示例：在默认网关部署中配置多节点高可用性
在此示例中，您将在默认网关（第 2 层网络）部署中的 SRX 系列防火墙之间建立多节点高可用性。
概述
在多节点高可用性下，参与的 SRX 系列防火墙在第 2 层网络中作为独立节点运行。加密的逻辑机箱间链路 （ICL） 通过路由网络连接节点。参与节点相互备份，以确保在发生系统或硬件故障时实现快速同步的故障切换。
在多节点高可用性中，活动性在服务冗余组 （SRG） 级别确定。SRG1 处于活动状态的 SRX 系列防火墙负责托管浮动 IP 地址，并使用浮动 IP 地址将流量引导至浮动 IP 地址。在故障转移期间，浮动 IP 地址从旧的主动节点移动到新的主动节点，并继续通信客户端设备。
注意：
从 Junos OS 22.3R1 版开始，我们支持在多节点高可用性解决方案中使用双节点配置。
让我们先概述一下在此示例中将使用的拓扑。
要求
此示例使用以下硬件和软件组件：
-
两个 SRX 系列防火墙或 vSRX 虚拟防火墙实例
-
两台瞻博网络 EX9214 以太网交换机
-
Junos OS 22.3R1 版
拓扑学
图 1 显示了此示例中使用的拓扑。
图 1：默认网关部署
中的多节点高可用性
中的多节点高可用性
如拓扑所示，两个 SRX 系列防火墙分别连接到信任侧和不信任侧的交换机。加密的逻辑机箱间链路 （ICL） 通过路由网络连接节点。节点使用网络上的可路由 IP 地址（浮动 IP 地址）相互通信。环路接口用于托管 SRX 系列防火墙上的 IP 地址。
通常，您可以使用聚合以太网 （AE） 或 SRX 系列防火墙上的收入以太网端口来设置 ICL 连接。在此示例中，我们使用了 ICL 的 GE 端口。我们还为 ICL 路径配置了一个路由实例，以确保最大程度的分段。
在典型的高可用性部署中，网络的北向和南向两侧有多个路由器和交换机。在此示例中，我们在 SRX 系列防火墙的两端使用了两台交换机。
在此示例中，您在 SRX-1 和 SRX-2 上使用静态路由，并将这些路由播发到 BGP 中，以添加指标以确定首选路径中的 SRX 系列防火墙。或者，您可以使用 SRX 系列防火墙上的路由反射器通告通过 BGP 获知的路由，并相应地配置路由策略以匹配 BGP。
您将执行以下任务来构建多节点高可用性设置：
- 通过分配 ID 将一对 SRX 系列防火墙配置为本地和对等节点。
- 配置服务冗余组 （SRG）。
- 配置虚拟 IP 地址，以确定和实施主动性。
- 使用 IKEv2 为高可用性 （ICL） 流量配置 VPN 配置文件。
- 配置适当的安全策略来管理网络中的流量。
-
根据您的网络要求配置无状态防火墙过滤和服务质量 （QoS）。
-
根据您的网络需求配置接口和区域。您必须允许在与 ICL 关联的安全区域上使用用于链路加密的 IKE 和用于配置同步的 SSH 等主机入站系统服务。
您可以在 SRG0 和 SRG1 上配置以下选项：
-
SRG1：主动/备用信号路由、部署类型、主动性优先级、抢占、虚拟 IP 地址（对于默认网关部署）、主动性 在备份时探测和处理数据包。
-
SRG1：SRG1 上的 BFD 监控、IP 监控和接口监控选项。
-
SRG0：故障时关闭和故障时安装路由选项。
在 SRG1 下配置监控（BFD 或 IP 或接口）选项时，建议不要在 SRG0 下配置故障时关机选项。
对于机箱间链路 （ICL），我们建议进行以下配置设置：
- 使用环路 （lo0） 接口、聚合以太网接口 （ae0） 或任何有收入的以太网接口来建立 ICL。请勿使用专用 HA 端口（控制和交换矩阵端口）（如果 SRX 系列防火墙上可用）。
- 设置 1514 的 MTU
- 允许在与用于 ICL 的接口关联的安全区域上提供以下服务
-
IKE、高可用性、SSH
-
协议取决于您需要的路由协议
-
BFD 监视相邻路由
-
配置
准备工作
SRX 系列防火墙需要 Junos IKE 软件包才能实现多节点高可用性配置。此软件包可作为默认软件包使用，也可以在 SRX 系列防火墙上作为可选软件包使用。有关详细信息，请参阅 对 Junos IKE 软件包的支持 。
如果默认情况下未在 SRX 系列防火墙上安装软件包，请使用以下命令进行安装。ICL 加密需要执行此步骤。
user@host> request system software add optional://junos-ike.tgz Verified junos-ike signed by PackageProductionECP256_2022 method ECDSA256+SHA256 Rebuilding schema and Activating configuration... mgd: commit complete Restarting MGD ... WARNING: cli has been replaced by an updated version: CLI release 20220208.163814_builder.r1239105 built by builder on 2022-02-08 17:07:55 UTC Restart cli using the new version ? [yes,no] (yes)
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改详细信息，以便与网络配置匹配，将命令复制并粘贴到层 [edit] 级的 CLI 中，然后从配置模式进入 commit 。
在 SRX-1 设备上
set chassis high-availability local-id 1 set chassis high-availability local-id local-ip 10.22.0.1 set chassis high-availability peer-id 2 peer-ip 10.22.0.2 set chassis high-availability peer-id 2 interface ge-0/0/2.0 set chassis high-availability peer-id 2 vpn-profile IPSEC_VPN_ICL set chassis high-availability peer-id 2 liveness-detection minimum-interval 400 set chassis high-availability peer-id 2 liveness-detection multiplier 5 set chassis high-availability services-redundancy-group 0 peer-id 2 set chassis high-availability services-redundancy-group 1 deployment-type switching set chassis high-availability services-redundancy-group 1 peer-id 2 set chassis high-availability services-redundancy-group 1 virtual-ip 1 ip 10.1.0.200/16 set chassis high-availability services-redundancy-group 1 virtual-ip 1 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 1 virtual-ip 1 use-virtual-mac set chassis high-availability services-redundancy-group 1 virtual-ip 2 ip 10.2.0.200/16 set chassis high-availability services-redundancy-group 1 virtual-ip 2 interface ge-0/0/4.0 set chassis high-availability services-redundancy-group 