{"id":14183,"date":"2016-10-06T05:13:00","date_gmt":"2016-10-05T21:13:00","guid":{"rendered":"http:\/\/blog.pmail.idv.tw\/?p=14183"},"modified":"2016-10-06T05:13:00","modified_gmt":"2016-10-05T21:13:00","slug":"%e8%bf%91%e6%9c%9f%e5%b7%a5%e4%bd%9c%e7%ad%86%e8%a8%982srx-240-ha-%e8%a8%ad%e5%ae%9a","status":"publish","type":"post","link":"https:\/\/blog.pmail.idv.tw\/?p=14183","title":{"rendered":"\u8fd1\u671f\u5de5\u4f5c\u7b46\u8a18(2)SRX 240 HA \u8a2d\u5b9a"},"content":{"rendered":"

\u7576\u7db2\u6bb5\u90fd\u898f\u5283\u597dcisco 3750\u4e5f\u8a2d\u5b9a\u597d\u4e86\u4ee5\u5f8c\uff0c\u63a5\u4e0b\u4f86\u6211\u8981\u9032\u884c\u7684\u5c31\u662f\u5169\u53f0juniper srx 240 \u7684\u8a2d\u5b9a\u3002<\/p>\n

<\/p>\n

\u57fa\u672c\u4e0a\u6b64\u6b21240\u8a2d\u5b9a\u7684\u5de5\u4f5c\u5c31\u662f\u628aHA\u8a2d\u5b9a\u597d\u8b93\u5167\u90e8\u7db2\u6bb5\u53ef\u4ee5\u4e0a\u7db2\u5c31\u5b8c\u6210\u76ee\u6a19\uff0cVPN\u5c31\u4ea4\u7d66\u570b\u5916\u8a2d\u5b9a\u3002<\/p>\n

Juniper SRX \u8981\u505aHA\u524d\u8981\u5148\u78ba\u8a8d\u7684\u6771\u897f\u5c31\u5169\u53f0\u578b\u865f OS\u53caModules \u90fd\u8981\u76f8\u540c<\/font><\/strong><\/p>\n

\u5f88\u5e78\u904b\u7684 \u6211\u9019\u908a\u5169\u53f0\u662f\u99ac\u4f86\u897f\u4e9e\u90a3\u908a\u6c92\u518d\u7528\u7684\u6700\u65e9\u4e5f\u662f\u8a2d\u5b9aHA\u3002<\/p>\n

\u56e0\u70ba\u5c0djuniper \u4e0d\u719f\uff0c\u6240\u4ee5\u53ea\u80fdgoogle \u627e\u4e00\u4e0b\u76f8\u95dc\u8cc7\u6e90<\/p>\n

\u5b98\u65b9\u6709\u4e00\u500b\u7db2\u7ad9(\u5982\u4e0b)\u53ef\u4ee5\u8f38\u5165\u76f8\u95dc\u8cc7\u8a0a\u5f8c\u628aconf \u7522\u751f\u51fa\u4f86\u975e\u5e38\u65b9\u4fbf<\/p>\n

http:\/\/www.juniper.net\/support\/tools\/srxha\/<\/a><\/p>\n

\u7db2\u8def\u4e0a\u627e\u4e86SRX240\u7684\u5716\u7247\u5982\u4e0b<\/p>\n

 <\/p>\n

\"SRX-240-1\"<\/a><\/p>\n

\u5148\u8aaa\u660e\u4e00\u4e0bHA\u6703\u7528\u5230\u7684interface <\/p>\n

fxp0: management interface
fxp1: control link
fab : data link
swfab : switching data link
reth : redundant pseudo-interface<\/p>\n

fxp1 \u529f\u80fd:<\/p>\n

1. Heartbet<\/p>\n

2. conf \u540c\u6b65<\/p>\n

fab \u529f\u80fd<\/p>\n

1. RTO(Real Time Object)<\/p>\n

2.traffic<\/p>\n

\u6bcf\u4e00\u5404\u578b\u865f\u53ef\u4ee5\u7528\u7684port\u5b9a\u7fa9\u53ef\u80fd\u6703\u4e0d\u540c\u53ef\u4ee5\u53c3\u8003\u4e0b\u9762\u7db2\u5740\u627e\u5230\u8981\u8a2d\u5b9a\u7684\u578b\u865f<\/p>\n

https:\/\/kb.juniper.net\/InfoCenter\/index?page=content&id=KB15356&actp=search<\/a><\/p>\n

