Juniper 防火墙HA配置详解_主从(L3 路由模式)

Juniper HA 主双（L3）路由模式配置
实际环境中防火墙做主双是不太可能实现全互联结构，juniper防火墙标配都是4个物理以太网端口，全互联架构需要防火墙增加额外的以太网接口（这样会增加用户成本），或者在物理接口上使用子接口（这样配置的复杂性增加许多），最主要的是用户的网络中大多没有像全互联模式那样多的设备。

因此主双多数实现在相对冗余的网络环境中。

G 2/23G 2/1
G 2/1
G 2/23
G 2/24G 2/24
防火墙A上执行的命令
set hostname ISG1000-A
set interface mgt ip 172.16.12.1/24
set interface "ethernet1/4" zone "HA"
set nsrp cluster id 1
set nsrp rto-mirror sync
set nsrp vsd-group id 0 priority 10
set nsrp vsd-group id 0 preempt
set nsrp vsd-group id 0 monitor interface ethernet1/1 set nsrp vsd-group id 0 monitor interface ethernet1/2
set interface ethernet1 zone trust
set interface ethernet1 ip 192.168.1.254/24
set interface ethernet1 manage-ip 192.168.1.1
set interface ethernet2 zone Untrust
set interface ethernet2 ip 172.16.1.254/24
set interface ethernet2 manage-ip 172.16.1.1
set interface eth1 manage
set interface eth2 manage
防火墙B上执行的命令
set hostname ISG1000-B
set interface mgt ip 172.16.12.2/24
set interface "ethernet1/4" zone "HA"
set nsrp cluster id 1
set nsrp rto-mirror sync
set nsrp vsd-group id 0 priority 100
set nsrp vsd-group id 0 preempt
set nsrp vsd-group id 0 monitor interface ethernet1/1 set nsrp vsd-group id 0 monitor interface ethernet1/2
set interface ethernet1 zone trust
set interface ethernet1 ip 192.168.1.254/24
set interface ethernet1 manage-ip 192.168.1.2
set interface ethernet2 zone Untrust
set interface ethernet2 ip 172.16.1.254/24
set interface ethernet2 manage-ip 172.16.1.2
set interface eth1 manage
set interface eth2 manage
任意一个防火墙上执行的命令即可
set policy id 2 from "Trust" to "Untrust" "Any" "Any" "ANY" permit
set policy id 3 from "UnTrust" to "trust" "Any" "Any" "ANY" permit
___________________________________________________________
最后 A 和B 都必须执行的命令
exec nsrp sync global save。