juniper防火墙透明模式HA高可用性配置.doc

网络拓扑： ? 条件要求： 软件 做HA的两台设备软件版本必须相同 Platform Active/Passive Active/Active ISG Series 5.0.0 or above 5.0.0 or above NS5000 Series 5.0.0 or above 5.0.0 or above SSG550/550M 5.1.0 or above 5.1.0 or above SSG520/520M 5.1.0 or above 6.0.0 or above SSG300 Series 5.4.0 or above 5.4.0 or above SSG 140 5.4.0 or above 6.0.0 or above SSG5 SSG20 5.4.0 or above* 6.0.0 or above* NS500 5.1.0 or above 5.1.0 or above NS200 Series 5.1.0 or above 5.1.0 or above NS50 5.1.0 or above Not Supported NS25 5.1.0 or above** Not Supported NS5gt 5.1.0 or above*** Not Supported 注： *?? extended license required**? Supports only NSRP Lite.? *** Supports only NSRP Lite? extended license required. 另外，如果防火墙要做透明模式的HA，那么Active/Active模式要在ScreenOS 6.1.0? or above才支持的；而且是以下平台：the SSG-500 series, NS-ISG-1000, NS-ISG-2000, and all NS-5000 platforms. ? 许可 两台防火墙必须有想同功能的软件许可； ? 硬件 两台防火墙必须是相同的硬件，有相同的模块； ? ? 网络详情： 这里配置举例使用设备ISG1000，两台做HA，A/S模式，ethernet1/1为信任端口，ethernet1/2为非信任端口，ethernet1/4为HA接口； ? 详细配置： 1、???????????? 配置主设备 set interface ethernet1/1 zone V1-Trust set interface ethernet1/2 zone V1-Untrust set interface ethernet1/4 zone HA ?set interface vlan1 ip /24 set interface vlan1 manage-ip ?set interface vlan1 ip manageable set zone V1-Untrust manage ping set zone V1-Untrust manage web ?set policy id 2 from V1-Trust to V1-Untrust?Any Any ANY permit ?set route /0 interface vlan1 gateway 54 ?set nsrp cluster id 1 set nsrp rto-mirror sync set nsrp vsd-group id 0 priority 10 set nsrp vsd-group id 0 preempt set nsrp vsd-group id 0 monitor interface ethernet1/1 set nsrp vsd-group id 0 monitor interface ethernet1/2 ? 2、???????????? 配置备设备 set nsrp cluster id 1 set nsrp rto-mirror sync set nsrp vsd-group id 0 priority 100 set nsrp vsd-group id 0 monitor interface ethernet1/1 set nsrp vsd-group id 0 monitor interface ethernet1/2 ? nsisg1000-exec nsrp sync global save Save global configuration successfully.Continue to save local configurations ... Save local configuration successfully.? nsisg100