JUNOS配置实例.pptx

JUNOS配置实例 u v v v v v v v u 2 63 新开局路由器需要配置什么 路由器基本信息配置 v 主机名root密码以及管理用户telnet和ftp服务路由器时区 日期和时间路由器ntp服务器 可选配置 路由器dns服务器 可选配置 u 端口配置 vvv 配置工作模式配置端口描述设置vlan 可选配置 配置IP地址 u 路由配置 v 配置静态路由配置动态路由 可选配置 uuu SNMP配置NAT配置VRRP配置GRETunnel配置JuniperNetworks Inc Copyright 2000 Proprietary Confidential RT01 3 63 实例1基本配置 211 17 3 0 24DNS211 17 3 1NTP211 17 3 2要求 1 内部局域网两个VLAN211 16 1 1 302 内部PC访问10 126 1 0通过RT023 内部PC访问211 17 3 0通过RT01 10 126 1 0 24NMS10 126 1 1RT0210 126 10 1 30 4 GE端口采用非协商模式5 FE端口设置100M全双工6 采用静态路由7 地址映射192 168 10 2 211 17 4 1192 168 20 2 211 17 4 2 211 16 1 2 30 ge 0 0 0fe 1 0 0 ge 0 0 110 126 10 2 30CE01 M10ivlan10网关 192 168 10 1 24vlan20网关 192 168 20 1 24 8 CE01 M10i和RT02静态路由运行BFD9 CE01 M10i是全新的juniper路由器二层交换机 vlan10 vlan20 192 168 10 2 192 168 10 3 192 168 20 2 192 168 20 3 JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u u 4 63 system基本配置设置主机名setsystemhost nameCE01 M10i u 设置root口令setsystemroot authenticationplain text password设置用户名setsystemloginuserzteuid2000setsystemloginuserzteclasssuper usersetsystemloginuserzteauthenticationplain text password设置telnet和ftp服务setsystemservicesftpsetsystemservicestelnetJuniperNetworks Inc Copyright 2000 Proprietary Confidential u u 5 63 system基本配置设置时区setsystemtime zoneAsia Shanghai设置路由器时间setdate200708091720 00说明 YYYYMMDDhhmm ss格式在用户模式下配置 uu 设置ntp服务setdatentp211 17 3 2setdatentpsource address211 16 1 2说明 在用户模式下配置设置dns服务setsystemname server211 17 3 1JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u 6 63 system基本配置设置时区setsystemtime zoneAsia Shanghai设置路由器时间setdate200708091720 00说明 YYYYMMDDhhmm ss格式在用户模式下配置 uu 设置ntp服务setdatentp211 17 3 2setdatentpsource address211 16 1 2说明 在用户模式下配置设置dns服务setsystemname server211 17 3 1JuniperNetworks Inc Copyright 2000 Proprietary Confidential 7 63 system基本配置 root CE01 M10i showsystemhost nameCE01 M10i time zoneAsia Shanghai root authentication encrypted password 1 tXnoO0Vm XVCIVOtrqW exGNN96nPT0 SECRET DATA name server 211 17 3 1 login userzte uid2000 classsuper user authentication encrypted password 1 Stwwx mF OuP039OdflLuz 5FAxXIG SECRET DATA services ftp telnet JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u 8 63 fe 1 0 0端口配置初始化配置中配置文件是空的 不象cisco一样在running config配置中会显示硬件配置的端口 如果要查看端口号 在用户模式下使用 vshowinterfacesterse设置工作模式setinterfacesfe 1 0 0speed100msetinterfacesfe 1 0 0link modefull duplex u 设置vlansetinterfacesfe 1 0 0vlan taggingsetinterfacesfe 1 0 0hold timeup30000down0 setinterfacesfe 1 0 0unit10vlan id10setinterfacesfe 1 0 0unit10description TOVLAN10 setinterfacesfe 1 0 0unit10familyinetaddress192 168 10 1 24setinterfacesfe 1 0 0unit20vlan id20setinterfacesfe 1 0 0unit20description TOVLAN20 setinterfacesfe 1 0 0unit20familyinetaddress192 168 20 1 24JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u u u 9 63 fe 1 0 0端口配置vlan tagging封装的是802 1Q 在交换机端需要开启802 1Qtrunkunit的范围是0 16385 unit号与vlanid没有关系familyinet表示配置的是IPV4地址ip地址不是覆盖形式 如输入setinterfacesfe 1 0 0unit10family inetaddress192 168 10 1 24和setinterfacesfe 1 0 0familyinetaddress192 