 172.16.12.1/24set nsrp cluster id 1 set nsrp rto-mirror syncset nsrp vsd-group id 0 priority 10set nsrp vsd-group id 0 preemptset nsrp vsd-group id 0 monitor interface ethernet1/1set nsrp vsd-group id 0 monitor interface ethernet1/2防

3、火墙B上执行的命令set hostname ISG1000-Bset interface mgt ip 172.16.12.2/24set interface ethernet1/4 zone HAset nsrp cluster id 1set nsrp rto-mirror syncset nsrp vsd-group id 0 priority 100set nsrp vsd-group id 0 preemptset nsrp vsd-group id 0 monitor interface ethernet1/1set nsrp vsd-group id 0 monitor inte

4、rface ethernet1/2任意一个防火墙上执行的命令即可set interface ethernet1/1 zone V1-Trustset interface ethernet1/2 zone V1-Untrust set policy id 2 from V1-Trust to V1-Untrust Any Any ANY permit set policy id 3 from V1-UnTrust to V1-trust Any Any ANY permit最后A和B都必须执行的命令exec nsrp sync global save这个实验环境中使用的设备是ISG1000,该产

5、品带有专用管理接口，方 便设备的管理配置。如果是其他没有管理接口的型号防火墙请参考下面配置进行 管理。首先在主防火墙上配置set interface vlanl ip 192.168.1.254/24管理地址为举例set interface vlan1 manage-ip 192.168.1.1在从防火墙上配置set interface vlan1 ip 192.168.1.254/24管理地址为举例set interface vlan1 manage-ip 192.168.1.2在任意一个防火墙上配置即可set interface vlan1 ip manageableset interfa

6、ce vlan1 ip managset zone V1-Untrust manageset zone V1-trust manage最后在两台防火墙上均需要执行的命令set interface vlanl nsrp manage zone Vl-Untrust set interface vlan1 nsrp manage zone V1-trust此处附上4506的hsrp的配置方便大家测试，配置中主4506还添加了上游F5 链路中断后的检测配置（SLA），有兴趣的朋友自己看配置研究吧。主4506配置spanning-tree vlan 1-2,40 priority 0ip sla 1i

7、cmp-echo 172.16.1.2frequency 5ip sla schedule 1 life forever start-time nowtrack 1 ip sla 1 reachabilityvtp mode transparentvlan 2-4,10interface Port-channel2switchportswitchport mode trunkinterface GigabitEthernet1/3description Connect to Server_Switch_3750G switch1 port51switchport mode trunkinter

8、face GigabitEthernet2/1description Connect to Core_FW ISG1000-1 prot eth1/1switchport access vlan 2interface GigabitEthernet2/2description Connect to BanGong-Switch port 21switchport mode trunkinterface GigabitEthernet2/23switchport mode trunkchannel-group 2 mode desirableswitchport mode trunkchanne

9、l-group 2 mode desirableinterface Vlan2ip address 172.16.1.251 255.255.255.0standby 2 ip 172.16.1.1standby 2 priority 99standby 2 preemptstandby 2 track 1 decrement 30interface Vlan3ip address 192.168.10.251 255.255.255.0standby 3 ip 192.168.10.254standby 3 priority 99standby 3 preemptstandby 3 trac

10、k 1 decrement 30interface Vlan4ip address 192.168.11.251 255.255.255.0standby 4 ip 192.168.11.254standby 4 priority 99standby 4 preemptstandby 4 track 1 decrement 30interface Vlan10ip address 10.0.4.251 255.255.255.0standby 10 ip 10.0.4.254standby 10 priority 99standby 10 preemptip route 0.0.0.0 0.0

11、.0.0 172.16.1.2从4506配置spanning-tree vlan 1-2,40 priority 4096vtp mode transparentvlan 2-4,10interface Port-channel2switchportswitchport mode trunkinterface GigabitEthernet1/3description Connect to Server_Switch_3750G switch1 port52 switchport mode trunkinterface GigabitEthernet2/1description Connect

12、 to Core_FW ISG1000-2 prot eth1/1switchport access vlan 2interface GigabitEthernet2/2description Connect to BanGong-Switch port 22switchport mode trunkinterface GigabitEthernet2/23switchport mode trunkchannel-group 2 mode desirableinterface GigabitEthernet2/24switchport mode trunkchannel-group 2 mode desirableinterface Vlan2ip address 172.16.1.252 255.255.255.0standby 2 ip 172.16.1.1standby 2 preempt interface Vlan3ip address 192.168.10.252 255.255.255.0standby 3 ip 192.168.10.254standby 3 priority 90standby 3 preemptinterface Vlan4ip address 192.168.11.252 255.255.255.0standby 4 ip