配置具有 LTE 备份的 WAN 链路（主动/主动模式）到互联网
此示例说明如何在 SRX300 系列设备或SRX550M的主动/主动设置中配置具有 LTE 备份的 WAN 链路。
要求
此示例包含以下硬件和软件组件：
一台 SRX300 系列设备（SRX320、SRX340、SRX345、SRX380）或SRX550M
一个用于 SRX300 系列的 LTE 小型 PIM
一张订阅数据服务的SIM卡
Junos OS 19.4R1 或更高版本
我们已在装有 Junos OS 19.4R1 的 SRX320 设备上测试了此配置。
概述
在此示例中，我们将设置分支机构 SRX320 系列设备，为现场员工提供有线和无线互联网以及内联网访问。我们还为访客设备提供无线互联网接入。主链路连接通过 MPLS 提供。宽带互联网接入通过以太网，备用连接通过LTE网络。两个链路配置为主动/主动模式;除非主链路和辅助链路均关闭，否则不会通过 LTE 调制解调器路由任何流量。
在本例中，我们使用 图 1 中所示的拓扑结构。
图 1：具有冗余互联网连接的分支机构示例
在拓扑中：
LTE Mini-PIM 安装在 SRX 系列设备的插槽 1 中。
SIM 卡安装在 LTE Mini-PIM 的插槽 1 中。
主 MPLS 链路连接到接口 ge-0/0/6。
宽带互联网链路连接到接口 ge-0/0/7。
接口 cl-1/0/0 标识调制解调器小型 PIM。
蜂窝网络上的链路在接口 dl0.0 上终止。
有线端口 ge-0/0/6 和 ge-0/0/7 通过 DHCP 接收其 IP 地址、网络掩码和默认网关。
LTE 接口（cl-1/0/0 和 dl0.0）接收蜂窝服务提供商提供的 IP 地址、网络掩码和默认网关。
在此示例中，我们使用在 SRX320 设备上配置的两个安全区域不信任和信任。通过将接口分离到安全区域中，可以分离流量并减轻公司内部网面临的风险。安全区域还允许您清晰、简化地实施安全策略。不信任区域托管有权访问互联网的接口。企业内部网中的内部接口位于信任区域中。请参阅 图 2 和 表 1 ，了解接口、安全区域和安全策略配置。
图 2 显示了每个安全区域中的接口。
图 2：安全区域
表 1 显示了区域之间流量的安全策略的预期行为。
从区域 |
到区域 |
允许流量的安全策略行为 |
|---|---|---|
信任 |
信任 |
是的 |
不信任 |
不信任 |
不 |
信任 |
不信任 |
是的 |
不信任 |
信任 |
仅信任启动。 允许在信任区域中启动的流量和返回流量。 |
表 2 汇总了接口的 VLAN 信息和 IP 地址信息。
接口 |
Vlan |
IP 地址 |
网络掩码 |
|---|---|---|---|
DL0.0 |
- |
Dhcp |
- |
ge-0/0/6 |
|
Dhcp |
255.255.255.0 |
ge-0/0/7 |
- |
Dhcp |
- |
IRB.0 |
3 |
192.168.1.1 |
255.255.255.0 |
让我们考虑表 3 中的应用。为了便于说明，假设Office365，Salesforce和Zoom应用程序是业务关键型应用程序，我们将主要通过MPLS链接路由它们。我们也优先考虑这些应用，而不是LTE链路。其余应用将使用宽带互联网接入链路。我们仅为关键业务应用程序保留 LTE 备份链路。因此，当 LTE 连接是唯一可用的连接时，将无法访问非关键应用程序。
应用 |
主链路 |
辅助链路 |
关键应用？ |
|---|---|---|---|
Office365 |
Mpls |
宽带互联网 |
是的 |
Salesforce |
Mpls |
宽带互联网 |
是的 |
缩放 |
Mpls |
宽带互联网 |
是的 |
松弛 |
宽带互联网 |
Mpls |
不 |
转到会议 |
宽带互联网 |
Mpls |
不 |
Dropbox |
宽带互联网 |
Mpls |
不 |
Skype |
宽带互联网 |
Mpls |
不 |
Youtube |
宽带互联网 |
Mpls |
不 |
配置
程序
分步过程
此配置示例中的步骤是从下层到上层逻辑构建的。
设置调制解调器中 SIM 卡 （LTE-MPIM） 的接入点名称 （APN）。
user@host>request modem wireless create-profile profile-id 10 access-point-name broadband cl-1/0/0 slot 1为网络的 LAN 段创建通用 VLAN。在此示例中，我们使用 VLAN ID 3 并将其称为 VLAN 信任。
user@host#set vlans vlan-trust vlan-id 3 set vlans vlan-trust l3-interface irb.0定义 AppQoS 规则和应用程序匹配标准。
set class-of-service application-traffic-control rule-sets critical_app_rs rule 1 match application-any set class-of-service application-traffic-control rule-sets critical_app_rs rule 1 then log
创建安全策略以允许信任区域和不信任区域之间的流量。请确保在策略中包含所需的网段和应用程序。
set security policies from-zone trust to-zone untrust policy allow-in-zone match source-address 192.168.1.0/24 set security policies from-zone trust to-zone untrust policy allow-in-zone match destination-address any set security policies from-zone trust to-zone untrust policy allow-in-zone match application any set security policies from-zone trust to-zone untrust policy allow-in-zone then permit application-services application-traffic-control rule-set critical_app_rs