168 10 2 24则会显示两个IP地址fe 1 0 0 vlan tagging speed100m link modefull duplex unit2 vlan id10 familyinet address192 168 10 1 24 address192 168 10 2 24 JuniperNetworks Inc Copyright 2000 Proprietary Confidential unit10 fe 1 0 0端口配置fe 1 0 0 vlan tagging speed100m hold timeup30000down0 link modefull duplex unit10 description TOVLAN10 vlan id10 familyinet address192 168 10 1 24 unit20 description TOVLAN20 vlan id20 familyinet address192 168 20 1 24 JuniperNetworks Inc Copyright 2000 Proprietary Confidential 10 63 11 63 fe 1 0 0端口配置 ab CE01 M10i showinterfacesfe 1 0 0 displaysetsetinterfacesfe 1 0 0vlan taggingsetinterfacesfe 1 0 0speed100m setinterfacesfe 1 0 0hold timeup30000setinterfacesfe 1 0 0hold timedown0setinterfacesfe 1 0 0link modefull duplex setinterfacesfe 1 0 0unit10description TOVLAN10 setinterfacesfe 1 0 0unit10vlan id10 setinterfacesfe 1 0 0unit10familyinetaddress192 168 10 1 24setinterfacesfe 1 0 0unit20description TOVLAN20 setinterfacesfe 1 0 0unit20vlan id20 setinterfacesfe 1 0 0unit20familyinetaddress192 168 20 1 24 edit lab CE01 M10i JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u 12 63 ge端口配置设置工作模式setinterfacesge 0 0 0link modefull duplexsetinterfacesge 0 0 0gigether optionsno auto negotiationsetinterfacesge 0 0 1link modefull duplexsetinterfacesge 0 0 1gigether optionsno auto negotiation u 设置IPsetinterfacesge 0 0 0unit0description TORT01 setinterfacesge 0 0 0unit0familyinetaddress211 16 1 2 30setinterfacesge 0 0 1unit0description TORT02 setinterfacesge 0 0 1unit0familyinetaddress10 126 10 2 30不象cisco juniper的端口IP即使不划分vlan 也必须要有一个unit单元 通常不划分vlan的端口使用unit0JuniperNetworks Inc Copyright 2000 Proprietary Confidential 13 63 ge端口配置 ge 0 0 0 link modefull duplex gigether options no auto negotiation unit0 descriptionTORT01 familyinet address211 16 1 2 30 ge 0 0 1 link modefull duplex gigether options no auto negotiation unit0 descriptionTORT02 familyinet address10 126 10 2 30 JuniperNetworks Inc Copyright 2000 Proprietary Confidential up up up up u u 14 63 端口检查zte CE01 M10i showinterfacesterse Interfacefe 1 0 0fe 1 0 0 10fe 1 3 0 20ge 0 0 0ge 0 0 0 0ge 0 0 1ge 0 0 1 0 AdminLinkProtoupupupinetupinetupupupinetupupupinet Local192 168 10 1 24192 168 20 1 24211 16 1 2 3010 126 10 2 30 Remote 只有在用户模式下showinterfacesterse看到所配置的IP地址才正常 如果看不到配置的IP地址 需要删除然后重新配置端口Admin和Link状态都是up才正常 否则请检查物理链路JuniperNetworks Inc Copyright 2000 Proprietary Confidential 端口检查zte CE01 M10i ping10 126 10 1PING10 126 10 1 10 126 10 1 56databytes64bytesfrom10 126 10 1 icmp seq 0ttl 64time 0 103ms64bytesfrom10 126 10 1 icmp seq 1ttl 64time 0 098ms64bytesfrom10 126 10 1 icmp seq 2ttl 64time 0 100ms64bytesfrom10 126 10 1 icmp seq 3ttl 64time 0 094ms64bytesfrom10 126 10 1 icmp seq 4ttl 64time 0 099ms C 10 126 10 1pingstatistics 5packetstransmitted 5packetsreceived 0 packetlossround tripmin avg max stddev 0 094 0 099 0 103 0 003mszte CE01 M10i ping10 126 10 1rapidPING10 126 10 1 10 126 10 1 56databytes 10 126 10 1pingstatistics 5packetstransmitted 5packetsreceived 