示例：在分支机构中配置单个 SRX 系列设备
此示例提供了在分支机构的单个 SRX 系列设备上进行配置的分步过程和验证机箱群集的命令。
要求
此示例使用以下硬件和软件组件：
SRX240 服务网关
Junos OS 12.1 或更高版本
注意：
此配置示例已使用列出的软件版本进行了测试，并假定适用于所有更高版本。
概述
要实施链路级高可用性部署，每个分支机构都需要为每个数据中心提供两个 WAN 连接和两个 IPsec 虚拟专用网络 （VPN） 隧道。流量在每对隧道之间进行负载平衡。每当流量定向到给定数据中心时，会话都会以轮询方式通过通向该数据中心的每个 IPsec 隧道进行负载平衡。反过来，隧道的配置方式是，每个隧道使用不同的出口链路，从而平衡 VPN 流量的上游链路。
配置
在 SRX 系列设备上配置冗余 IPsec VPN 隧道
分步过程
要配置冗余 IPsec VPN 隧道，请执行以下操作：
指定全局 VPN 设置。
[edit] user@host# set security ipsec vpn-monitor-options interval 5 user@host# set security ipsec vpn-monitor-options threshold 5
为主模式、预定义标准提议集和预共享密钥配置 IKE 策略。
[edit] user@host# set security ike policy preShared mode main user@host# set security ike policy preShared proposal-set standard user@host# set security ike policy preShared pre-shared-key ascii-text "$9$5Q69tuORcypuxNVwg469CA1RvWL" user@host# set security ike policy preShared_2 mode main user@host# set security ike policy preShared_2 proposal-set standard user@host# set security ike policy preShared_2 pre-shared-key ascii-text "$9$-9V24JGDkmfZGCt0BEh24oaikFn/"
使用 对等方 IP 地址、IKE 策略和传出接口配置 IKE 网关。
[edit] user@host# set security ike gateway DCA_1 ike-policy preShared user@host# set security ike gateway DCA_1 address 4.4.4.2 user@host# set security ike gateway DCA_1 external-interface ge-0/0/4.0 user@host# set security ike gateway DCA_2 ike-policy preShared_2 user@host# set security ike gateway DCA_2 address 5.5.5.2 user@host# set security ike gateway DCA_2 external-interface ge-0/0/5.0
配置 IPsec 策略和隧道接口绑定
st0.0在此示例中，请使用标准提议集。但是，您可以创建唯一的提议，然后根据需要在 IPsec 策略中指定该建议。
[edit] user@host# set security ipsec policy std proposal-set standard user@host# set security ipsec vpn DCA_1 bind-interface st0.0 user@host# set security ipsec vpn DCA_1 vpn-monitor optimized user@host# set security ipsec vpn DCA_1 ike gateway DCA_1 user@host# set security ipsec vpn DCA_1 ike no-anti-replay user@host# set security ipsec vpn DCA_1 ike proxy-identity local 0.0.0.0/0 user@host# set security ipsec vpn DCA_1 ike proxy-identity remote 0.0.0.0/0 user@host# set security ipsec vpn DCA_1 ike proxy-identity service any user@host# set security ipsec vpn DCA_1 ike ipsec-policy std user@host# set security ipsec vpn DCA_1 establish-tunnels immediately
配置隧道接口的绑定
st0.1[edit] user@host# set security ipsec vpn DCA_2 bind-interface st0.1 user@host# set security ipsec vpn DCA_2 vpn-monitor optimized user@host# set security ipsec vpn DCA_2 ike gateway DCA_2 user@host# set security ipsec vpn DCA_2 ike no-anti-replay user@host# set security ipsec vpn DCA_2 ike proxy-identity local 0.0.0.0/0 user@host# set security ipsec vpn DCA_2 ike proxy-identity remote 0.0.0.0/0 user@host# set security ipsec vpn DCA_2 ike proxy-identity service any user@host# set security ipsec vpn DCA_2 ike ipsec-policy std user@host# set security ipsec vpn DCA_2 establish-tunnels immediately
同时配置和
st0.0st0.1接口多点。[edit] user@host# set interfaces st0 unit 0 multipoint user@host# set interfaces st0 unit 0 family inet mtu 1500 user@host# set interfaces st0 unit 0 family inet address 10.255.1.5/24 user@host# set interfaces st0 unit 1 multipoint user@host# set interfaces st0 unit 1 family inet mtu 1500 user@host# set interfaces st0 unit 1 family inet address 10.255.2.5/24
为两个隧道接口配置静态路由。
[edit] user@host# set routing-options static route 0.0.0.0/0 next-hop 10.204.115.254 user@host# set routing-options static route 172.16.0.0/24 next-hop 10.255.1.254 user@host# set routing-options static route 172.16.0.0/24 next-hop 10.255.2.254 user@host# set routing-options forwarding-table export load-balancing-policy user@host# set policy-options policy-statement load-balancing-policy then load-balance per-packet
