新一代服务 针对 NAT、有状态防火墙和 IDS 流的机箱间高可用性概述
用于下一代服务的 NAT、有状态防火墙和 IDS 流的机箱间高可用性概述
运营商级 NAT、状态防火墙和 IDS 流可配置双机箱冗余数据路径。虽然可以通过使用 AMS 接口在 MX 系列设备中使用机箱内高可用性,但此方法仅在本地处理服务 PIC 故障。如果由于任何原因流量由于路由器中的某些其他故障而切换到备份路由器,则来自服务 PIC 的会话状态将丢失,除非您配置与备份路由器上的服务 PIC 的服务会话状态同步。
机箱间高可用性提供这种同步,并控制冗余对中服务 PIC 之间的切换。机箱间高可用性是主-辅助模型,而不是主动-主动群集。冗余对(当前主节点)中只有一个服务 PIC 接收要服务的流量。
要为 NAT、状态防火墙和 IDS 配置机箱间高可用性,请配置:
有状态同步,将会话状态从主服务器箱上的主服务 PIC 复制到其他机箱上的备份服务 PIC。
机箱间服务冗余,根据受监控的事件控制服务 PIC 冗余对中的主要角色切换。大多数运维人员不希望在不实施服务冗余的情况下采用有状态同步。
好处
机箱间的高可用性可提供从一个机箱上的服务 PIC 到另一个机箱上的服务 PIC 的自动切换,同时为客户流量提供不间断的服务。
示例: 新一代服务 机箱间 NAT 和有状态防火墙的有状态高可用性 (MX-SPC3)
此示例说明如何为有状态防火墙和 NAT 服务配置新一代服务机箱间高可用性。
要求
此示例使用以下硬件和软件组件:
两台带 MX-SPC3 服务卡的 MX480 路由器
Junos OS 19.3R2、19.4R1 或更高版本
概述
两台 MX 3D 路由器的配置相同,以便在机箱发生故障时促进防火墙和 NAT 服务的有状态故障切换。
配置
要在此示例中配置机箱间高可用性,请执行以下任务:
CLI 快速配置
要在路由器上快速配置此示例,请在删除换行符并替换特定于您站点的接口信息后,将以下命令复制粘贴到路由器终端窗口中。
以下配置适用于机箱 1。
[edit] set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.2 set interfaces vms-4/0/0 redundancy-options routing-instance HA set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.1/32 set interfaces vms-4/0/0 unit 20 family inet set interfaces vms-4/0/0 unit 20 service-domain inside set interfaces vms-4/0/0 unit 30 family inet set interfaces vms-4/0/0 unit 30 service-domain outside set interfaces ge-2/0/0 vlan-tagging set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.1/24 set routing-instances HA instance-type vrf set routing-instances HA interface ge-2/0/0.0 set routing-instances HA interface vms-4/0/0.10 set routing-instances HA route-distinguisher 1:1 set policy-options policy-statement dummy term 1 then reject set routing-instances HA vrf-import dummy set routing-instances HA vrf-export dummy set routing-instances HA routing-options static route route 5.5.5.1/32 next-hop vms-4/0/0.10 set routing-instances HA routing-options static route route 5.5.5.2/32 next-hop 20.1.1.2 set services nat pool p2 address 32.0.0.0/24 set services nat pool p2 port automatic random-allocation set services nat pool p2 address-allocation round-robin set services nat rule r2 match-direction input set services nat rule r2 term t1 from source-address 129.0.0.0/8 set services nat rule r2 term t1 from source-address 128.0.0.0/8 set services nat rule r2 term t1 then translated source-pool p2 set services nat rule r2 term t1 then translated translation-type napt-44 set services nat rule r2 term t1 then translated address-pooling paired set services nat rule r2 term t1 then syslog set services stateful-firewall rule r2 match-direction input set services stateful-firewall rule r2 term t1 from source-address any-unicast set services stateful-firewall rule r2 term t1 then accept set services stateful-firewall rule r2 term t1 then syslog set services service-set ss2 replicate-services replication-threshold 180 set services service-set ss2 replicate-services stateful-firewall set services service-set ss2 replicate-services nat set services service-set ss2 stateful-firewall-rules r2 set services service-set ss2 nat-rules r2 set services service-set ss2 next-hop-service inside-service-interface vms-4/0/0.20 set services service-set ss2 next-hop-service outside-service-interface vms-4/0/0.30 set services service-set ss2 syslog host local class session-logs set services service-set ss2 syslog host local class stateful-firewall-logs set services service-set ss2 syslog host local class nat-logs
