Juniper 防火墙HA配置详解_双主(L3 路由器模式).doc

Juniper HA 双主（L3）模式配置实际环境中防火墙做双主是不太可能实现全互联结构，juniper防火墙标配都是4个物理以太网端口，全互联架构需要防火墙增加额外的以太网接口（这样会增加用户成本），或者在物理接口上使用子接口（这样配置的复杂性增加许多），最主要的是用户的网络中大多没有像全互联模式那样多的设备。因此双主多数实现在相对冗余的网络环境中。具体实际环境如下：防火墙A上执行的命令set hostname ISG1000-Aset interface mgt ip 172.16.12.1/24set interface ethernet1/4 zone HAset interface loopback.1 zone Trustset interface loopback.1 ip 172.255.255.251/32set interface loopback.1 routeset router-id 172.255.255.251 必须web页面设置set nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror session ageout-ackunset nsrp vsd-group id 0set nsrp vsd-group id 1 priority 1set nsrp vsd-group id 1 preemptset nsrp vsd-group id 1 preempt hold-down 10set nsrp vsd-group id 2 priority 255set nsrp vsd-group id 2 preempt hold-down 10set source-routing enable 可选设置，命令无法执行时，在web页面设置set sibr-routing enable 可选设置，命令无法执行时，在web页面设置set adv-inact-interface 可选设置，命令无法执行时，在web页面设置防火墙B上执行的命令set hostname ISG1000-Bset interface mgt ip 172.16.12.2/24set interface ethernet1/4 zone HAset interface loopback.1 zone Trustset interface loopback.1 ip 172.255.255.252/32set interface loopback.1 routeset router-id 172.255.255.252 命令无法执行时，在web页面设置set nsrp cluster id 1set nsrp rto-mirror syncset nsrp rto-mirror session ageout-ackset nsrp rto-mirror session non-vsiunset nsrp vsd-group id 0set nsrp vsd-group id 1 priority 255set nsrp vsd-group id 1 preempt hold-down 10set nsrp vsd-group id 2 priority 1set nsrp vsd-group id 2 preemptset nsrp vsd-group id 2 preempt hold-down 10set nsrp secondary-path ethernet1/2set nsrp vsd-group id 1 monitor zone Trustset nsrp vsd-group id 2 monitor zone Trustset nsrp ha-link probeset source-routing enable 可选设置，命令无法执行时，在web页面设置set sibr-routing enable 可选设置，命令无法执行时，在web页面设置set adv-inact-interface 可选设置，命令无法执行时，在web页面设置任意一个防火墙上执行的命令即可set interface id 64 redundant1 zone Untrustset interface ethernet1/3 zone Trustset interface ethernet1/2 group redundant1set interface ethernet1/1 group redundant1set interface ethernet1/3:1 ip 172.17.2.1/24set interface ethernet1/3:1 routeset interface ethernet1/3:2 ip 172.17.2.2/24set interface ethernet1/3:2 routeset interface redundant1:1 ip 172.17.1.251/28set interface redundant1:1 routeset interface redundant1:2 ip 172.17.1.252/28set interface redundant1:2 routeset interface ethernet1/3:1 ip manageableset interface ethernet1/3:2 ip manageableset interface loopback.1 ip manageableset interface redundant1:1 ip manageableset interface redundant1:2 ip manageableset policy id 1 name trunt-to-untrust from Trust to Untrust Any Any ANY permit set policy id 2 name untrust-to-trust from Untrust to Trust Any Any ANY permit set protocol ospf 命令无法执行时，在web页面设置set enable 命令无法执行时，在web页面设置set area 0.0.0.0 range 172.17.1.240 255.255.255.240 advertiseset area 0.0.0.0 range 172.17.2.0 255.255.255.0 advertiseset interface ethernet1/3:1 protocol ospf area 0.0.0.0set interface ethernet1/3:1 protocol ospf enableset interface ethernet1/3:1 protocol ospf priority 0set interface ethernet1/3:1 protocol ospf cost 1set interface ethernet1/3:2 protocol ospf area 0.0.0.0set interface ethernet1/3:2 protocol ospf enableset interface ethernet1/3:2 protocol ospf priority 0set interface ethernet1/3:2 protocol ospf cost 1set interface redundant1:1 protocol ospf area 0.0.0.0set interface redundant1:1 protocol ospf enableset interface redundant1:1 protocol ospf priority 0set interface redundant1:1 protocol ospf cost 1set interface redundant1:1 manage pingset interface redundant1:1 manage sshset interface redundant1:1 manage telnetset interface redundant1:1 manage webset interface redundant1:2 protocol ospf area 0.0.0.0set interface redundant1:2 protocol ospf enableset interface redundant1:2 protocol ospf priority 0set interface redundant1:2 protocol ospf cost 1set interface redundant1:2 manage pingset interface redundant1:2 manage sshset interface redundant1:2 manage telnetset interface redundant1:2 manage webset admin user admi