1 virtual-ip 2 use-virtual-mac set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 1 preemption set chassis high-availability services-redundancy-group 1 activeness-priority 200 set security ike proposal MNHA_IKE_PROP description mnha_link_encr_tunnel set security ike proposal MNHA_IKE_PROP authentication-method pre-shared-keys set security ike proposal MNHA_IKE_PROP dh-group group14 set security ike proposal MNHA_IKE_PROP authentication-algorithm sha-256 set security ike proposal MNHA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal MNHA_IKE_PROP lifetime-seconds 3600 set security ike policy MNHA_IKE_POL description mnha_link_encr_tunnel set security ike policy MNHA_IKE_POL proposals MNHA_IKE_PROP set security ike policy MNHA_IKE_POL pre-shared-key ascii-text "$ABC123" set security ike gateway MNHA_IKE_GW ike-policy MNHA_IKE_POL set security ike gateway MNHA_IKE_GW version v2-only set security ipsec proposal MNHA_IPSEC_PROP description mnha_link_encr_tunnel set security ipsec proposal MNHA_IPSEC_PROP protocol esp set security ipsec proposal MNHA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal MNHA_IPSEC_PROP lifetime-seconds 3600 set security ipsec policy MNHA_IPSEC_POL description mnha_link_encr_tunnel set security ipsec policy MNHA_IPSEC_POL proposals MNHA_IPSEC_PROP set security ipsec vpn IPSEC_VPN_ICL ha-link-encryption set security ipsec vpn IPSEC_VPN_ICL ike gateway MNHA_IKE_GW set security ipsec vpn IPSEC_VPN_ICL ike ipsec-policy MNHA_IPSEC_POL set interfaces ge-0/0/3 description "trust" unit 0 family inet address 10.1.0.1/16 set interfaces ge-0/0/4 description "untrust" unit 0 family inet address 10.2.0.1/16 set interfaces ge-0/0/2 description "ha_link" unit 0 family inet address 10.22.0.1/24 set interfaces lo0 description "untrust" unit 0 family inet address 10.11.0.1/32 set routing-options autonomous-system 65000 set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces ge-0/0/4 set security zones security-zone untrust interfaces lo0.0 set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/3 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/2 set security policies default-policy permit-all set system services netconf ssh
在 SRX-2 设备上
set chassis high-availability local-id 2 set chassis high-availability local-id local-ip 10.22.0.2 set chassis high-availability peer-id 1 peer-ip 10.22.0.1 set chassis high-availability peer-id 1 interface ge-0/0/2.0 set chassis high-availability peer-id 1 vpn-profile IPSEC_VPN_ICL set chassis high-availability peer-id 1 liveness-detection minimum-interval 400 set chassis high-availability peer-id 1 liveness-detection multiplier 5 set chassis high-availability services-redundancy-group 0 peer-id 1 set chassis high-availability services-redundancy-group 1 deployment-type switching set chassis high-availability services-redundancy-group 1 peer-id 1 set chassis high-availability services-redundancy-group 1 virtual-ip 1 ip 10.1.0.200/16 set chassis high-availability services-redundancy-group 1 virtual-ip 1 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 1 virtual-ip 2 ip 10.2.0.200/16 set chassis high-availability services-redundancy-group 1 virtual-ip 2 interface ge-0/0/4.0 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 1 activeness-priority 1 set security ike proposal MNHA_IKE_PROP description mnha_link_encr_tunnel set security ike proposal MNHA_IKE_PROP authentication-method pre-shared-keys set security ike proposal MNHA_IKE_PROP dh-group group14 set security ike proposal