Juniper防火墙AP全网状NSRP配置实例
2024-06-30 05:34:18
以下为Juniper ISG-2000防火墙相关配置：<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
一、物理接口配置情况：
NS2000_M(M)-> get int
A - Active, I - Inactive, U - Up, D - Down, R - Ready
Interfaces in vsys Root:
Name IP Address Zone MAC VLAN State VSD
mgt 192.168.1.1/24 MGT 0010.dbbf.0c80 - D -
eth1/1 0.0.0.0/0 Untrust 0010.dbff.4070 - U 0
eth1/2 0.0.0.0/0 Untrust 0010.dbff.4080 - U 0
eth2/1 0.0.0.0/0 Trust 0010.dbff.4150 - U 0
eth2/2 0.0.0.0/0 Trust 0010.dbff.4160 - U 0
eth3/1 10.243.213.9/29 DMZ 0010.dbff.41d0 - U 0
eth3/2 0.0.0.0/0 Null 0010.dbff.41e0 - D 0
eth4/1 0.0.0.0/0 HA 0010.dbbf.0ca5 - U -
eth4/2 0.0.0.0/0 HA 0010.dbbf.0ca6 - U -
eth4/3 0.0.0.0/0 Null 0010.dbff.4270 - D 0
eth4/4 0.0.0.0/0 IDP 0010.dbff.4280 - U 0
eth4/4.200 10.243.210.142/28 IDP 0010.dbff.4280 200 U 0
red1 10.243.213.1/29 Trust 0010.dbff.4400 - U 0
red2 10.243.209.17/29 Untrust 0010.dbff.4410 - U 0
vlan1 0.0.0.0/0 VLAN 0010.dbff.40f0 1 D 0
null 0.0.0.0/0 Null N/A - U 0
Name IP Address Zone MAC VLAN State VSD
mgt 192.168.1.1/24 MGT 0010.dbbf.0c80 - D -
eth1/1 0.0.0.0/0 Untrust 0010.dbff.4070 - U 0
eth1/2 0.0.0.0/0 Untrust 0010.dbff.4080 - U 0
eth2/1 0.0.0.0/0 Trust 0010.dbff.4150 - U 0
eth2/2 0.0.0.0/0 Trust 0010.dbff.4160 - U 0
eth3/1 10.243.213.9/29 DMZ 0010.dbff.41d0 - U 0
eth3/2 0.0.0.0/0 Null 0010.dbff.41e0 - D 0
eth4/1 0.0.0.0/0 HA 0010.dbbf.0ca5 - U -
eth4/2 0.0.0.0/0 HA 0010.dbbf.0ca6 - U -
eth4/3 0.0.0.0/0 Null 0010.dbff.4270 - D 0
eth4/4 0.0.0.0/0 IDP 0010.dbff.4280 - U 0
eth4/4.200 10.243.210.142/28 IDP 0010.dbff.4280 200 U 0
red1 10.243.213.1/29 Trust 0010.dbff.4400 - U 0
red2 10.243.209.17/29 Untrust 0010.dbff.4410 - U 0
vlan1 0.0.0.0/0 VLAN 0010.dbff.40f0 1 D 0
null 0.0.0.0/0 Null N/A - U 0
NS2000_B(B)-> get int
A - Active, I - Inactive, U - Up, D - Down, R - Ready
Interfaces in vsys Root:
Name IP Address Zone MAC VLAN State VSD
mgt 192.168.1.1/24 MGT 0010.dbbf.0c00 - D -
eth1/1 0.0.0.0/0 Untrust 0010.dbff.4070 - I 0
eth1/2 0.0.0.0/0 Untrust 0010.dbff.4080 - I 0
eth2/1 0.0.0.0/0 Trust 0010.dbff.4150 - I 0
eth2/2 0.0.0.0/0 Trust 0010.dbff.4160 - I 0
eth3/1 10.243.213.9/29 DMZ 0010.dbff.41d0 - I 0
eth3/2 0.0.0.0/0 Null 0010.dbff.41e0 - I 0
eth4/1 0.0.0.0/0 HA 0010.dbbf.0c25 - U -
eth4/2 0.0.0.0/0 HA 0010.dbbf.0c26 - U -
eth4/3 0.0.0.0/0 Null 0010.dbff.4270 - I 0
eth4/4 0.0.0.0/0 IDP 0010.dbff.4280 - I 0
eth4/4.200 10.243.210.142/28 IDP 0010.dbff.4280 200 I 0
red1 10.243.213.1/29 Trust 0010.dbff.4400 - I 0
red2 10.243.209.17/29 Untrust 0010.dbff.4410 - I 0
vlan1 0.0.0.0/0 VLAN 0010.dbff.40f0 1 I 0
null 0.0.0.0/0 Null N/A - U 0
Name IP Address Zone MAC VLAN State VSD
mgt 192.168.1.1/24 MGT 0010.dbbf.0c00 - D -
eth1/1 0.0.0.0/0 Untrust 0010.dbff.4070 - I 0
eth1/2 0.0.0.0/0 Untrust 0010.dbff.4080 - I 0