配置管理区域。
[edit] user@host# set security zones functional-zone management interfaces ge-0/0/2.0 user@host# set security zones functional-zone management host-inbound-traffic system-services all user@host# set security zones functional-zone management host-inbound-traffic protocols all
配置信任区域。
[edit] user@host# set security zones security-zone trust address-book address 0.0.0.0/0 0.0.0.0/0 user@host# set security zones security-zone trust host-inbound-traffic system-services any-service user@host# set security zones security-zone trust host-inbound-traffic protocols all
配置不信任区域。
[edit] user@host# set security zones security-zone untrust host-inbound-traffic system-services all user@host# set security zones security-zone untrust host-inbound-traffic protocols all user@host# set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services any-service user@host# set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic protocols all user@host# set security zones security-zone untrust interfaces lo0.0 user@host# set security zones security-zone untrust interfaces ge-0/0/1.0 user@host# set security zones security-zone untrust interfaces ge-0/0/4.0 user@host# set security zones security-zone untrust interfaces ge-0/0/5.0 user@host# set security zones security-zone VPN host-inbound-traffic system-services all
通过分配接口和主机入站服务来配置安全区域。
[edit] user@host# set security zones security-zone VPN host-inbound-traffic system-services all user@host# set security zones security-zone VPN host-inbound-traffic protocols all user@host# set security zones security-zone VPN interfaces st0.0 user@host# set security zones security-zone VPN interfaces st0.1
结果
在操作模式下，输入 show configuration | no-more 命令确认您的配置。如果输出未显示预期的配置，请重复此示例中的说明以更正配置。
user@host>show configuration | no-more
## Last commit: 2013-05-28 20:10:49 UTC by root
version 12.1R5.5;
system {
root-authentication {
encrypted-password "$1$ltXYoZky$Gg3OHOmBGCBKwPET6ijPw0"; ## SECRET-DATA
}
name-server {
8.8.8.8;
}
services {
web-management {
http;
}
}
syslog {
file default-message {
any any;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.204.115.166/24;
address 30.30.30.1/24;
}
}
}
ge-0/0/1 {
unit 0 {
family inet {
address 10.10.99.1/30;
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 20.20.20.1/24;
}
}
}
ge-0/0/4 {
unit 0 {
family inet {
address 4.4.4.1/30;
}
}
}
ge-0/0/5 {
unit 0 {
family inet {
address 5.5.5.1/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 172.16.1.1/24;
}
}
}
st0 {
unit 0 {
multipoint;
family inet {
mtu 1500;
address 10.255.1.5/24;
}
}
unit 1 {
multipoint;
family inet {
mtu 1500;
address 10.255.2.5/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 10.204.115.254;
route 172.16.0.0/24 next-hop [ 10.255.1.254 10.255.2.254 ];
}
forwarding-table {
export load-balancing-policy;
}
}
policy-options {
policy-statement load-balancing-policy {
then {
load-balance per-packet;
}
}
}
security {
ike {
policy preShared {
mode main;
proposal-set standard;
pre-shared-key ascii-text "$9$5Q69tuORcypuxNVwg469CA1RvWL"; ## SECRET-DATA
}
policy preShared_2 {
mode main;
proposal-set standard;
pre-shared-key ascii-text "$9$-9V24JGDkmfZGCt0BEh24oaikFn/"; ## SECRET-DATA
}
gateway DCA_1 {
ike-policy preShared;
address 4.4.4.2;
external-interface ge-0/0/4.0;
}
gateway DCA_2 {
ike-policy preShared_2;
address 5.5.5.2;
external-interface ge-0/0/5.0;
}
}
ipsec {
vpn-monitor-options {
interval 5;
threshold 5;
}
policy std {
proposal-set standard;
}
vpn DCA_1 {
bind-interface st0.0;
vpn-monitor {
optimized;
}
ike {