MNHA_IKE_PROP authentication-algorithm sha-256 set security ike proposal MNHA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal MNHA_IKE_PROP lifetime-seconds 3600 set security ike policy MNHA_IKE_POL description mnha_link_encr_tunnel set security ike policy MNHA_IKE_POL proposals MNHA_IKE_PROP set security ike policy MNHA_IKE_POL pre-shared-key ascii-text "$ABC123" set security ike gateway MNHA_IKE_GW ike-policy MNHA_IKE_POL set security ike gateway MNHA_IKE_GW version v2-only set security ipsec proposal MNHA_IPSEC_PROP description mnha_link_encr_tunnel set security ipsec proposal MNHA_IPSEC_PROP protocol esp set security ipsec proposal MNHA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal MNHA_IPSEC_PROP lifetime-seconds 3600 set security ipsec policy MNHA_IPSEC_POL description mnha_link_encr_tunnel set security ipsec policy MNHA_IPSEC_POL proposals MNHA_IPSEC_PROP set security ipsec vpn IPSEC_VPN_ICL ha-link-encryption set security ipsec vpn IPSEC_VPN_ICL ike gateway MNHA_IKE_GW set security ipsec vpn IPSEC_VPN_ICL ike ipsec-policy MNHA_IPSEC_POL set interfaces ge-0/0/3 description "trust" unit 0 family inet address 10.1.0.2/16 set interfaces ge-0/0/4 description "untrust" unit 0 family inet address 10.2.0.2/16 set interfaces ge-0/0/2 description "ha_link" unit 0 family inet address 10.22.0.2/24 set interfaces lo0 description "untrust" unit 0 family inet address 10.11.0.1/32 set routing-options autonomous-system 65000 set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces ge-0/0/4 set security zones security-zone untrust interfaces lo0.0 set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/3 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/2 set security policies default-policy permit-all set system services netconf ssh
以下部分显示了在网络中设置多节点高可用性设置所需的交换机上的配置片段。
On Switch（EX9214 以太网交换机）
set interfaces ge-0/0/2 description lan set interfaces ge-0/0/2 mtu 9192 set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members lan set interfaces ge-0/0/0 mtu 9192 set interfaces ge-0/0/0 description lan unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members lan set interfaces ge-0/0/1 mtu 9192 set interfaces ge-0/0/1 description lan unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members lan set vlans lan vlan-id 1001
On Switch（EX9214 以太网交换机）
set interfaces ge-0/0/2 description lan set interfaces ge-0/0/2 mtu 9192 set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members lan set interfaces ge-0/0/0 mtu 9192 set interfaces ge-0/0/0 description lan unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members lan set interfaces ge-0/0/1 mtu 9192 set interfaces ge-0/0/1 description lan unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members lan set vlans lan vlan-id 1001
配置
分步过程
下面的示例要求您在各个配置层级中进行导航。有关作说明，请参阅 CLI 用户指南中的在配置模式下使用 CLI 编辑器。
-
配置接口。
[edit] user@host# set interfaces ge-0/0/3 description "trust" unit 0 family inet address 10.1.0.1/16 user@host# set interfaces ge-0/0/4 description "untrust" unit 0 family inet address 10.2.0.1/16 user@host# set interfaces ge-0/0/2 description "ha_link" unit 0 family inet address 10.22.0.1/24
我们使用接口 ge-0/0/3 和 ge-0/0/4 连接到交换机，并使用 ge-0/0/2 接口进行 ICL。
-
配置环路接口。
[edit] user@host# set interfaces lo0 description "untrust" unit 0 family inet address 10.11.0.1/32
将 IP 地址 （10.11.0.1） 分配给环路接口。此 IP 地址充当浮动 IP 地址。
使用环路接口可确保在任何给定点，来自相邻设备的流量都将引导到浮动 IP 地址（即活动节点）。
- 配置安全策略。
[edit] user@host# set security policies default-policy permit-all
确保您已根据网络要求配置了安全策略。在此示例中，您将配置一个策略以允许所有流量。
-