eth2/1 0.0.0.0/0 Trust 0010.dbff.4150 - I 0
eth2/2 0.0.0.0/0 Trust 0010.dbff.4160 - I 0
eth3/1 10.243.213.9/29 DMZ 0010.dbff.41d0 - I 0
eth3/2 0.0.0.0/0 Null 0010.dbff.41e0 - I 0
eth4/1 0.0.0.0/0 HA 0010.dbbf.0c25 - U -
eth4/2 0.0.0.0/0 HA 0010.dbbf.0c26 - U -
eth4/3 0.0.0.0/0 Null 0010.dbff.4270 - I 0
eth4/4 0.0.0.0/0 IDP 0010.dbff.4280 - I 0
eth4/4.200 10.243.210.142/28 IDP 0010.dbff.4280 200 I 0
red1 10.243.213.1/29 Trust 0010.dbff.4400 - I 0
red2 10.243.209.17/29 Untrust 0010.dbff.4410 - I 0
vlan1 0.0.0.0/0 VLAN 0010.dbff.40f0 1 I 0
null 0.0.0.0/0 Null N/A - U 0
二、HA配置
NS2000_M(M)-> get config | in ethernet4/1
set interface "ethernet4/1" zone "HA"
NS2000_M(M)-> get config | in ethernet4/2
set interface "ethernet4/2" zone "HA"
set interface "ethernet4/1" zone "HA"
NS2000_M(M)-> get config | in ethernet4/2
set interface "ethernet4/2" zone "HA"
NS2000_B(B)-> get config | in ethernet4/1
set interface "ethernet4/1" zone "HA"
NS2000_B(B)-> get config | in ethernet4/2
set interface "ethernet4/2" zone "HA"
set interface "ethernet4/1" zone "HA"
NS2000_B(B)-> get config | in ethernet4/2
set interface "ethernet4/2" zone "HA"
三、冗余接口配置
NS2000_M(M)-> get config | in redundant1
set interface id 64 "redundant1" zone "Trust"
set interface ethernet2/1 group redundant1
set interface ethernet2/2 group redundant1
set interface redundant1 ip 10.243.213.1/29
set interface redundant1 route
set interface redundant1 manage-ip 10.243.213.2
unset interface redundant1 ip manageable
set interface id 64 "redundant1" zone "Trust"
set interface ethernet2/1 group redundant1
set interface ethernet2/2 group redundant1
set interface redundant1 ip 10.243.213.1/29
set interface redundant1 route
set interface redundant1 manage-ip 10.243.213.2
unset interface redundant1 ip manageable
NS2000_B(B)-> get config | in redundant1
set interface id 64 "redundant1" zone "Trust"
set interface ethernet2/1 group redundant1
set interface ethernet2/2 group redundant1
set interface redundant1 ip 10.243.213.1/29
set interface redundant1 route
set interface redundant1 manage-ip 10.243.213.3
unset interface redundant1 ip manageable
set interface id 64 "redundant1" zone "Trust"
set interface ethernet2/1 group redundant1
set interface ethernet2/2 group redundant1
set interface redundant1 ip 10.243.213.1/29
set interface redundant1 route
set interface redundant1 manage-ip 10.243.213.3
unset interface redundant1 ip manageable
四、NSRP配置
NS2000_M(M)-> get config | in nsrp
set nsrp cluster id 2
set nsrp rto-mirror sync
set nsrp rto-mirror session ageout-ack
set nsrp vsd-group id 0 priority 50
set nsrp vsd-group id 0 preempt hold-down 1
set nsrp monitor interface redundant1
set nsrp monitor interface redundant2
set nsrp monitor interface ethernet3/1
set nsrp ha-link probe
set nsrp cluster id 2