以下配置适用于机箱 2。机箱 1 和机箱 2 的 NAT、状态防火墙和服务集信息必须相同。
set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.1 set interfaces vms-4/0/0 redundancy-options routing-instance HA set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.2/32 set interfaces vms-4/0/0 unit 20 family inet set interfaces vms-4/0/0 unit 20 service-domain inside set interfaces vms-4/0/0 unit 30 family inet set interfaces vms-4/0/0 unit 30 service-domain outside set interfaces ge-2/0/0 vlan-tagging set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.2/24 set routing-instances HA instance-type vrf set routing-instances HA interface ge-2/0/0.0 set routing-instances HA interface vms-4/0/0.10 set routing-instances HA route-distinguisher 1:1 set policy-options policy-statement dummy term 1 then reject set routing-instances HA vrf-import dummy set routing-instances HA vrf-export dummy set routing-instances HA routing-options static route 5.5.5.2/32 next-hop vms-4/0/0.10 set routing-instances HA routing-options static route 5.5.5.1/32 next-hop 20.1.1.1 set services nat pool p2 address 32.0.0.0/24 set services nat pool p2 port automatic random-allocation set services nat pool p2 address-allocation round-robin set services nat rule r2 match-direction input set services nat rule r2 term t1 from source-address 129.0.0.0/8 set services nat rule r2 term t1 from source-address 128.0.0.0/8 set services nat rule r2 term t1 then translated source-pool p2 set services nat rule r2 term t1 then translated translation-type napt-44 set services nat rule r2 term t1 then translated address-pooling paired set services nat rule r2 term t1 then syslog set services stateful-firewall rule r2 match-direction input set services stateful-firewall rule r2 term t1 from source-address any-unicast set services stateful-firewall rule r2 term t1 then accept set services stateful-firewall rule r2 term t1 then syslog set services service-set ss2 replicate-services replication-threshold 180 set services service-set ss2 replicate-services stateful-firewall set services service-set ss2 replicate-services nat set services service-set ss2 stateful-firewall-rules r2 set services service-set ss2 nat-rules r2 set services service-set ss2 next-hop-service inside-service-interface vms-4/0/0.20 set services service-set ss2 next-hop-service outside-service-interface vms-4/0/0.30 set services service-set ss2 syslog host local class session-logs set services service-set ss2 syslog host local class stateful-firewall-logs set services service-set ss2 syslog host local class nat-logs
配置机箱 1 的接口。
分步过程
除以下服务 PIC 选项外,每个 HA 路由器对的接口配置均相同:
redundancy-options redundancy-peer ipaddress address
unit unit-number family inet address address
除 0 以外的包含选项的单元的ip-address-owner service-plane
要素
要配置接口,请执行以下操作:
在机箱 1 上配置冗余服务 PIC。
[edit interfaces} user@host# set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.2 user@host# set interfaces vms-4/0/0 redundancy-options routing-instance HA user@host# set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane user@host# set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.1/32 user@host# set interfaces vms-4/0/0 unit 20 family inet user@host# set interfaces vms-4/0/0 unit 20 service-domain inside user@host# set interfaces vms-4/0/0 unit 30 family inet user@host# set interfaces vms-4/0/0 unit 30 service-domain outside
为机箱 1 配置用作同步流量的机箱间链路的接口。
