Juniper SRX HA 配置实例.doc

Juniper SRX HA 配置实例文档查看须知：3测试拓扑：3一 路由模式HA:4配置：4验证：4配置解析：5二 透明模式HA（Access接口）6配置：6验证：7配置解析：8三 透明模式HA(Trunk接口)9配置：9验证：10配置解析：10注意点12文档查看须知：测试环境：SRX 220H两台配置须知：SRX 220H默认带外管理口Ge-0/0/6控制口：Ge-0/0/7数据同步口：Ge-0/0/1 使用集群则集群后接口标示为：Ge-0/0/0-7; Ge-3/0/0-7不同型号集群后接口显示不同，详情见官方文档 拓扑对应IP:G-0/0/3：192.168.3.1/24 G-0/0/4：192.168.4.1/24 G-0/0/5：192.168.5.1/24 MGT:10.10.30.189-190/24 F0/0：192.168.4.2/24F0/1：192.168.6.1/24 （模拟遥远互联网）测试拓扑：一 路由模式HA: 配置：On device A:set chassis cluster cluster-id 1 node 0 reboot On device B:set chassis cluster cluster-id 1 node 1 rebootOn device A:set groups node0 system host-name SRX-Primaryset groups node0 interfaces fxp0 unit 0 family inet address 10.10.30.189/24 set groups node1 system host-name SRX-Secondbyset groups node1 interfaces fxp0 unit 0 family inet address 10.10.30.190/24 set apply-groups $nodeset interfaces fab0 fabric-options member-interfaces ge-0/0/1 set interfaces fab1 fabric-options member-interfaces ge-3/0/1 set chassis cluster redundancy-group 0 node 0 priority 100 set chassis cluster redundancy-group 0 node 1 priority 1 set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/4 weight 255 set chassis cluster redundancy-group 1 interface-monitor ge-3/0/5 weight 255set chassis cluster reth-count 3set interfaces ge-0/0/3 gigether-options redundant-parent reth0 set interfaces ge-3/0/3 gigether-options redundant-parent reth0 set interfaces reth0 redundant-ether-options redundancy-group 1 set interfaces reth0 unit 0 family inet address 192.168.3.1/24set interfaces ge-0/0/4 gigether-options redundant-parent reth1 set interfaces ge-3/0/4 gigether-options redundant-parent reth1 set interfaces reth1 redundant-ether-options redundancy-group 1 set interfaces reth1 unit 0 family inet address 192.168.4.1/24set interfaces ge-0/0/5 gigether-options redundant-parent reth2 set interfaces ge-3/0/5 gigether-options redundant-parent reth2 set interfaces reth2 redundant-ether-options redundancy-group 1set interfaces reth2 unit 0 family inet address 192.168.5.1/24set security zones security-zone trust interfaces reth0.0 set security zones security-zone untrust interfaces reth1.0set security zones security-zone DMZ interfaces reth2.0验证：查看双机状态rootSRX-Primary show chassis cluster statusCluster ID: 1Node Priority Status Preempt Manual failoverRedundancy group: 0 , Failover count: 1 node0 100 primary no no node1 1 secondary no noRedundancy group: 1 , Failover count: 1 node0 100 primary no no node1 1 secondary no no测试主备切换；查看当前设备主备情况；配置解析：On device A: set chassis cluster cluster-id 1 node 0 reboot /定义cluster-id和node，同一个集群cluster-id必须相同，取值范围为0-15，0代表禁用集群；node取值范围为0-1,0代表主设备On device B: set chassis cluster cluster-id 1 node 1 reboot/定义cluster-id和node，同一个集群cluster-id必须相同，取值范围为0-15，0代表禁用集群；node取值范围为0-1,0代表主设备On device A:set groups node0 system host-name SRX-Primaryset groups node0 interfaces fxp0 unit 0 family inet address 10.10.30.189/24 set groups node1 system host-name SRX-Secondby set groups node1 interfaces fxp0 unit 0 family inet address 10.10.30.190/24 /为集群设备配置单独的名字和管理IP地址 set apply-groups $node/让以上的全局配置应用到每个独立的节点上set interfaces fab0 fabric-options member-interfaces ge-0/0/1 set interfaces fab1 fabric-options member-interfaces ge-3/0/1 /定义数据面板控制口并关联端口 set chassis cluster redundancy-group 0 node 0 priority 100 set chassis cluster redundancy-group 0 node 1 priority 1 set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1/设置冗余组的对不同节点的优先级，优先级范围1-254.值越大优先级越高，一般习惯定义2个冗余组，redundancy-group 0用于控制引擎，redundancy-group 1用于控制数据引擎，当然你也可以为每组冗余端口放在一个redundancy-group组中set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/4 weight 255 set chassis cluster redundancy-group 1 interface-monitor ge-3/0/5 weight 255/配置接口监控在数据冗余口，不建议配置接口监控在redundancy-group 0，当监控到接口故障后优先级降255，实现数据口冗余自动切换set chassis cluster reth-count 3/定义集群最多支持多少组冗余接口，必须不低于当前配置的冗余口组数目，否则将有超过数量的冗余口不能正常工作，超过冗余组的冗余接口的路由信息都不生效set interfaces ge-0/0/3 gigether-options redundant-parent reth0 set interfaces ge-3/0/3 gigether-options redundant-parent reth0 set interfaces reth0 redundant-ether-options redundancy-group 1 /把物理端口加入到冗余接口reth，并把接口reth0加入数据冗余组redundancy-group 1set interfaces reth0 unit 0 family inet address 192.168.3.1/24/为冗余逻辑接口配置IP地址set interfaces ge-0/0/4 