配置安全区域，为这些区域分配接口，并为安全区域指定允许的系统服务。
[edit] user@host# set security zones security-zone untrust host-inbound-traffic system-services ike user@host# set security zones security-zone untrust host-inbound-traffic system-services ping user@host# set security zones security-zone untrust host-inbound-traffic protocols bfd user@host# set security zones security-zone untrust host-inbound-traffic protocols bgp user@host# set security zones security-zone untrust interfaces ge-0/0/4 user@host# set security zones security-zone untrust interfaces lo0.0 user@host# set security zones security-zone trust host-inbound-traffic system-services all user@host# set security zones security-zone trust host-inbound-traffic protocols all user@host# set security zones security-zone trust interfaces ge-0/0/3 user@host# set security zones security-zone halink host-inbound-traffic system-services ike user@host# set security zones security-zone halink host-inbound-traffic system-services ping user@host# set security zones security-zone halink host-inbound-traffic system-services high-availability user@host# set security zones security-zone halink host-inbound-traffic system-services ssh user@host# set security zones security-zone halink host-inbound-traffic protocols bfd user@host# set security zones security-zone halink host-inbound-traffic protocols bgp user@host# set security zones security-zone halink interfaces ge-0/0/2
将接口 ge-0/0/3 和 ge-0/0/4 分别分配给信任区和不信任区。将 lo0.0 接口分配给不信任区域，以通过公共 IP 网络进行连接。将接口 ge-0/0/2 分配给 halink 区域。您可以使用此区域来设置 ICL。
-
配置路由选项。
[edit] user@host# set routing-options autonomous-system 65000
-
配置本地节点和对等节点详细信息，例如节点 ID、本地节点和对等节点的 lP 地址以及对等节点的接口。
[edit] user@host# set chassis high-availability local-id 1 user@host# set chassis high-availability local-id local-ip 10.22.0.1 user@host# set chassis high-availability peer-id 2 peer-ip 10.22.0.2 user@host# set chassis high-availability peer-id 2 interface ge-0/0/2.0
您将使用 ge-0/0/2 接口通过 ICL 与对等节点进行通信。
-
将 IPsec VPN 配置文件IPSEC_VPN_ICL附加到对等节点。
[edit] user@host# set chassis high-availability peer-id 2 vpn-profile IPSEC_VPN_ICL
您需要此配置才能在节点之间建立安全的 ICL 链路。
-
为对等节点配置双向转发检测 （BFD） 协议选项。
[edit] user@host# set chassis high-availability peer-id 2 liveness-detection minimum-interval 400 user@host# set chassis high-availability peer-id 2 liveness-detection multiplier 5
-
将对等节点 ID 2 与服务冗余组 0 （SRG0） 关联。
[edit] user@host# set chassis high-availability services-redundancy-group 0 peer-id 2
-
配置服务冗余组 1 （SRG1）。
[edit] user@host# set chassis high-availability services-redundancy-group 1 deployment-type switching user@host# set chassis high-availability services-redundancy-group 1 peer-id 2 user@host# set chassis high-availability services-redundancy-group 1 virtual-ip 1 ip 10.1.0.200/16 user@host# set chassis high-availability services-redundancy-group 1 virtual-ip 1 interface ge-0/0/3.0 user@host# set chassis high-availability services-redundancy-group 1 virtual-ip 1 use-virtual-mac user@host# set chassis high-availability services-redundancy-group 1 virtual-ip 2 ip 10.2.0.200/16 user@host# set chassis high-availability services-redundancy-group 1 virtual-ip 2 interface ge-0/0/4.0 user@host# set chassis high-availability services-redundancy-group 1 virtual-ip 2 use-virtual-mac
为 SRG1 分配虚拟 IP （VIP） 地址和接口。
注意：use-virtual-mac在大多数情况下，配置选项是推荐选项，除非除了本地 MAC 地址之外，周围的基础架构不支持在端口上活动的移动虚拟 MAC 地址。 -
配置 SRG1 的 IP 和 BFD 监控参数，以检查 IP 地址的可访问性并检测网络故障。
[edit] user@host# set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 user@host# set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4 user@host# set chassis high-availability services-redundancy-group 1 preemption