gateway DCA_1;
no-anti-replay;
proxy-identity {
local 0.0.0.0/0;
remote 0.0.0.0/0;
service any;
}
ipsec-policy std;
}
establish-tunnels immediately;
}
vpn DCA_2 {
bind-interface st0.1;
vpn-monitor {
optimized;
}
ike {
gateway DCA_2;
no-anti-replay;
proxy-identity {
local 0.0.0.0/0;
remote 0.0.0.0/0;
service any;
}
ipsec-policy std;
}
establish-tunnels immediately;
}
}
policies {
default-policy {
permit-all;
}
}
zones {
functional-zone management {
interfaces {
ge-0/0/2.0;
}
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
any-service;
}
protocols {
all;
}
}
}
lo0.0;
ge-0/0/1.0;
ge-0/0/4.0;
ge-0/0/5.0;
}
}
security-zone trust {
address-book {
address 0.0.0.0/0 0.0.0.0/0;
}
host-inbound-traffic {
system-services {
any-service;
}
protocols {
all;
}
}
}
security-zone VPN {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
st0.0;
st0.1;
}
}
}
}
验证
确认配置工作正常。
验证隧道接口
目的
验证隧道接口配置是否正常工作。
行动
在操作模式下，输入 show interfaces terse | match st 命令。
user@host>show interfaces terse | match st
st0 up up st0.0 up up inet 10.255.1.5/24 st0.1 up up inet 10.255.2.5/24
意义
该 show interfaces terse | match st 命令将显示隧道接口的状态。
验证 IKE 状态
目的
验证 IKE 状态。
行动
在操作模式下，输入 show security ike sa 命令。
user@host>show security ike sa
Index State Initiator cookie Responder cookie Mode Remote Address 1898257 UP c3cc256b779db5ec 258300201eaba783 Main 5.5.5.2 1898255 UP ca13acf3daceb369 0921e2e7abf91a05 Main 4.4.4.2
意义
该 show security ike sa 命令会列出所有活动的 IKE 第 1 阶段 SA。如果未列出任何 SA，则第 1 阶段建立存在问题。检查配置中的 IKE 策略参数和外部接口设置。
如果列出了 SA，请查看以下信息：
索引 - 此值对于每个 IKE SA 都是唯一的，您可以在命令中
show security ike security-associations index detail使用它来获取有关 SA 的更多信息。远程地址 - 验证远程 IP 地址是否正确。
状态
UP—已建立第 1 阶段 SA。
DOWN — 建立第 1 阶段 SA 时出现问题。
模式 - 验证是否使用了正确的模式。
验证 IPsec 安全关联
目的
验证 IPsec 安全关联。
行动
在操作模式下，输入 show security ipsec sa 命令。
user@host>show security ipsec sa
Total active tunnels: 2 ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway <131073 ESP:3des/sha1 3ca3386b 2492/ unlim U root 500 4.4.4.2 >131073 ESP:3des/sha1 be66b350 2492/ unlim U root 500 4.4.4.2 <131074 ESP:3des/sha1 84080019 2491/ unlim U root 500 5.5.5.2 >131074 ESP:3des/sha1 deabdb54 2491/ unlim U root 500 5.5.5.2
意义
输出指示：
有一个已配置的 IPsec SA 对可用。端口号 500 表示使用的是标准 IKE 端口。否则，它是网络地址转换遍历 （NAT-T）、4500 或随机高端口。
安全参数索引 （SPI） 用于两个方向。SA 的生存期或使用限制以秒或千字节表示。在输出中，2492/unlim 表示第 2 阶段生存期设置为在 2492 秒后过期，并且没有指定的生存期大小。
ID 号显示每个 IPsec SA 的唯一索引值。
验证路由条目
目的
验证路由表中的路由条目。
行动
在操作模式下，输入 show route 命令。
user@host>show route
inet.0: 19 destinations, 19 routes (19 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0 *[Static/5] 10w5d 22:23:53
> to 10.204.115.254 via ge-0/0/0.0
4.4.4.0/30 *[Direct/0] 00:18:45
> via ge-0/0/4.0
4.4.4.1/32 *[Local/0] 00:18:45
Local via ge-0/0/4.0
5.5.5.0/30 *[Direct/0] 00:18:45
> via ge-0/0/5.0
5.5.5.1/32 *[Local/0] 00:18:45
Local via ge-0/0/5.0
10.10.99.1/32 *[Local/0] 10w5d 22:24:03
Reject
10.204.115.0/24 *[Direct/0] 10w5d 22:23:53
> via ge-0/0/0.0
10.204.115.166/32 *[Local/0] 10w5d 22:24:04
Local via ge-0/0/0.0
10.255.1.0/24 *[Direct/0] 00:18:40
> via st0.0
10.255.1.5/32 *[Local/0] 4d 02:50:20
Local via st0.0
10.255.2.0/24 *[Direct/0] 00:18:40
> via st0.1
10.255.2.5/32 *[Local/0] 4d 02:50:20
Local via st0.1
20.20.20.0/24 *[Direct/0] 03:46:19
> via ge-0/0/2.0
20.20.20.1/32 *[Local/0] 03:46:19
Local via ge-0/0/2.0
30.30.30.0/24 *[Direct/0] 03:46:19
> via ge-0/0/0.0
30.30.30.1/32 *[Local/0] 03:46:19
Local via ge-0/0/0.0
172.16.0.0/24 *[Static/5] 00:18:40
> to 10.255.1.254 via st0.0
to 10.255.2.254 via st0.1
172.16.1.0/24 *[Direct/0] 00:15:55
> via lo0.0
172.16.1.1/32 *[Local/0] 00:15:55
Local via lo0.0
意义
输出指示有 19 个路由，并且所有路由都处于活动状态。