2015年11月24日 星期二

Juniper SRX 新增Virtual Router

Juniper SRX550新增Virtual Router SOP

telnet 登入Juniper SRX550,進入設定模式
configure

指定整個Cluster redundant ethernet interface數量上限
set chassis cluster reth-count 6

設定SRX介面接收vlan tag
set interfaces reth5 vlan-tagging

定義介面vlan & sub interface
set interfaces ge-0/0/8 gigether-options redundant-parent reth4
set interfaces ge-9/0/8 gigether-options redundant-parent reth4
set interfaces ge-0/0/9 gigether-options redundant-parent reth5
set interfaces ge-9/0/9 gigether-options redundant-parent reth5
set interfaces reth4 redundant-ether-options redundancy-group 1
set interfaces reth5 redundant-ether-options redundancy-group 1
set interfaces reth4 unit 0 family inet address 192.168.0.4/24
set interfaces reth5 unit 3001 vlan-id 3001
set interfaces reth5 unit 3001 family inet address 10.168.1.254/24
set interfaces reth5 unit 3002 vlan-id 3002
set interfaces reth5 unit 3002 family inet address 10.168.2.254/24
set interfaces reth5 unit 3003 vlan-id 3003
set interfaces reth5 unit 3003 family inet address 10.168.3.254/24
set interfaces reth5 unit 3004 vlan-id 3004
set interfaces reth5 unit 3004 family inet address 10.168.4.254/24

新增Virtual Router
set routing-instances vr3 instance-type virtual-router

配置指定介面至Virtual Router
set routing-instances vr3 interface reth4.0
set routing-instances vr3 interface reth5.3001
set routing-instances vr3 interface reth5.3002
set routing-instances vr3 interface reth5.3003
set routing-instances vr3 interface reth5.3004

設定Virtual Router路由
set routing-instances vr3 routing-options static route 0.0.0.0/0 next-hop 192.168.0.1

定義S-NAT pool
set security nat source pool 192_168_0_250 address 192.168.0.250/32

設定S-NAT規則
set security nat source rule-set vr3-SNAT from zone trust-vr3
set security nat source rule-set vr3-SNAT to zone untrust-vr3
set security nat source rule-set vr3-SNAT rule vr3-S-Rule1 match source-address 10.168.0.0/16
set security nat source rule-set vr3-SNAT rule vr3-S-Rule1 then source-nat pool 192_168_0_250

設定untrust zone 接收IP封包範圍
set security nat proxy-arp interface reth4.0 address 10.168.0.5/32 to 10.168.0.254/32

定義Zone
set security zones security-zone untrust-vr3 host-inbound-traffic system-services snmp
set security zones security-zone untrust-vr3 host-inbound-traffic system-services snmp-trap
set security zones security-zone untrust-vr3 host-inbound-traffic system-services ping
set security zones security-zone untrust-vr3 interfaces reth4.0
set security zones security-zone trust-vr3 host-inbound-traffic system-services snmp
set security zones security-zone trust-vr3 host-inbound-traffic system-services snmp-trap
set security zones security-zone trust-vr3 host-inbound-traffic system-services http
set security zones security-zone trust-vr3 host-inbound-traffic system-services telnet
set security zones security-zone trust-vr3 host-inbound-traffic system-services ping
set security zones security-zone trust-vr3 interfaces reth5.3001
set security zones security-zone trust-vr3 interfaces reth5.3002
set security zones security-zone trust-vr3 interfaces reth5.3003
set security zones security-zone trust-vr3 interfaces reth5.3004

設定Zone測試規則
set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all match source-address any
set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all match destination-address any
set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all match application any
set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all then permit
set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all match source-address any
set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all match destination-address any
set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all match application any
set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all then permit

配置Redundant Interface
最後再進行設定,避免介面未設定完畢造成設備切換
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/8 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/9 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-9/0/8 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-9/0/9 weight 255

設定vr3 snmp
set snmp community Public authorization read-write
set snmp community Public clients 192.168.0.10/32
set snmp community Public clients 10.168.1.0/24
set snmp community Public routing-instance vr3
set snmp routing-instance-access access-list vr3

寫入設定
commit

沒有留言:

張貼留言