一、实验拓扑
业务网段： siteA: vlan100 192.168.100.0/24 , vlan200 192.168.200.0/24 siteB: 192.168.10.0/24 siteC: 192.168.20.0/24
互联网段： 172.16.1.0/24 172.16.2.0/24 172.16.3.0/24
siteA vlan100 ping siteB: ping 192.168.10.10 routing-instance v100 siteA vlan200 ping siteC: ping 192.168.10.10 routing-instance v200
vMX-ISP路由器模拟ISP运营商。
二、vSRXA的配置： vSRXA接口IP地址配置： set chassis cluster reth-count 8
set interfaces ge-0/0/2 gigether-options redundant-parent reth0 set interfaces ge-0/0/3 gigether-options redundant-parent reth1 set interfaces ge-7/0/2 gigether-options redundant-parent reth0 set interfaces ge-7/0/3 gigether-options redundant-parent reth1 set interfaces reth0 vlan-tagging set interfaces reth0 redundant-ether-options redundancy-group 1 set interfaces reth0 unit 100 vlan-id 100 set interfaces reth0 unit 100 family inet address 192.168.100.1/24 set interfaces reth0 unit 200 vlan-id 200 set interfaces reth0 unit 200 family inet address 192.168.200.1/24 set interfaces reth1 redundant-ether-options redundancy-group 1 set interfaces reth1 unit 0 family inet address 172.16.3.1/24
vSRXA接口加入到安全区域： set security zones security-zone v100 host-inbound-traffic system-services all set security zones security-zone v100 host-inbound-traffic protocols all set security zones security-zone v100 interfaces reth0.100 set security zones security-zone v200 host-inbound-traffic system-services all set security zones security-zone v200 host-inbound-traffic protocols all set security zones security-zone v200 interfaces reth0.200 set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces reth1.0
vSRXA配置安全策略，放行所有流量： set security zones security-zone v100 host-inbound-traffic system-services all set security zones security-zone v100 host-inbound-traffic protocols all set security zones security-zone v100 interfaces reth0.100 set security zones security-zone v200 host-inbound-traffic system-services all set security zones security-zone v200 host-inbound-traffic protocols all set security zones security-zone v200 interfaces reth0.200 set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces reth1.0
{primary:node0}[edit] root@vSRXA1# show security policies | display set set security policies from-zone v100 to-zone untrust policy 1 match source-address any set security policies from-zone v100 to-zone untrust policy 1 match destination-address any set security policies from-zone v100 to-zone untrust policy 1 match application any set security policies from-zone v100 to-zone untrust policy 1 then permit set security policies from-zone v200 to-zone untrust policy 1 match source-address any set security policies from-zone v200 to-zone untrust policy 1 match destination-address any set security policies from-zone v200 to-zone untrust policy 1 match application any set security policies from-zone v200 to-zone untrust policy 1 then permit set security policies from-zone v100 to-zone v200 policy 1 match source-address any set security policies from-zone v100 to-zone v200 policy 1 match destination-address any set security policies from-zone v100 to-zone v200 policy 1 match application any set security policies from-zone v100 to-zone v200 policy 1 then permit set security policies from-zone v200 to-zone v100 policy 1 match source-address any set security policies from-zone v200 to-zone v100 policy 1 match destination-address any set security policies from-zone v200 to-zone v100 policy 1 match application any set security policies from-zone v200 to-zone v100 policy 1 then permit set security policies from-zone untrust to-zone v100 policy 1 match source-address any set security policies from-zone untrust to-zone v100 policy 1 match destination-address any set security policies from-zone untrust to-zone v100 policy 1 match application any set security policies from-zone untrust to-zone v100 policy 1 then permit set security policies from-zone untrust to-zone v200 policy 1 match source-address any set security policies from-zone untrust to-zone v200 policy 1 match destination-address any set security policies from-zone untrust to-zone v200 policy 1 match application any set security policies from-zone untrust to-zone v200 policy 1 then permit
vSRXA的路由配置： set routing-options static route 0.0.0.0/0 next-hop 172.16.3.2
三、vSRXB1配置 vSRXB1的接口及安全区域配置： set interfaces ge-0/0/0 unit 0 family inet address 172.16.1.1/24 set interfaces ge-0/0/1 unit 0 family inet address 192.168.10.1/24
set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/1.0 set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0
set routing-options static route 0.0.0.0/0 next-hop 172.16.1.2
vSRXB1的安全策略配置： set security policies from-zone trust to-zone trust policy default-permit match source-address any set security policies from-zone trust to-zone trust policy default-permit match destination-address any set security policies from-zone trust to-zone trust policy default-permit match application any set security policies from-zone trust to-zone trust policy default-permit then permit set security policies from-zone trust to-zone untrust policy default-permit match source-address any set security policies from-zone trust to-zone untrust policy default-permit match destination-address any set security policies from-zone trust to-zone untrust policy default-permit match application any set security policies from-zone trust to-zone untrust policy default-permit then permit set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit
四、vSRXC1配置 vSRXC1接口与安全区域配置: root@vSRX-NGC1# show interfaces | display set set interfaces ge-0/0/0 unit 0 family inet address 172.16.2.1/24 set interfaces ge-0/0/1 unit 0 family inet address 192.168.20.1/24
set security zones security-zone trust tcp-rst set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/1.0 set security zones security-zone untrust screen untrust-screen set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0
set routing-options static route 0.0.0.0/0 next-hop 172.16.2.2
vSRXC1安全策略配置： set security policies from-zone trust to-zone trust policy default-permit match source-address any set security policies from-zone trust to-zone trust policy default-permit match destination-address any set security policies from-zone trust to-zone trust policy default-permit match application any set security policies from-zone trust to-zone trust policy default-permit then permit set security policies from-zone trust to-zone untrust policy default-permit match source-address any set security policies from-zone trust to-zone untrust policy default-permit match destination-address any set security policies from-zone trust to-zone untrust policy default-permit match application any set security policies from-zone trust to-zone untrust policy default-permit then permit set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit
五、vMX-ISP路由器配置 set interfaces ge-0/0/0 unit 0 family bridge interface-mode access set interfaces ge-0/0/0 unit 0 family bridge vlan-id 30 set interfaces ge-0/0/1 unit 0 family bridge interface-mode access set interfaces ge-0/0/1 unit 0 family bridge vlan-id 30 set interfaces ge-0/0/2 unit 0 family inet address 172.16.1.2/24 set interfaces ge-0/0/3 unit 0 family inet address 172.16.2.2/24 set interfaces irb unit 30 family inet address 172.16.3.2/24
[edit] root@vMX-ISP# show routing-options | display set set routing-options static route 192.168.10.0/24 next-hop 172.16.1.1 set routing-options static route 192.168.20.0/24 next-hop 172.16.2.1 set routing-options static route 192.168.100.0/24 next-hop 172.16.3.1 set routing-options static route 192.168.200.0/24 next-hop 172.16.3.1
六：vMXA1、vMXB1、vMXC1配置
root@vMXA1# show interfaces | display set
set interfaces ge-0/0/0 unit 0 family bridge interface-mode trunk
set interfaces ge-0/0/0 unit 0 family bridge vlan-id-list 100
set interfaces ge-0/0/0 unit 0 family bridge vlan-id-list 200
set interfaces ge-0/0/1 unit 0 family bridge interface-mode trunk
set interfaces ge-0/0/1 unit 0 family bridge vlan-id-list 100
set interfaces ge-0/0/1 unit 0 family bridge vlan-id-list 200
set interfaces irb unit 100 family inet address 192.168.100.10/24
set interfaces irb unit 200 family inet address 192.168.200.10/24
[edit] root@vMXA1# show routing-instances | display set set routing-instances v100 instance-type virtual-router set routing-instances v100 interface irb.100 set routing-instances v100 routing-options static route 0.0.0.0/0 next-hop 192.168.100.1 set routing-instances v200 instance-type virtual-router set routing-instances v200 interface irb.200 set routing-instances v200 routing-options static route 0.0.0.0/0 next-hop 192.168.200.1
[edit] root@vMXB1# show interfaces | display set set interfaces ge-0/0/0 unit 0 family inet address 192.168.10.10/24 root@vMXB1# show routing-options | display set set routing-options static route 0.0.0.0/0 next-hop 192.168.10.1
root@vMXC1# show interfaces | display set set interfaces ge-0/0/0 unit 0 family inet address 192.168.20.10/24 root@vMXC1# show routing-options | display set set routing-options static route 0.0.0.0/0 next-hop 192.168.20.1
七、连通性测试 root@vMXA1> ping 192.168.10.10 routing-instance v100 count 1 PING 192.168.10.10 (192.168.10.10): 56 data bytes 64 bytes from 192.168.10.10: icmp_seq=0 ttl=61 time=21.264 ms
--- 192.168.10.10 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max/stddev = 21.264/21.264/21.264/0.000 ms
root@vMXA1> ping 192.168.10.10 routing-instance v200 count 1
PING 192.168.10.10 (192.168.10.10): 56 data bytes
64 bytes from 192.168.10.10: icmp_seq=0 ttl=61 time=19.351 ms
--- 192.168.10.10 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max/stddev = 19.351/19.351/19.351/0.000 ms
root@vMXA1> ping 192.168.20.10 routing-instance v200 count 1
PING 192.168.20.10 (192.168.20.10): 56 data bytes
64 bytes from 192.168.20.10: icmp_seq=0 ttl=61 time=14.968 ms
--- 192.168.20.10 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max/stddev = 14.968/14.968/14.968/0.000 ms
root@vMXA1> ping 192.168.20.10 routing-instance v100 count 1
PING 192.168.20.10 (192.168.20.10): 56 data bytes
64 bytes from 192.168.20.10: icmp_seq=0 ttl=61 time=14.589 ms
--- 192.168.20.10 ping statistics --- 1 packets transmitted, 1 packets received, 0% packet loss round-trip min/avg/max/stddev = 14.589/14.589/14.589/0.000 ms
root@vMXA1
总结： 1、SRX HA 环境下物理接口IP地址配置、vlan接口IP地址配置 2、接口与安全区域的配置 3、安全策略安放行配置 4、路由连通性配置