0 packetlossround tripmin avg max stddev 0 044 0 058 0 095 0 019mszte CE01 M10i zte CE01 M10i ping10 126 10 1rapidcount1000size1500source10 126 10 2PING10 126 10 1 10 126 10 1 1500databytes C 10 126 10 1pingstatistics 261packetstransmitted 260packetsreceived 0 packetlossround tripmin avg max stddev 2 701 10 956 40 103 5 046ms zte CE01 M10i JuniperNetworks Inc Copyright 2000 Proprietary Confidential 15 63 0 0 0 0 16 63 Junipererrors 端口检查zte CE01 M10i showinterfacesfe 1 0 0extensivePhysicalinterface fe 1 0 0 Enabled PhysicallinkisUpInterfaceindex 138 SNMPifIndex 33 Generation 163Link leveltype Ethernet MTU 1514 Speed 100mbps Loopback Disabled Sourcefiltering Disabled Flowcontrol EnabledDeviceflags PresentRunningInterfaceflags SNMP TrapsInternal 0 x4000CoSqueues 8supported 8maximumusablequeuesHold times Up30000ms Down0msCurrentaddress 00 05 85 c1 a8 c1 Hardwareaddress 00 05 85 c1 a8 c1Lastflapped 2007 07 1916 52 29UTC 00 08 01ago Statisticslastcleared NeverTrafficstatistics Inputbytes Outputbytes Inputpackets Outputpackets 17506911633124512294 0bps0bps0pps0pps IPv6transitstatistics Inputbytes Outputbytes Inputpackets Outputpackets Inputerrors Errors 0 Drops 0 Framingerrors 0 Runts 0 Policeddiscards 0 L3incompletes 0 L2channelerrors 115 L2mismatchtimeouts 0 FIFOerrors 0 Resourceerrors 190Outputerrors Carriertransitions 9 Errors 0 Drops 0 Collisions 0 Agedpackets 0 FIFOerrors 0 HSlinkCRCerrors 0 MTUerrors 0 ResourceNetworks 0Inc Copyright 2000 Proprietary Confidential u 17 63 静态路由配置 u 设置静态路由setrouting optionsstaticroute211 17 3 0 24next hop211 16 1 1setrouting optionsstaticroute10 126 1 0 24next hop10 126 1 1设置缺省路由 默认路由 setrouting optionsstaticroute0 0next hop211 16 1 1routing options static route211 17 3 0 24next hop211 16 1 1 route10 126 1 0 24next hop10 126 1 1 route0 0 0 0 0next hop211 16 1 1 JuniperNetworks Inc Copyright 2000 Proprietary Confidential u 18 63 路由检查 带源地址ping211 17 3 1source211 16 1 2 u带源地址traceroute211 17 3 1source211 16 1 2ushowroute 问题 在路由器上能ping通211 17 3 1 但是内部PC不能ping通 在路由器上带源地址211 16 1 2能ping通211 17 3 1 但是带原地址为192 168 10 1 则ping不通 什么问题 JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u u u 19 63 静态路由bfd配置bfd BidirectionalForwardingDetection 双向转发检测 定期发送自己的hello包给对方 一旦收不到对方发送过来的hello包次数超过设定的阀值 则认为对方不可达 马上消除静态路由作用 加快故障检测 免得产生下一跳已经不可达但是由于路由表还存在而路由器会继续发包的情况动态路由也可以配置bfd 路由器1路由表 我ok route0 0 0 0 0next hop211 16 1 1route10 126 1 0 24next hop10 126 1 1路由器1路由表route0 0 0 0 0next hop211 16 1 1 路由器1 10 126 10 2 30我ok我ok10 126 10 2 30 10 126 10 1 3010 126 10 1 30 路由器2 路由器1JuniperNetworks Inc Copyright 2000 Proprietary Confidential 我ok 路由器2 20 63 静态路由bfd配置 u 设置静态路由setrouting optionsstaticroute10 126 1 0 24next hop10 126 1 1bfd liveness detectionversion1setrouting optionsstaticroute10 126 1 0 24next hop10 126 1 1bfd liveness detectionminimum interval200setrouting optionsstaticroute10 126 1 0 24next hop10 126 1 1bfd liveness detectionmultiplier2routing options static route10 126 1 0 24 next hop10 126 1 1 bfd liveness