user@host# set interfaces ge-2/0/0 vlan-tagging user@host# set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.1/24
根据需要配置其余接口。
结果
user@host# show interfaces ge-2/0/0 { vlan-tagging; unit 0 { vlan-id 100; family inet { address 20.1.1.1/24; } } } vms-4/0/0 { redundancy-options { redundancy-peer { ipaddress 5.5.5.2; } routing-instance HA; } unit 10 { ip-address-owner service-plane; family inet { address 5.5.5.1/32; } } unit 20 { family inet; family inet6; service-domain inside; } unit 30 { family inet; family inet6; service-domain outside; } } }
配置机箱 1 的路由信息
分步过程
此示例不包括详细的路由配置。机箱之间的 HA 同步流量需要路由实例,如下所示:
为机箱 1 配置路由实例。
user@host# set routing-instances HA instance-type vrf user@host# set routing-instances HA interface ge-2/0/0.0 user@host# set routing-instances HA interface vms-4/0/0.10 user@host# set routing-instances HA route-distinguisher 1:1 user@host# set policy-options policy-statement dummy term 1 then reject user@host# set routing-instances HA vrf-import dummy user@host# set routing-instances HA vrf-export dummy user@host# set routing-instances HA routing-options static route route 5.5.5.1/32 next-hop vms-4/0/0.10 user@host# set routing-instances HA routing-options static route route 5.5.5.2/32 next-hop 20.1.1.2
结果
user@host# show routing-instances HA { instance-type vrf; interface ge-2/0/0.0; interface vms-4/0/0.10; route-distinguisher 1:1; vrf-import dummy; vrf-export dummy; routing-options { static { route 5.5.5.1/32 next-hop vms-4/0/0.10; route 5.5.5.2/32 next-hop 20.1.1.2; } } }
为机箱 1 配置 NAT 和有状态防火墙
分步过程
在两个路由器上以相同的方式配置 NAT 和有状态防火墙。要配置 NAT 和有状态防火墙,请执行以下操作:
根据需要配置 NAT。
user@host# set services nat pool p2 address 32.0.0.0/24 user@host# set services nat pool p2 port automatic random-allocation user@host# set services nat pool p2 address-allocation round-robin user@host# set services nat rule r2 match-direction input user@host# set services nat rule r2 term t1 from source-address 129.0.0.0/8 user@host# set services nat rule r2 term t1 from source-address 128.0.0.0/8 user@host# set services nat rule r2 term t1 then translated source-pool p2 user@host# set services nat rule r2 term t1 then translated translation-type napt-44 user@host# set services nat rule r2 term t1 then translated address-pooling paired user@host# set services nat rule r2 term t1 then syslog
根据需要配置有状态防火墙。
user@host# set services stateful-firewall rule r2 match-direction input user@host# set services stateful-firewall rule r2 term t1 from source-address any-unicast user@host# set services stateful-firewall rule r2 term t1 then accept user@host# set services stateful-firewall rule r2 term t1 then syslog
结果
user@host# show services nat nat { pool p2 { address 32.0.0.0/24; port { automatic { random-allocation; } } address-allocation round-robin; } rule r2 { match-direction input; term t1 { from { source-address { 129.0.0.0/8; 128.0.0.0/8; } } then { translated { source-pool p2; translation-type { napt-44; } address-pooling paired; } syslog; } } } } }
user@host show services stateful-firewell rule r2 { match-direction input; term t1 { from { source-address { any-unicast; } } then { accept; syslog; } } }
配置服务集
分步过程
在两台路由器上以相同的方式配置服务集。要配置服务集,请执行以下操作:
配置服务集复制选项。
user@host# set services service-set ss2 replicate-services replication-threshold 180 user@host# set services service-set ss2 replicate-services stateful-firewall user@host# set services service-set ss2 replicate-services nat