gigether-options redundant-parent reth1 set interfaces ge-3/0/4 gigether-options redundant-parent reth1 set interfaces reth1 redundant-ether-options redundancy-group 1 /把物理端口加入到冗余接口reth，并把接口reth1加入数据冗余组redundancy-group 1 set interfaces reth1 unit 0 family inet address 192.168.4.1/24/为冗余逻辑接口配置IP地址set interfaces ge-0/0/5 gigether-options redundant-parent reth2 set interfaces ge-3/0/5 gigether-options redundant-parent reth2 set interfaces reth2 redundant-ether-options redundancy-group 1/把物理端口加入到冗余接口reth，并把接口reth2加入数据冗余组redundancy-group 1set interfaces reth2 unit 0 family inet address 192.168.5.1/24/为冗余逻辑接口配置IP地址set security zones security-zone trust interfaces reth0.0 set security zones security-zone untrust interfaces reth1.0set security zones security-zone DMZ interfaces reth2.0/把集群的逻辑接口关联到ZONE二 透明模式HA（Access接口）; 配置：On device A:set chassis cluster cluster-id 1 node 0 reboot On device B:set chassis cluster cluster-id 1 node 1 rebootOn device A:set groups node0 system host-name SRX-Primaryset groups node0 interfaces fxp0 unit 0 family inet address 10.10.30.189/24set groups node1 system host-name SRX-Secondbyset groups node1 interfaces fxp0 unit 0 family inet address 10.10.30.190/24set apply-groups $nodeset chassis cluster reth-count 3set chassis cluster redundancy-group 0 node 0 priority 100set chassis cluster redundancy-group 0 node 1 priority 1set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/5 weight 255set interfaces ge-0/0/3 gigether-options redundant-parent reth0set interfaces ge-0/0/4 gigether-options redundant-parent reth1set interfaces ge-0/0/5 gigether-options redundant-parent reth2set interfaces ge-3/0/3 gigether-options redundant-parent reth0set interfaces ge-3/0/4 gigether-options redundant-parent reth1set interfaces ge-3/0/5 gigether-options redundant-parent reth2set interfaces fab0 fabric-options member-interfaces ge-0/0/1set interfaces fab1 fabric-options member-interfaces ge-3/0/1set interfaces reth0 redundant-ether-options redundancy-group 1set interfaces reth0 unit 0 family bridge interface-mode accessset interfaces reth0 unit 0 family bridge vlan-id 1set interfaces reth1 redundant-ether-options redundancy-group 1set interfaces reth1 unit 0 family bridge interface-mode accessset interfaces reth1 unit 0 family bridge vlan-id 1set interfaces reth2 redundant-ether-options redundancy-group 1set interfaces reth2 unit 0 family bridge interface-mode accessset interfaces reth2 unit 0 family bridge vlan-id 1set bridge-domains sysway domain-type bridgeset bridge-domains sysway vlan-id 1验证：查看双机状态配置解析：On device A:set chassis cluster cluster-id 1 node 0 reboot On device B:set chassis cluster cluster-id 1 node 1 reboot/定义cluster-id和node，同一个集群cluster-id必须相同，取值范围为0-15，0代表禁用集群；node取值范围为0-1,0代表主设备On device A:set groups node0 system host-name SRX-Primaryset groups node0 interfaces fxp0 unit 0 family inet address 10.10.30.189/24set groups node1 system host-name SRX-Secondbyset groups node1 interfaces fxp0 unit 0 family inet address 10.10.30.190/24set apply-groups $node/把以上的全局配置应用到每个独立的节点上set chassis cluster reth-count 3set chassis cluster redundancy-group 0 node 0 priority 100set chassis cluster redundancy-group 0 node 1 priority 1set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1/设置冗余组数量及冗余组的不同节点的优先级set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/5 weight 255/配置接口监控在数据冗余组set interfaces ge-0/0/3 gigether-options redundant-parent reth0set interfaces ge-0/0/4 gigether-options redundant-parent reth1set interfaces ge-0/0/5 gigether-options redundant-parent reth2set interfaces ge-3/0/3 gigether-options redundant-parent reth0set interfaces ge-3/0/4 gigether-options redundant-parent reth1set interfaces ge-3/0/5 gigether-options redundant-parent reth2/把物理接口关联到冗余组set interfaces fab0 fabric-options member-interfaces ge-0/0/1set interfaces fab1 fabric-options member-interfaces ge-3/0/1/定义数据面板控制口并关联端口set interfaces reth0 redundant-ether-options redundancy-group 1/定义接口reth0口关联到redundancy-group 1set interfaces reth0 unit 0 family bridge interface-mode access/设置逻辑接口为网桥模式并且接口类型为accessset interfaces reth0 unit 0 family bridge vlan-id 1/设置逻辑接口为网桥模式并允许vlan 1的数据包通过（建议VLAN ID值与直连交换机的接口属于同一个VLAN）set interfaces reth1 redundant-ether-options