detection version1 minimum interval200 multiplier2 JuniperNetworks Inc Copyright 2000 Proprietary Confidential 2 2 21 63 bfd检查 u 设置静态路由setrouting optionsstaticroute10 126 1 0 24next hop10 126 1 1bfd liveness detectionversion1setrouting optionsstaticroute10 126 1 0 24next hop10 126 1 1bfd liveness detectionminimum interval200setrouting optionsstaticroute10 126 1 0 24next hop10 126 1 1bfd liveness detectionmultiplier2lab zte m7i showbfdsessionTransmit Address State Interface DetectTimeIntervalMultiplier 220 0 21 10221 0 21 10 UpUp fe 0 0 0 0fe 0 0 1 0 0 4000 400 0 2000 200 2sessions 2clientsCumulativetransmitrate10 0pps cumulativereceiverate10 0ppslab zte m7i JuniperNetworks Inc Copyright 2000 Proprietary Confidential SNMP配置 u 设置snmp setsnmpsetsnmpsetsnmpsetsnmpsetsnmpsetsnmpsetsnmp communitypublicauthorizationread onlycommunitypublicclients10 126 1 1 32communityprivateauthorizationread writecommunityprivateclients10 126 1 1 32trap optionssource address10 126 1 2contactengine idlocal snmp communitypublic authorizationread only clients 10 126 1 1 32 communityprivate authorizationread write clients 10 126 1 1 32 trap options source address10 126 1 2 JuniperNetworks Inc Copyright 2000 Proprietary Confidential 22 63 u u 23 63 JuniperNetworks Inc Copyright2000Proprietary NAT配置定义output方向的nat规则 setsetsetsetsetsetset servicesservicesservicesservicesservicesservicesservices natnatnatnatnatnatnat rulerulerulerulerulerulerule nat outputnat outputnat outputnat outputnat outputnat outputnat output match directionoutputtermafromsource address192 168 10 1 32termathentranslatedsource prefix211 17 4 1 32termathentranslatedtranslation typesourcestatictermbfromsource address192 168 20 1 32termbthentranslatedsource prefix211 17 4 2 32termbthentranslatedtranslation typesourcestatic 定义input方向的nat规则 setsetsetsetsetsetset servicesservicesservicesservicesservicesservicesservices natnatnatnatnatnatnat rulerulerulerulerulerulerule nat inputnat inputnat inputnat inputnat inputnat inputnat input match directioninputtermafromdestination address211 17 4 1 32termathentranslateddestination prefix192 168 10 1 32termathentranslatedtranslation typedestinationstatictermbfromdestination address211 17 4 2 32termbthentranslateddestination prefix192 168 20 1 32termbthentranslatedtranslation typedestinationstatic setservicesservice setnat service setnat rulesnat outputsetservicesservice setnat service setnat rulesnat inputsetservicesservice setnat service set interface serviceConfidentialservice interfacesp 0 0 0 u u 24 63 NAT配置 定义service集合 setservicesservice setnat service setnat rulesnat outputsetservicesservice setnat service setnat rulesnat input setservicesservice setnat service setinterface serviceservice interfacesp 0 0 0 将service集合应用到端口 setinterfacesge 0 0 0unit0familyinetserviceinputservice setnat service setsetinterfacesge 0 0 0unit0familyinetserviceoutputservice setnat service set JuniperNetworks Inc Copyright 2000 Proprietary Confidential 25 63 NAT配置 ge 0 0 0 unit0 familyinet