set nsrp rto-mirror sync
set nsrp rto-mirror session ageout-ack
set nsrp vsd-group id 0 priority 50
set nsrp vsd-group id 0 preempt hold-down 1
set nsrp monitor interface redundant1
set nsrp monitor interface redundant2
set nsrp monitor interface ethernet3/1
set nsrp ha-link probe
NS2000_B(B)-> get config | in nsrp
set nsrp cluster id 2
set nsrp rto-mirror sync
set nsrp rto-mirror session ageout-ack
set nsrp vsd-group id 0 priority 100
set nsrp monitor interface redundant1
set nsrp monitor interface redundant2
set nsrp monitor interface ethernet3/1
set nsrp ha-link probe
set nsrp cluster id 2
set nsrp rto-mirror sync
set nsrp rto-mirror session ageout-ack
set nsrp vsd-group id 0 priority 100
set nsrp monitor interface redundant1
set nsrp monitor interface redundant2
set nsrp monitor interface ethernet3/1
set nsrp ha-link probe
以下为华为交换机S8512相关配置：
一、VLAN配置情况
<S8512_1>disp vlan 80
VLAN ID: 80
VLAN Type: static
Route Interface: configured
IP Address: 10.243.213.4
Subnet Mask: 255.255.255.248
Description: NetScreen
Name: VLAN 0080
Tagged Ports:
GigabitEthernet5/1/24 GigabitEthernet8/1/22
Untagged Ports:
GigabitEthernet5/1/23 GigabitEthernet8/1/21
<S8512_2>disp vlan 80
VLAN ID: 80
VLAN Type: static
Route Interface: configured
IP Address: 10.243.213.5
Subnet Mask: 255.255.255.248
Description: VLAN 0080
Name: VLAN 0080
Tagged Ports:
GigabitEthernet5/1/24 GigabitEthernet8/1/22
Untagged Ports:
GigabitEthernet5/1/23 GigabitEthernet8/1/21
VLAN ID: 80
VLAN Type: static
Route Interface: configured
IP Address: 10.243.213.4
Subnet Mask: 255.255.255.248
Description: NetScreen
Name: VLAN 0080
Tagged Ports:
GigabitEthernet5/1/24 GigabitEthernet8/1/22
Untagged Ports:
GigabitEthernet5/1/23 GigabitEthernet8/1/21
<S8512_2>disp vlan 80
VLAN ID: 80
VLAN Type: static
Route Interface: configured
IP Address: 10.243.213.5
Subnet Mask: 255.255.255.248
Description: VLAN 0080
Name: VLAN 0080
Tagged Ports:
GigabitEthernet5/1/24 GigabitEthernet8/1/22
Untagged Ports:
GigabitEthernet5/1/23 GigabitEthernet8/1/21
二、VLAN起三层接口配置情况
<S8512_1>disp cur | be interface Vlan-interface80
interface Vlan-interface80
description NetScreen
ip address 10.243.213.4 255.255.255.248
vrrp vrid 80 virtual-ip 10.243.213.6
vrrp vrid 80 priority 200
vrrp vrid 80 preempt-mode timer delay 3
<S8512_2>disp cur | be interface Vlan-interface80
interface Vlan-interface80
description NetScreen
ip address 10.243.213.5 255.255.255.248
vrrp vrid 80 virtual-ip 10.243.213.6
vrrp vrid 80 preempt-mode timer delay 3
interface Vlan-interface80
description NetScreen
ip address 10.243.213.4 255.255.255.248
vrrp vrid 80 virtual-ip 10.243.213.6
vrrp vrid 80 priority 200
vrrp vrid 80 preempt-mode timer delay 3
<S8512_2>disp cur | be interface Vlan-interface80
interface Vlan-interface80
description NetScreen