\u76ee\u524d\u6211\u7684\u578b\u865f240 \u5c31\u5982\u4e0b\u5716<\/p>\n

\"SRX-240-2\"<\/a><\/p>\n

 <\/p>\n

\u4f9d\u7167\u4e0a\u5716\u67e5\u5230\u7684\u6211\u5148\u5b9a\u7fa9\u865f\u6211\u8981\u7528\u7684port<\/p>\n

node0 : ge-0\/0\/0 \u7ba1\u7406IP
node1 : ge-0\/0\/0 \u7ba1\u7406IP <\/p>\n

node0 : ge-0\/0\/1 HA  control
node1 : ge-0\/0\/1 HA  control<\/p>\n

node0 : ge-0\/0\/2  RTO
node1 : ge-0\/0\/2  RTO <\/p>\n

node0 : ge-0\/0\/3 \u5167\u90e8IP
node1 : ge-0\/0\/3 \u5167\u90e8IP <\/p>\n

node0 : ge-0\/0\/4 isp1
node1 : ge-0\/0\/4 isp1 <\/p>\n

node0 : ge-0\/0\/5 isp2
node1 : ge-0\/0\/5 isp2 <\/p>\n

  <\/p>\n

\u5c0f\u63d2\u66f2\uff1a\u3000<\/p>\n

\u56e0\u70ba\u4e0d\u77e5\u9053root\u5bc6\u78bc\u6240\u4ee5\u53c3\u8003\u4e0b\u9762\u7684\u6587\u4ef6\u5c07root \u5bc6\u78bc\u3000reset<\/p>\n

https:\/\/www.juniper.net\/documentation\/en_US\/junos12.1×46\/topics\/task\/operational\/security-root-password-srx-series-device-recovering.html<\/a><\/p>\n

\u5bc6\u78bcreset \u5f8c\uff0c\u78ba\u5b9a\u53ef\u4ee5\u767b\u5165\uff0c\u4f46\u8a62\u554f\u6211\u7684\u5ee0\u5546\u5f8c\u8981\u505a\uff28\uff21\u4ed6\u7684\u7fd2\u6163\u5c31\u662f\u628a\u6240\u6709\u8a2d\u5b9a\u6e05\u7a7a<\/p>\n

\u6e05\u7a7a\u7684\u65b9\u5f0f<\/p>\n

\u76f4\u63a5\u662fconf \u6a21\u5f0f<\/p>\n

\u4e0b delete \u9078yes \u7136\u5f8c\u91cd\u65b0\u8a2d\u5b9a\u4e00\u7d44root\u3000password (\u6307\u4ee4\u5982\u4e0b\u7d05\u8272\u5b57\u9ad4\uff0c\u6211\u662f\u7528console \u9023\u7136\u5f8c\u5169\u53f0\u90fd\u505a\u597d\u5f8c\uff0c\u91cd\u958b\u6a5f)<\/p>\n

root# delete<\/strong><\/font> <\/p>\n

This will delete the entire configuration <\/p>\n

Delete everything under this level? [yes,no] (no) yes <\/p>\n

root@host# set system root-authentication plain-text-password<\/font><\/strong> <\/p>\n

New password: <\/p>\n

Retype new password: <\/p>\n

root@host# commit<\/strong><\/font> <\/p>\n

HA\u8a2d\u5b9a:<\/font> <\/p>\n

\u9664\u975e\u6c92\u6709\u505aHA\uff0c\u5426\u5247HA\u8a2d\u5b9a\u4e00\u5b9a\u662f\u505a\u512a\u5148\u505a<\/font> <\/p>\n

\u9996\u5148\u5c07\u5169\u53f0 HA\u76f8\u95dc\u7684port \u5c0d\u63a5\u8d77\u4f86<\/font> (\u5982\u4e0b) <\/p>\n

node0 : ge-0\/0\/1 HA  control
node1 : ge-0\/0\/1 HA  control<\/p>\n

node0 : ge-0\/0\/2  RTO
node1 : ge-0\/0\/2  RTO<\/p>\n

\u5169\u53f0\u500b\u5225\u505a <\/p>\n

NODE1: <\/p>\n

set chassis cluster cluster-id 1 node 0 reboot <\/p>\n

NODE2: <\/p>\n

set chassis cluster cluster-id 1 node 1 reboot <\/p>\n

cluster-id 1-15 node 0 or 1 \uff0ccluster-id \u9808\u8a2d\u5b9a\u76f8\u540c <\/p>\n

\u5169\u53f0\u91cd\u958b\u6a5f\u5f8c: <\/p>\n

\u67e5\u8a62cluster \u72c0\u614b(\u6b63\u5e38\u61c9\u8a72\u5982\u4e0b\u5716) <\/p>\n

root> show chassis cluster status <\/p>\n

\"image\"<\/a> <\/p>\n

\u4ee5\u4e0a\u5c31\u5b8c\u6210HA\u7684\u8a2d\u5b9a <\/p>\n

\u63a5\u4e0b\u4f86\u90fd\u5728primary \u505a\u5c31\u53ef\u4ee5: <\/p>\n

set groups node0 system host-name  SRX_0=>\u8a2d\u5b9a NODE0 HOSTNAME<\/font>
set groups node0 set interface fxp0 unit 0 family inet address 10.65.114.1\/23 =>\u8a2d\u5b9aNODE0 \u7ba1\u7406ip \u5728GE-0\/0\/0<\/font> <\/p>\n

set groups node1 system host-name  SRX_1 =>\u8a2d\u5b9a NODE1 HOSTNAME<\/font> <\/p>\n

set groups node1 interface fxp0 unit 0 family inet address 10.65.114.2\/23 =>\u8a2d\u5b9aNODE1 \u7ba1\u7406ip \u5728GE-0\/0\/0<\/font> <\/p>\n

set apply-groups “${node}” => HA group\u7684\u6210\u54e1node\u4ee3\u865f<\/font> <\/p>\n