service input service setnat service set output service setnat service set then translated source prefix211 17 4 1 32 translation type sourcestatic termb from source address 192 168 20 1 32 services nat rulenat output match directionoutput terma from source address 192 168 10 1 32 then translated source prefix211 17 4 2 32 translation type sourcestatic JuniperNetworks Inc Copyright 2000 Proprietary Confidential 26 63 NAT配置rulenat input match directioninput terma from destination address 211 17 4 1 32 then translated destination prefix192 168 10 1 32 translation type destinationstatic termb from then translated destination prefix192 168 20 1 32 translation type destinationstatic service setnat service set nat rulesnat output nat rulesnat input interface service service interfacesp 0 0 0 destination address 211 17 4 2 32 JuniperNetworks Inc Copyright 2000 Proprietary Confidential OSPF配置 28 63 实例2OSPF配置 211 17 3 0 24DNS211 17 3 1NTP211 17 3 2211 16 1 1 30 RT01 OSPFarea0 10 126 1 0 24NMS10 126 1 1RT0210 126 10 1 30 211 16 1 2 30要求 1 内部局域网两个VLAN2 三台路由器之间运行OSPF动态路由协议fe 1 0 03 交换机和CE01 M10i之间用三根线做端口聚合fe 1 0 1 ge 0 0 0 ge 0 0 110 126 10 2 30CE01 M10ivlan10网关 192 168 10 1 24vlan20网关 192 168 20 1 24fe 1 0 2 二层交换机 vlan10 vlan20 192 168 10 2 192 168 10 3 192 168 20 2 192 168 20 3 JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u 29 63 端口聚合配置 u 设置聚合端口setchassisaggregated devicesethernetdevice count2将产生两个聚合端口ae0和ae1 device count最多可以支持128个聚合端口设置物理端口属于哪个聚合端口setinterfacesfe 1 0 0fastether options802 3adae0setinterfacesfe 1 0 1fastether options802 3adae0setinterfacesfe 1 0 2fastether options802 3adae0设置聚合端口IP地址 setsetsetsetsetsetsetsetsetset interfacesinterfacesinterfacesinterfacesinterfacesinterfacesinterfacesinterfacesinterfacesinterfaces ae0ae0ae0ae0ae0ae0ae0ae0ae0ae0 vlan tagginghold timeup30000hold timedown0link modefull duplexunit10description TOVLAN10 unit10vlan id10unit10familyinetaddress192 168 10 1 24unit20description TOVLAN20 unit20vlan id20unit20familyinetaddress192 168 20 1 24 产生的聚合端口操作跟物理端口fe 1 0 0一样 例如划分vlan 配置IP地址JuniperNetworks Inc Copyright 2000 Proprietary Confidential 30 63 端口聚合配置 fe chassis aggregated devices ethernet device count2 fe 1 0 2 descriptionTo Lanswitchport1 0 speed100m link modefull duplex fastether options 802 3adae0 interfaces ge 1 0 0 descriptionTo Lanswitchport1 0 speed100m link modefull duplex fastether options 802 3adae0 fe 1 0 1 descriptionTo Lanswitchport1 0 speed100m link modefull duplex fastether options 802 3adae0 ae0 vlan tagging hold timeup30000down0 link modefull duplex unit10 description TOVLAN10 vlan id10 familyinet address192 168 10 1 24 unit20 description TOVLAN20 vlan id20 familyinet address192 168 20 1 24 JuniperNetworks Inc Copyright 2000 Proprietary Confidential 31 63 端口聚合配置 ge chassis aggregated devices ethernet device count2 ge 1 0 2 descriptionTo Lanswitchport1 0 link modefull duplex gigether options no auto negotiation 802 3adae0 interfaces ge 1 0 0 descriptionTo Lanswitchport1 0 link