-
配置主动性实施所需的活动信号路由。
[edit] user@host# set chassis high-availability services-redundancy-group 1 activeness-priority 200
您分配的活动信号路由 IP 地址用于路由优先级播发。您必须在
policy-options语句中指定活动信号路由和route-exists策略。 -
为多节点高可用性定义互联网密钥交换 （IKE） 配置。IKE 配置定义用于建立安全连接的算法和密钥。
[edit] user@host# set security ike proposal MNHA_IKE_PROP description mnha_link_encr_tunnel user@host# set security ike proposal MNHA_IKE_PROP authentication-method pre-shared-keys user@host# set security ike proposal MNHA_IKE_PROP dh-group group14 user@host# set security ike proposal MNHA_IKE_PROP authentication-algorithm sha-256 user@host# set security ike proposal MNHA_IKE_PROP encryption-algorithm aes-256-cbc user@host# set security ike proposal MNHA_IKE_PROP lifetime-seconds 3600 user@host# set security ike policy MNHA_IKE_POL description mnha_link_encr_tunnel user@host# set security ike policy MNHA_IKE_POL proposals MNHA_IKE_PROP user@host# set security ike policy MNHA_IKE_POL pre-shared-key ascii-text "$ABC123" user@host# set security ike gateway MNHA_IKE_GW ike-policy MNHA_IKE_POL user@host# set security ike gateway MNHA_IKE_GW version v2-only
对于多节点高可用性功能，必须将 IKE 版本配置为
v2-only -
指定 IPsec 提议协议和加密算法。指定 IPsec 选项以在两个参与设备之间创建 IPsec 隧道以保护 VPN 通信。
[edit] user@host# set security ipsec proposal MNHA_IPSEC_PROP description mnha_link_encr_tunnel user@host# set security ipsec proposal MNHA_IPSEC_PROP protocol esp user@host# set security ipsec proposal MNHA_IPSEC_PROP encryption-algorithm aes-256-gcm user@host# set security ipsec proposal MNHA_IPSEC_PROP lifetime-seconds 3600 user@host# set security ipsec policy MNHA_IPSEC_POL description mnha_link_encr_tunnel user@host# set security ipsec policy MNHA_IPSEC_POL proposals MNHA_IPSEC_PROP user@host# set security ipsec vpn IPSEC_VPN_ICL ha-link-encryption user@host# set security ipsec vpn IPSEC_VPN_ICL ike gateway MNHA_IKE_GW user@host# set security ipsec vpn IPSEC_VPN_ICL ike ipsec-policy MNHA_IPSEC_POL
指定
ha-link-encryption选项可对 ICL 进行加密，以保护节点之间的高可用性流量。在机箱高可用性配置中必须提及 vpn_profile 相同的 VPN 名称IPSEC_VPN_ICL。
软件升级的配置选项
在多节点高可用性中，在软件升级期间，您可以通过关闭节点上的接口来转移流量。在这里，流量无法通过节点。有关详细信息，请检查 多节点高可用性中的软件升级 。
- 在“故障时关闭”选项下配置所有流量接口。
user@srx-02# set chassis high-availability services-redundancy-group 0 shutdown-on-failure <interface-name>
[edit] user@srx-02# set chassis high-availability services-redundancy-group 0 shutdown-on-failure ge-0/0/3 user@srx-02# set chassis high-availability services-redundancy-group 0 shutdown-on-failure ge-0/0/4
谨慎：请勿使用为机箱间链路 （ICL） 分配的接口。
结果 （SRX-1）
在配置模式下，输入以下命令以确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明，以便进行更正。
[edit]
user@host# show chassis high-availability
local-id 1 local-ip 10.22.0.1;
peer-id 2 {
peer-ip 10.22.0.2;
interface ge-0/0/2.0;
vpn-profile IPSEC_VPN_ICL;
liveness-detection {
minimum-interval 400;
multiplier 5;
}
}
services-redundancy-group 0 {
peer-id {
2;
}
}
services-redundancy-group 1 {
deployment-type switching;
peer-id {
2;
}
virtual-ip 1 {
ip 10.1.0.200/16;
interface ge-0/0/3.0;
use-virtual-mac;
}
virtual-ip 2 {
ip 10.2.0.200/16;
interface ge-0/0/4.0;
use-virtual-mac;
}
monitor {
interface {
ge-0/0/3;
ge-0/0/4;
}
}
preemption;
activeness-priority 200;
}
[edit]
user@host# show security ike
proposal MNHA_IKE_PROP {
description mnha_link_encr_tunnel;
authentication-method pre-shared-keys;
dh-group group14;
authentication-algorithm sha-256;
encryption-algorithm aes-256-cbc;
lifetime-seconds 3600;
}
policy MNHA_IKE_POL {