ip address 10.243.213.5 255.255.255.248
vrrp vrid 80 virtual-ip 10.243.213.6
vrrp vrid 80 preempt-mode timer delay 3
三、VLAN TRUNK透传配置情况
<S8512_1>disp cur | be GigabitEthernet5/1/24
interface GigabitEthernet5/1/24
description to GZ_S8512_YZ_2
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
<S8512_1>disp cur | be GigabitEthernet8/1/22
interface GigabitEthernet8/1/22
description to GZ_S8512_YZ_2
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
<S8512_2>disp cur | be GigabitEthernet5/1/24
interface GigabitEthernet5/1/24
description to GZ_S8512_YZ_1
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
interface GigabitEthernet5/1/24
description to GZ_S8512_YZ_2
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
<S8512_1>disp cur | be GigabitEthernet8/1/22
interface GigabitEthernet8/1/22
description to GZ_S8512_YZ_2
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
<S8512_2>disp cur | be GigabitEthernet5/1/24
interface GigabitEthernet5/1/24
description to GZ_S8512_YZ_1
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
<S8512_2>disp cur | be GigabitEthernet8/1/22
interface GigabitEthernet8/1/22
description to GZ_S8512_YZ_1
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
interface GigabitEthernet8/1/22
description to GZ_S8512_YZ_1
speed 1000
duplex full
port link-type trunk
port trunk permit vlan all
port link-aggregation group 1
<S8512_1>disp cur | be interface GigabitEthernet5/1/23
interface GigabitEthernet5/1/23
description to ISG2000
port access vlan 80
<S8512_1>disp cur | be interface GigabitEthernet8/1/21
interface GigabitEthernet8/1/21
description to ISG2000
port access vlan 80
-----------------------------------------
<S8512_2>disp cur | be interface GigabitEthernet5/1/23
interface GigabitEthernet5/1/23
description to ISG2000
port access vlan 80
<S8512_2>disp cur | be interface GigabitEthernet8/1/21
interface GigabitEthernet8/1/21
description to ISG2000
port access vlan 80
interface GigabitEthernet5/1/23
description to ISG2000
port access vlan 80
<S8512_1>disp cur | be interface GigabitEthernet8/1/21
interface GigabitEthernet8/1/21
description to ISG2000
port access vlan 80
-----------------------------------------
<S8512_2>disp cur | be interface GigabitEthernet5/1/23
interface GigabitEthernet5/1/23
description to ISG2000
port access vlan 80
<S8512_2>disp cur | be interface GigabitEthernet8/1/21
interface GigabitEthernet8/1/21
description to ISG2000
port access vlan 80
转载于:https://blog.51cto.com/hbsunny/290273
Juniper防火墙AP全网状NSRP配置实例相关推荐
- ASA防火墙之基于用户MPF配置实例
ASA防火墙之基于用户MPF 本篇继续介绍ASA防火墙,上篇我们讲了URL的过滤,那么本篇我们在这个基础下设置不同的用户,来控制一个可以访问,一个过滤掉. 配置实例 需求: ASA本地有两个用户:分别 ...
- 思科胖AP多个SSID配置实例
需求:配置两个SSID(OPEN和WPA2),一个使用开放认证,另一个使用WPA2认证. 描述: (1) SSID OPEN对应VLAN10,SSID WPA2是对应VLAN20,在交换机上创建VLA ...