modefull duplex gigether options no auto negotiation 802 3adae0 ge 1 0 1 descriptionTo Lanswitchport1 0 link modefull duplex gigether options no auto negotiation 802 3adae0 ae0 vlan tagging hold timeup30000down0 link modefull duplex unit10 description TOVLAN10 vlan id10 familyinet address192 168 10 1 24 unit20 description TOVLAN20 vlan id20 familyinet address192 168 20 1 24 JuniperNetworks Inc Copyright 2000 Proprietary Confidential u set set set set set set set set 32 63 OSPF配置 u 设置router idsetrouting optionsrouter id192 16 1 1routerID相当于路由器ID 用于在动态路由中标识路由器身份 如果不配置routerid 则路由器会选用loopback0IP地址来做为路由器ID配置protocols协议protocolsospfarea0 0 0 0interfacege 0 0 0 0interface typep2pprotocolsospfarea0 0 0 0interfacege 0 0 0 0hello interval1protocolsospfarea0 0 0 0interfacege 0 0 0 0dead interval4interfacege 0 0 0 0authenticationmd51key 24059 CM138 protocolsospfarea0 0 0 0interfacege 0 0 1 0interface typep2pprotocolsospfarea0 0 0 0interfacege 0 0 1 0hello interval1protocolsospfarea0 0 0 0interfacege 0 0 1 0dead interval4interfacege 0 0 1 0authenticationmd51key 24059 CM138 JuniperNetworks Inc Copyright 2000 Proprietary Confidential u 33 63 OSPF配置passive局域网端口setinterfaceae0 0passive u 配置ospf参数setprotocolsospfreference bandwidth10g 设置ospf带宽值setprotocolsospfspf delay50 设置ospf收敛计算时间JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u u u u u 34 63 OSPF配置 发布静态路由 定义策略 setpolicy optionspolicy statementstatic routefromprotocolstaticsetpolicy optionspolicy statementstatic routethenaccept 发布静态路由 应用策略 setprotocolsospfexportstatic route 发布直连路由 定义策略 setpolicy optionspolicy statementdirect routefromprotocoldirectsetpolicy optionspolicy statementdirect routethenaccept 发布直连路由 应用策略 setprotocolsospfexportdirect route 发布直连路由 定义策略 setpolicy optionspolicy statementaggregate routefromprotocolaggregatesetpolicy optionspolicy statementaggregate routethenexternaltype1setpolicy optionspolicy statementaggregate routethenaccept发布直连路由 应用策略 setprotocolsospfexportdirect route JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u u 35 63 OSPF配置 发布聚合路由 定义聚合路由 setrouting optionsaggregateroute192 168 10 0 24 setrouting optionsaggregateroute192 168 20 0 24 发布聚合路由 定义策略 setpolicy optionspolicy statementaggregate routefromprotocolaggregatesetpolicy optionspolicy statementaggregate routethenexternaltype1setpolicy optionspolicy statementaggregate routethenaccept 发布聚合路由 应用策略 setprotocolsospfexportaggregate route JuniperNetworks Inc Copyright 2000 Proprietary Confidential u u u 36 63 OSPF配置 发布聚合路由 定义聚合路由 setrouting optionsaggregateroute192 168 10 0 24 setrouting optionsaggregateroute192 168 20 0 24 发布聚合路由 定义策略 setpolicy optionspolicy statementaggregate routefromprotocolaggregatesetpolicy optionspolicy statementaggregate routethenexternaltype1setpolicy optionspolicy statementaggregate routethenaccept 发布聚合路由 应用策略 setprotocolsospfexportaggregate route JuniperNetworks Inc Copyright 2000 Proprietary Confidential set set 37 63 OSPF配置 u 配置ospf的log setsetset protocolsospftraceoptionsprotocolsospf