redundancy-group 1set interfaces reth1 unit 0 family bridge interface-mode accessset interfaces reth1 unit 0 family bridge vlan-id 1set interfaces reth2 redundant-ether-options redundancy-group 1set interfaces reth2 unit 0 family bridge interface-mode accessset interfaces reth2 unit 0 family bridge vlan-id 1/设置reth1，reth2的相关属性set bridge-domains sysway domain-type bridge/定义网桥域类型及网桥域名称set bridge-domains sysway vlan-id 1/定义网桥域的VLAN ID 建议和reth接口定义的一样三 透明模式HA(Trunk接口)配置：On device A:set chassis cluster cluster-id 1 node 0 reboot On device B:set chassis cluster cluster-id 1 node 1 rebootOn device A:set groups node0 system host-name SRX-Primaryset groups node0 interfaces fxp0 unit 0 family inet address 10.10.30.189/24set groups node1 system host-name SRX-Secondbyset groups node1 interfaces fxp0 unit 0 family inet address 10.10.30.190/24set apply-groups $nodeset chassis cluster reth-count 3set chassis cluster redundancy-group 0 node 0 priority 100set chassis cluster redundancy-group 0 node 1 priority 1set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/3 weight 255set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/4 weight 255set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/5 weight 255set interfaces ge-0/0/3 gigether-options redundant-parent reth0set interfaces ge-0/0/4 gigether-options redundant-parent reth1set interfaces ge-0/0/5 gigether-options redundant-parent reth2set interfaces ge-3/0/3 gigether-options redundant-parent reth0set interfaces ge-3/0/4 gigether-options redundant-parent reth1set interfaces ge-3/0/5 gigether-options redundant-parent reth2set interfaces fab0 fabric-options member-interfaces ge-0/0/1set interfaces fab1 fabric-options member-interfaces ge-3/0/1set interfaces reth0 redundant-ether-options redundancy-group 1set interfaces reth0 vlan-taggingset interfaces reth0 native-vlan-id 1set interfaces reth0 unit 0 family bridge interface-mode trunkset interfaces reth0 unit 0 family bridge vlan-id-list 1-1000set interfaces reth1 redundant-ether-options redundancy-group 1set interfaces reth1 vlan-taggingset interfaces reth1 native-vlan-id 1set interfaces reth1 unit 0 family bridge interface-mode trunkset interfaces reth1 unit 0 family bridge vlan-id-list 1-1000set interfaces reth2 redundant-ether-options redundancy-group 1set interfaces reth2 vlan-taggingset interfaces reth2 native-vlan-id 1set interfaces reth2 unit 0 family bridge interface-mode trunkset interfaces reth2 unit 0 family bridge vlan-id-list 1-1000set bridge-domains sysway vlan-id-list 1-1000验证：手动主备切换：当前双机状态配置解析：On device A:set chassis cluster cluster-id 1 node 0 reboot On device B:set chassis cluster cluster-id 1 node 1 reboot/定义cluster-id和node，同一个集群cluster-id必须相同，取值范围为0-15，0代表禁用集群；node取值范围为0-1,0代表主设备On device A:set groups node0 system host-name SRX-Primaryset groups node0 interfaces fxp0 unit 0 family inet address 10.10.30.189/24set groups node1 system host-name SRX-Secondbyset groups node1 interfaces fxp0 unit 0 family inet address 10.10.30.190/24set apply-groups $node/把以上的全局配置应用到每个独立的节点上set chassis cluster reth-count 3set chassis cluster redundancy-group 0 node 0 priority 100set chassis cluster redundancy-group 0 node 1 priority 1/设置冗余组数量及控制冗余组的不同节点的优先级set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/3 weight 255set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/4 weight 255set chassis cluster redundancy-group 1 node 0 priority 100set chassis cluster redundancy-group 1 node 1 priority 1set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255set chassis cluster redundancy-group 1 interface-monitor ge-3/0/5 weight 255/配置接口监控在数据冗余组set interfaces ge-0/0/3 gigether-options redundant-parent reth0set interfaces ge-0/0/4 gigether-options redundant-parent reth1set interfaces ge-0/0/5 gigether-options redundant-parent reth2set interfaces ge-3/0/3 gigether-options redundant-parent reth0set interfaces ge-3/0/4 gigether-options redundant-parent reth1set interfaces ge-3/0/5 gigether-options redundant-parent reth2/把物理接口关联到数据冗余组set interfaces fab0 fabric-options member-interfaces ge-0/0/1set interfaces fab1 fabric-options member-interfaces ge-3/0/1/定义数据面板控制口并关联端口set interfaces reth0 redundant-ether-options redundancy-group 1/定义接口reth0口关联到redun