- 思科无线AP版本15.2配置实例
SSID:XXXX password:YYYYYYYY ap>en Password:Cisco(默认) ap#show run Building configuration- Current ...
- 防火墙双机热备配置实例（三）
今天继续给大家介绍HCIE安全系列相关内容.本文以华为eNSP模拟器为例,实现了配置防火墙双击热备技术配置实例,采用的是上下行交换机配置VRRP的主备模式. 阅读本文,您需要有一定的防火墙配置基础和防 ...
- 防火墙双机热备配置实例（一）
今天继续给大家介绍HCIE安全.本文以华为eNSP模拟器为例,实现了配置防火墙双击热备技术配置实例,采用的是上下行交换机配置VRRP的主备模式. 阅读本文,您需要有一定的防火墙配置基础和防火墙双机热备 ...
- Juniper 防火墙简明配置手册
Juniper SRX防火墙简明配置手册 SRX系列防火墙是Juniper公司基于JUNOS操作系统的安全系列产品,JUNOS集成了路由.交换.安全性和一系列丰富的网络服务.目前Juniper公司的 ...
- juniper防火墙常用配置
juniper netscreen FW的常用配置 1.Juniper防火墙管理配置的基本信息 Juniper防火墙常用管理方式: ① 通过Web浏览器方式管理.推荐使用IE浏览器进行登录管理,需 ...
- 思科pix防火墙配置实例大全
在配置PIX防火墙之前,先来介绍一下防火墙的物理特性.防火墙通常具有至少3个接口,但许多早期的防火墙只具有2个接口:当使用具有3个接口的防火墙时,就至少产生了3个网络,描述如下: 内部区域(内网):内 ...
- Juniper SRX防火墙批量导入set格式配置
Juniper SRX防火墙批量导入set格式配置 SRX在进行大量配置时可能会出现一些小问题,可以使用load set terminal命令导入大量set格式的配置. root# load set ...
最新文章
- 二进制bit0是什么意思_模拟信号是什么 模拟信号数字传输原理介绍【图文】
- ITK:打印顶点邻居
- 华为手机logcat不出日志解决方案
- Javascript Array和String的互转换。
- Uboot中start.S源码的指令级的详尽解析 在线版
- 策略模式应用场景和uml_策略模式
- 蓝桥杯真题训练 2019.3题
- 电子增稳云台_揭秘Dobby自拍无人机，电子增稳是黑科技？
- 2021年高考成绩什么时候查询辽宁,2021年辽宁高考成绩什么时候几点可以查
- 大数据时代，百货行业信息化将如何变革？
- DDoS booter滥用 DTLS 服务器放大攻击
- 并行编译 Xoreax IncrediBuild
- jQuery 学习笔记之二 (jQuery代码风格)
- Java 原生 JDBC 代码操作演示
- 体育类App原型制作分享-Onefootball
- 全图各省市乡镇数据交流
- mfc动态改变clip风格_游戏背景音乐的种类—动态音效
- 教你用迅雷下载百度云网盘的大文件
- 南京理工大学计算机学院施静,“为是这个学院的一分子而骄傲”----院友风采（2014届）：南京理工大学最年轻教授 祁志祥...
- 怎么让两个java文件关联,怎么把多个excel文件合并成一个【几个excle合并成一个】...
热门文章
- 给XLua生成Unity Api的EmmyLua代码提示
- 中国有个公司叫华为技术，不叫华为。
- 鞋子，靴子，拖鞋傻傻分不清楚 pytorch实现分类 入门小案例
- 11月英语--慢慢回温
- javascript中This的几种赋值情况
- ipad在线看html5,在iPad上播放HTML5视频并寻找(Playing HTML5 Video on IPad and seeking)
- C++最经典斗破苍穹游戏代码，（高仿），完美复原原游戏，好玩到停不下来
- 自建ca根证书_如何创建私有 CA 并签发证书
- 100% 远程办公也能培养企业文化、享受乐趣并组建办公空间 #Party Space
- 2005/12/24 游三清山