description mnha_link_encr_tunnel;
proposals MNHA_IKE_PROP ;
pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
}
gateway MNHA_IKE_GW {
ike-policy MNHA_IKE_POL ;
version v2-only;
}
[edit]
user@host# show security ipsec
proposal MNHA_IPSEC_PROP {
description mnha_link_encr_tunnel;
protocol esp;
encryption-algorithm aes-256-gcm;
lifetime-seconds 3600;
}
policy MNHA_IPSEC_POL {
description mnha_link_encr_tunnel;
proposals MNHA_IPSEC_PROP;
}
vpn IPSEC_VPN_ICL {
ha-link-encryption;
ike {
gateway MNHA_IKE_GW;
ipsec-policy MNHA_IPSEC_POL;
}
}
[edit] user@host# show routing-options autonomous-system 65000;
[edit]
user@host# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/4.0;
lo0.0;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/3.0;
}
}
security-zone halink {
host-inbound-traffic {
system-services {
ike;
ping;
high-availability;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/2.0;
}
}
[edit]
user@host# show interfaces
ge-0/0/2 {
description ha_link;
unit 0 {
family inet {
address 10.22.0.1/24;
}
}
}
ge-0/0/3 {
description trust;
unit 0 {
family inet {
address 10.1.0.1/16;
}
}
}
ge-0/0/4 {
description untrust;
unit 0 {
family inet {
address 10.2.0.1/16;
}
}
}
lo0 {
description untrust;
unit 0 {
family inet {
address 10.11.0.1/32;
}
}
}
如果完成设备配置，请从配置模式输入 commit 。
结果 （SRX-2）
在配置模式下，输入以下命令以确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明，以便进行更正。
[edit]
user@host# show chassis high-availability
local-id 2 local-ip 10.22.0.2;
peer-id 1 {
peer-ip 10.22.0.1;
interface ge-0/0/2.0;
vpn-profile IPSEC_VPN_ICL;
liveness-detection {
minimum-interval 400;
multiplier 5;
}
}
services-redundancy-group 0 {
peer-id {
1;
}
}
services-redundancy-group 1 {
deployment-type switching;
peer-id {
1;
}
virtual-ip 1 {
ip 10.1.0.200/16;
interface ge-0/0/3.0;
}
virtual-ip 2 {
ip 10.2.0.200/16;
interface ge-0/0/4.0;
}
monitor {
interface {
ge-0/0/3;
ge-0/0/4;
}
}
activeness-priority 1;
}
[edit]
user@host# show security ike
proposal MNHA_IKE_PROP {
description mnha_link_encr_tunnel;
authentication-method pre-shared-keys;
dh-group group14;
authentication-algorithm sha-256;
encryption-algorithm aes-256-cbc;
lifetime-seconds 3600;
}
policy MNHA_IKE_POL {
description mnha_link_encr_tunnel;
proposals MNHA_IKE_PROP ;
pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
}
gateway MNHA_IKE_GW {
ike-policy MNHA_IKE_POL ;
version v2-only;
}
[edit]
user@host# show security ipsec
proposal MNHA_IPSEC_PROP {
description mnha_link_encr_tunnel;
protocol esp;
encryption-algorithm aes-256-gcm;
lifetime-seconds 3600;
}
policy MNHA_IPSEC_POL {
description mnha_link_encr_tunnel;
proposals MNHA_IPSEC_PROP;
}
vpn IPSEC_VPN_ICL {
ha-link-encryption;
ike {
gateway MNHA_IKE_GW;
ipsec-policy MNHA_IPSEC_POL;
}
}
[edit] user@host# show routing-options autonomous-system 65000;
[edit]
user@host# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/4.0;
lo0.0;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/3.0;
}
}
security-zone halink {
host-inbound-traffic {
system-services {
ike;
ping;
high-availability;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/2.0;
}
}
[edit]
user@host# show interfaces
ge-0/0/2 {
description ha_link;
unit 0 {
family inet {
address 10.22.0.2/24;
}
}
}
ge-0/0/3 {
description trust;
unit 0 {
family inet {
address 10.1.0.2/16;
}
}
}
ge-0/0/4 {
description untrust;
unit 0 {
family inet {
address 10.2.0.2/16;
}
}
}
lo0 {
description untrust;
unit 0 {
family inet {
address 10.11.0.1/32;
}
}
}
如果完成设备配置，请从配置模式输入 commit 。