\u8a2d\u5b9adata link interface <\/p>\n

set interfaces fab0 fabric-options member-interfaces ge-0\/0\/2 <\/p>\n

set interfaces fab1 fabric-options member-interfaces ge-5\/0\/2 <\/p>\n

  <\/p>\n

\u8a2d\u5b9aredundancy-group (\u4ee5\u4e0b\u7684\u8a2d\u5b9a\u662f\u5229\u7528\u5b98\u65b9\u63d0\u4f9b\u7684\u8a2d\u5b9a\u6a94\u914d\u7f6e\u7522\u751f\u7db2\u9801\u505a\u51fa\u4f86\u7684) <\/p>\n

set chassis cluster reth-count 3 =>\u8a2d\u5b9a\u6709\u5e7e\u500b\u4ecb\u9762\uff0c\u5167\u90e8\uff0cisp1,isp2 \u6240\u4ee5\u662f3<\/font> <\/p>\n

set chassis cluster redundancy-group 0 node 0 priority 200 <\/p>\n

set chassis cluster redundancy-group 0 node 1 priority 100 <\/p>\n

set chassis cluster redundancy-group 1 node 0 priority 200 <\/p>\n

set chassis cluster redundancy-group 1 node 1 priority 100 <\/p>\n

set interfaces ge-0\/0\/3 gigether-options redundant-parent reth0 <\/p>\n

set interfaces ge-0\/0\/4 gigether-options redundant-parent reth1 <\/p>\n

set interfaces ge-0\/0\/5 gigether-options redundant-parent reth2 <\/p>\n

set interfaces ge-5\/0\/3 gigether-options redundant-parent reth0 <\/p>\n

set interfaces ge-5\/0\/4 gigether-options redundant-parent reth1 <\/p>\n

set interfaces ge-5\/0\/5 gigether-options redundant-parent reth2 <\/p>\n

set interfaces reth0 redundant-ether-options redundancy-group 1 <\/p>\n

set interfaces reth0 unit 0 family inet address 10.65.113.253\/23 <\/p>\n

set interfaces reth1 redundant-ether-options redundancy-group 1 <\/p>\n

set interfaces reth1 unit 0 family inet address 1.1.1.1\/24 =>  \u9019\u88e1\u662fISP\u7dda\u8defIP<\/font> <\/p>\n

set interfaces reth2 redundant-ether-options redundancy-group 1 <\/p>\n

set interfaces reth2 unit 0 family inet address 2.2.2.2\/24 => \u9019\u88e1\u662fISP\u7dda\u8defIP<\/font> <\/p>\n

set security zones security-zone Trusted host-inbound-traffic system-services all <\/p>\n

set security zones security-zone Trusted interfaces reth0.0 <\/p>\n

set security zones security-zone Untrusted interfaces reth1.0 <\/p>\n

set security zones security-zone Untrusted interfaces reth2.0 <\/p>\n

  <\/p>\n

\u5176\u4ed6\u8a2d\u5b9a <\/p>\n

\u8a2d\u5b9aweb console <\/p>\n

set system services web-management https system-generated-certificate <\/p>\n

set system services web-management http interface ge-0\/0\/3 <\/p>\n

set system services web-management https interface ge-0\/0\/3.0 <\/p>\n

\u8a2d\u5b9astatic routing <\/p>\n

\u5229\u7528web \u4f86\u8a2d\u5b9a\u4e0a\u7db2\u8d70\u7b2c\u4e00\u689d\u7dda\u8def <\/p>\n

\u9ede\u9078 Routing  => static routing \u4f86\u65b0\u589e <\/p>\n

\"666\"<\/a> <\/p>\n

\"2016-10-05_230630\"<\/a> <\/p>\n

<\/font><\/strong><\/p>\n

\u6700\u5f8c\u9084\u8981\u8a2d\u5b9a policy and secure NAT \u5f8c\u7528\u6236\u7aef\u5c31\u53ef\u4ee5\u4e0a\u7db2<\/p>\n

\u53ef\u4ee5\u53c3\u8003\u4e4b\u524d\u7684\u7684\u6587\u7ae0<\/p>\n

https:\/\/blog.pmail.idv.tw\/?p=13998<\/a><\/p>\n

\n