Juniper SRX 新增Virtual Router

Juniper SRX550新增Virtual Router SOP

以telnet 登入Juniper SRX550，進入設定模式

configure

指定整個Cluster 中redundant ethernet interface數量上限

set chassis cluster reth-count 6

設定SRX介面接收vlan tag

set interfaces reth5 vlan-tagging

定義介面vlan & sub interface

set interfaces ge-0/0/8 gigether-options redundant-parent reth4

set interfaces ge-9/0/8 gigether-options redundant-parent reth4

set interfaces ge-0/0/9 gigether-options redundant-parent reth5

set interfaces ge-9/0/9 gigether-options redundant-parent reth5

set interfaces reth4 redundant-ether-options redundancy-group 1

set interfaces reth5 redundant-ether-options redundancy-group 1

set interfaces reth4 unit 0 family inet address 192.168.0.4/24

set interfaces reth5 unit 3001 vlan-id 3001

set interfaces reth5 unit 3001 family inet address 10.168.1.254/24

set interfaces reth5 unit 3002 vlan-id 3002

set interfaces reth5 unit 3002 family inet address 10.168.2.254/24

set interfaces reth5 unit 3003 vlan-id 3003

set interfaces reth5 unit 3003 family inet address 10.168.3.254/24

set interfaces reth5 unit 3004 vlan-id 3004

set interfaces reth5 unit 3004 family inet address 10.168.4.254/24

新增Virtual Router

set routing-instances vr3 instance-type virtual-router

配置指定介面至Virtual Router

set routing-instances vr3 interface reth4.0

set routing-instances vr3 interface reth5.3001

set routing-instances vr3 interface reth5.3002

set routing-instances vr3 interface reth5.3003

set routing-instances vr3 interface reth5.3004

設定Virtual Router路由

set routing-instances vr3 routing-options static route 0.0.0.0/0 next-hop 192.168.0.1

定義S-NAT pool

set security nat source pool 192_168_0_250 address 192.168.0.250/32

設定S-NAT規則

set security nat source rule-set vr3-SNAT from zone trust-vr3

set security nat source rule-set vr3-SNAT to zone untrust-vr3

set security nat source rule-set vr3-SNAT rule vr3-S-Rule1 match source-address 10.168.0.0/16

set security nat source rule-set vr3-SNAT rule vr3-S-Rule1 then source-nat pool 192_168_0_250

設定untrust zone 接收IP封包範圍

set security nat proxy-arp interface reth4.0 address 10.168.0.5/32 to 10.168.0.254/32

定義Zone

set security zones security-zone untrust-vr3 host-inbound-traffic system-services snmp

set security zones security-zone untrust-vr3 host-inbound-traffic system-services snmp-trap

set security zones security-zone untrust-vr3 host-inbound-traffic system-services ping

set security zones security-zone untrust-vr3 interfaces reth4.0

set security zones security-zone trust-vr3 host-inbound-traffic system-services snmp

set security zones security-zone trust-vr3 host-inbound-traffic system-services snmp-trap

set security zones security-zone trust-vr3 host-inbound-traffic system-services http

set security zones security-zone trust-vr3 host-inbound-traffic system-services telnet

set security zones security-zone trust-vr3 host-inbound-traffic system-services ping

set security zones security-zone trust-vr3 interfaces reth5.3001

set security zones security-zone trust-vr3 interfaces reth5.3002

set security zones security-zone trust-vr3 interfaces reth5.3003

set security zones security-zone trust-vr3 interfaces reth5.3004

設定Zone測試規則

set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all match source-address any

set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all match destination-address any

set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all match application any

set security policies from-zone untrust-vr3 to-zone trust-vr3 policy permit_all then permit

set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all match source-address any

set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all match destination-address any

set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all match application any

set security policies from-zone trust-vr3 to-zone untrust-vr3 policy permit_all then permit

配置Redundant Interface

最後再進行設定，避免介面未設定完畢造成設備切換

set chassis cluster redundancy-group 1 interface-monitor ge-0/0/8 weight 255

set chassis cluster redundancy-group 1 interface-monitor ge-0/0/9 weight 255

set chassis cluster redundancy-group 1 interface-monitor ge-9/0/8 weight 255

set chassis cluster redundancy-group 1 interface-monitor ge-9/0/9 weight 255

設定vr3 snmp

set snmp community Public authorization read-write

set snmp community Public clients 192.168.0.10/32

set snmp community Public clients 10.168.1.0/24

set snmp community Public routing-instance vr3

set snmp routing-instance-access access-list vr3

寫入設定

commit