user@host# commit warning: High Availability Mode changed, please reboot the device to avoid undesirable behavior commit complete
验证
确认配置工作正常。
检查多节点高可用性详细信息
目的
查看并验证安全设备上配置的多节点高可用性设置的详细信息。
行动
在作模式下，运行以下命令：
在 SRX-1 上
user@host> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Local-id: 1
Local-IP: 10.22.0.1
HA Peer Information:
Peer Id: 2 IP address: 10.22.0.2 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Cold Sync Status: COMPLETE
Services Redundancy Group: 0
Current State: ONLINE
Peer Information:
Peer Id: 2
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: SWITCHING
Status: ACTIVE
Activeness Priority: 200
Preemption: ENABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 2
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: READY
在 SRX-2 上
user@host> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Local-id: 2
Local-IP: 10.22.0.2
HA Peer Information:
Peer Id: 1 IP address: 10.22.0.1 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Cold Sync Status: COMPLETE
Services Redundancy Group: 0
Current State: ONLINE
Peer Information:
Peer Id: 1
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: SWITCHING
Status: BACKUP
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
意义
从命令输出中验证以下详细信息：
-
本地节点和对等节点详细信息，例如 IP 地址和 ID。
-
该字段
Encrypted: YES表示流量受到保护。 -
字段
Deployment Type: SWITCHING表示默认网关（交换）模式配置，即网络的两端都连接了交换机（第 2 层网络）。 -
该字段
Services Redundancy Group: 1表示该节点上 SRG1（ACTIVE 或 BACKUP）的状态。
检查多节点高可用性对等节点状态
目的
查看并验证对等节点详细信息。
行动
在作模式下，运行以下命令：
SRX-1
user@host> show chassis high-availability peer-info
HA Peer Information:
Peer-ID: 2 IP address: 10.22.0.2 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Cold Sync Status: COMPLETE
Internal Interface: st0.16000
Internal Local-IP: 180.100.1.1
Internal Peer-IP: 180.100.1.2
Internal Routing-instance: __juniper_private1__
Packet Statistics:
Receive Error : 0 Send Error : 0
Packet-type Sent Received
SRG Status Msg 3 4
SRG Status Ack 4 3
Attribute Msg 3 2
Attribute Ack 2 2
SRX-2
user@host> show chassis high-availability peer-info
HA Peer Information:
Peer-ID: 1 IP address: 10.22.0.1 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Cold Sync Status: COMPLETE
Internal Interface: st0.16000
Internal Local-IP: 180.100.1.2
Internal Peer-IP: 180.100.1.1
Internal Routing-instance: __juniper_private1__
Packet Statistics:
Receive Error : 0 Send Error : 0
Packet-type Sent Received
SRG Status Msg 10 8
SRG Status Ack 8 8
Attribute Msg 8 4
Attribute Ack 4 4
意义
从命令输出中验证以下详细信息：
-
对等节点详细信息，例如使用的接口、IP 地址和 ID。
-
加密状态、连接状态、冷同步状态
-
跨节点的数据包统计信息。
检查多节点高可用性服务冗余组
目的
验证 SRG 是否已配置并正常工作。
行动
在作模式下，运行以下命令：
对于 SRG0：
user@host> show chassis high-availability services-redundancy-group 0
Services Redundancy Group: 0
Current State: ONLINE
Peer Information:
Peer Id: 2
对于 SRG1：
user@host> show chassis high-availability services-redundancy-group 1 >
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: SWITCHING
Status: ACTIVE
Activeness Priority: 200
Preemption: ENABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 2
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: READY
Virtual IP Info:
Index: 2
IP: 10.2.0.200/16
VMAC: N/A
Interface: ge-0/0/4.0
Status: INSTALLED
Index: 1
IP: 10.1.0.200/16
VMAC: N/A
Interface: ge-0/0/3.0
Status: INSTALLED
Split-brain Prevention Probe Info:
DST-IP: 10.1.0.200
Routing Instance: default
Status: NOT RUNNING
Result: N/A Reason: N/A
Interface Monitoring:
Status: UP
IF Name: ge-0/0/4 State: Up
IF Name: ge-0/0/3 State: Up
意义
从命令输出中验证以下详细信息：
-
对等节点详细信息，例如部署类型、状态以及活动和备用信号路由。
-
虚拟 IP 信息，例如 IP 地址和虚拟 MAC 地址。
-
IP 监控和 BFD 监控状态。