为服务集配置对 NAT 和有状态防火墙规则的引用。
user@host# set services service-set ss2 stateful-firewall-rules r2 user@host# set services service-set ss2 nat-rules r2
在 vms-PIC 上配置下一跃点服务接口。
user@host# set services service-set ss2 next-hop-service inside-service-interface vms-4/0/0.20 user@host# set services service-set ss2 next-hop-service outside-service-interface vms-4/0/0.30
配置所需的日志记录选项。
user@host# set services service-set ss2 syslog host local class session-logs user@host# set services service-set ss2 syslog host local class stateful-firewall-logs user@host# set services service-set ss2 syslog host local class nat-logs
结果
user@host# show services service-set ss2 syslog { host local { class { session-logs; inactive: stateful-firewall-logs; nat-logs; } } } replicate-services { replication-threshold 180; stateful-firewall; nat; } stateful-firewall-rules r2; inactive: nat-rules r2; next-hop-service { inside-service-interface vms-3/0/0.20; outside-service-interface vms-3/0/0.30; } }
为机箱 2 配置接口
分步过程
除以下服务 PIC 选项外,每个 HA 路由器对的接口配置均相同:
redundancy-options redundancy-peer ipaddress address
unit unit-number family inet address address
除 0 以外的包含选项的单元的ip-address-owner service-plane
要素
在机箱 2 上配置冗余服务 PIC。
这些
redundancy-peer ipaddress
指向包含语句的机箱上ip-address-owner service-plane
机箱上的 vms-4/0/0 上的单元(单元 10)的地址。[edit interfaces} set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.1 user@host# set interfaces vms-4/0/0 redundancy-options routing-instance HA user@host# set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane user@host# set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.2/32 user@host# set interfaces vms-4/0/0 unit 20 family inet user@host# set interfaces vms-4/0/0 unit 20 service-domain inside user@host# set interfaces vms-4/0/0 unit 30 family inet user@host# set interfaces vms-4/0/0 unit 30 service-domain outside
为机箱 2 配置用作同步流量的机箱间链路的接口
user@host# set interfaces ge-2/0/0 vlan-tagging user@host# set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.2/24
根据需要为机箱 2 配置其余接口。
结果
user@host# show interfaces vms-4/0/0 { redundancy-options { redundancy-peer { ipaddress 5.5.5.1; } routing-instance HA; } unit 0 { family inet; } unit 10 { ip-address-owner service-plane; family inet { address 5.5.5.2/32; } } ge-2/0/0 { vlan-tagging; unit 0 { vlan-id 100; family inet { address 20.1.1.2/24; } } unit 10 { vlan-id 10; family inet { address 2.10.1.2/24; }
配置机箱 2 的路由信息
分步过程
此示例不包括详细的路由配置。两个机箱之间的 HA 同步流量需要路由实例,此处包括一个路由实例。
为机箱 2 配置路由实例。
user@host# set routing-instances HA instance-type vrf user@host# set routing-instances HA interface ge-2/0/0.0 user@host# set routing-instances HA interface vms-4/0/0.10 user@host# set routing-instances HA route-distinguisher 1:1 user@host# set policy-options policy-statement dummy term 1 then reject user@host# set routing-instances HA vrf-import dummy user@host# set routing-instances HA vrf-export dummy user@host# set routing-instances HA routing-options static route 5.5.5.2/32 next-hop vms-4/0/0.10 user@host# set routing-instances HA routing-options static route 5.5.5.1/32 next-hop 20.1.1.1
注意:以下配置步骤与机箱 1 所示的步骤 相同 。
配置 NAT 和有状态防火墙
配置服务集
结果
user@host# show services routing-instances HA { instance-type vrf; interface xe-2/2/0.0; interface vms-4/0/0.10; route-distinguisher 1:1; vrf-import dummy; vrf-export dummy; routing-options { static { route 5.5.5.2/32 next-hop vms-4/0/0.10; route 5.5.5.1/32 next-hop 20.1.1.1; } }