验证故障切换前后的多节点高可用性状态
目的
在多节点高可用性设置中检查故障转移前后的节点状态变化。
行动
要检查备份节点 （SRX-2） 上的多节点高可用性状态，请在作模式下运行以下命令：
user@host> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Local-id: 2
Local-IP: 10.22.0.2
HA Peer Information:
Peer Id: 1 IP address: 10.22.0.1 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Cold Sync Status: COMPLETE
Services Redundancy Group: 0
Current State: ONLINE
Peer Information:
Peer Id: 1
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: SWITCHING
Status: BACKUP
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
在该 Services Redundancy Group: 1 部分下，您可以看到该 Status: BACKUP 字段。此字段值表示 SRG 1 的状态为备份。
在活动节点（SRX-1 设备）上启动故障切换，然后在备份节点 （SRX-2） 上再次运行命令。
user@host> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Local-id: 2
Local-IP: 10.22.0.2
HA Peer Information:
Peer Id: 1 IP address: 10.22.0.1 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: DOWN
Cold Sync Status: IN PROGRESS
Services Redundancy Group: 0
Current State: ONLINE
Peer Information:
Peer Id: 1
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: SWITCHING
Status: ACTIVE
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: READY
请注意，在该Services Redundancy Group: 1部分下，SRG1 的状态已从 BACKUP 更改为 ACTIVE。
您还可以在该Peer Information部分下查看对等节点详细信息。输出将对等方的状态显示为 BACKUP。
验证机箱间链路 （ICL） 加密状态
目的
验证机箱间链路 （ICL） 状态。
行动
在作模式下，运行以下命令：
user@host> show security ipsec security-associations ha-link-encryption detail
ID: 495002 Virtual-system: root, VPN Name: IPSEC_VPN_ICL
Local Gateway: 10.22.0.1, Remote Gateway: 10.22.0.2
Traffic Selector Name: __IPSEC_VPN_ICL__multi_node__
Local Identity: ipv4(180.100.1.1-180.100.1.1)
Remote Identity: ipv4(180.100.1.2-180.100.1.2)
TS Type: traffic-selector
Version: IKEv2
PFS group: N/A
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.16000, Tunnel MTU: 0, Policy-name: MNHA_IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
HA Link Encryption Mode: Multi-Node
Location: FPC -, PIC -, KMD-Instance -
Anchorship: Thread -
Distribution-Profile: default-profile
Direction: inbound, SPI: 0x000afc7f, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1888 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1248 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 0, PIC 0, KMD-Instance 0
Anchorship: Thread 0
IKE SA Index: 4294966274
Direction: outbound, SPI: 0x000079a0, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1888 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1248 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 0, PIC 0, KMD-Instance 0
Anchorship: Thread 0
IKE SA Index: 4294966274
意义
命令输出提供以下信息：
-
本地网关和远程网关详细信息。
-
PIC 中每个线程的 IPsec SA 对。
-
高可用性链路加密模式（如以下行所示）：
HA Link Encryption Mode: Multi-Node -
使用的身份验证和加密算法
谨慎：
命令输出中显示的 IP 范围 （180.100.1.x） 用作 ICL IPsec 流量选择器。系统动态分配此 IP 范围，不得更改或修改它。此外，BFD（双向转发检测）将自动启用，适用于更广泛的 180.x.x.x IP 范围。
验证链路加密隧道统计信息
目的
验证活动节点和备份节点上的链路加密隧道统计信息。
行动
在作模式下，运行以下命令：
user@host> show security ipsec statistics ha-link-encryption ESP Statistics: Encrypted bytes: 2455540 Decrypted bytes: 1186957 Encrypted packets: 22673 Decrypted packets: 22694 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication failures: 0, Replay errors: 0 ESP authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0 Invalid SPI: 0, TS check fail: 0 Exceeds tunnel MTU: 0 Discarded: 0
意义
如果看到 VPN 中有数据包丢失的问题，可以多次运行 show security ipsec statistics ha-link-encryption 命令以验证加密和解密数据包计数器是否在递增。还应检查其他错误计数器是否也在递增。
show security ike active-peer ha-link-encryption使用命令显示活动对等节点上 ICL 的详细信息。
clear security ipsec statistics ha-link-encryption使用命令清除所有 IPsec 统计信息。