创建安全策略以允许信任区域中设备之间的流量。请确保在策略中包含所需的网段和应用程序。
set security policies from-zone trust to-zone trust policy allow-in-zone match source-address 192.168.1.0/24 set security policies from-zone trust to-zone trust policy allow-in-zone match destination-address 192.168.1.0/24 set security policies from-zone trust to-zone trust policy allow-in-zone match application any set security policies from-zone trust to-zone trust policy allow-in-zone then permit
为 LAN 网段上连接的设备创建唯一的 DHCP 服务器组。
set system services dhcp-local-server group jdhcp -group interface irb.0
创建要分配给 LAN 网段中的设备的 IP 地址池。对于此 IP 地址池，请指定最低和最高 IP 地址、DNS 服务器的 IP 地址以及默认网关（接口）
irb.0的 IP 地址。默认网关通常是 irb.0 接口。set access address-assignment pool junosDHCPPool family inet network 192.168.1.0/24 set access address-assignment pool junosDHCPPool family inet range junosRange low 192.168.1.10 set access address-assignment pool junosDHCPPool family inet range junosRange high 192.168.1.240 set access address-assignment pool junosDHCPPool family inet dhcp-attributes name-server 8.8.8.8 set access address-assignment pool junosDHCPPool family inet dhcp-attributes name-server 1.1.1.1 set access address-assignment pool junosDHCPPool family inet dhcp-attributes propagate-settings ge-0/0/7 set access address-assignment pool junosDHCPPool family inet dhcp-attributes router 192.168.1.1
创建源 NAT 以将 NAT 应用于信任区域中的外部接口设备。
set security nat source rule-set trust-to-untrust from zone trust set security nat source rule-set trust-to-untrust to zone untrust set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 192.168.1.0/24 set security nat source rule-set trust-to-untrust rule r1 then source-nat interface
为主互联网链路配置接口。设置接口以通过 DHCP 协议获取配置。
set interfaces ge-0/0/7 unit 0 description "WAN Interface 1 - Primary" set interfaces ge-0/0/7 unit 0 family inet dhcp vendor-id Juniper-srx320
配置 LTE-MPIM 接口。确保包含 SIM 卡的 SIM 卡插槽设置为活动状态。
set interfaces cl-1/0/0 description “WAN Interfaces 2 – Backup” set interfaces cl-1/0/0 dialer-options pool 1 priority 100 set interfaces cl-1/0/0 act-sim 1 set interfaces cl-1/0/0 cellular-options sim 1 radio-access automatic
配置拨号器接口。
set interfaces dl0 unit 0 family inet negotiate-address set interfaces dl0 unit 0 family inet6 negotiate-address set interfaces dl0 unit 0 dialer-options pool 1 set interfaces dl0 unit 0 dialer-options dial-string "*99#"
将 LAN 接口 ge-0/0/0、ge-0/0/1 和其他接口配置为信任 VLAN 中的交换接口。信任 VLAN 有效地将接口添加到信任区域。我们展示了一个接口的配置。重复相同的步骤以配置所有 LAN 分段接口。
set interface ge-0/0/0 unit 0 family ethernet-switching vlan members vlan-trust
允许在信任区域中使用必要的协议。此步骤可确保网络的 LAN 段正常运行。
set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces irb.0
允许在不受信任区域中使用必要的协议。
set security zones security-zone untrust screen untrust-screen set security zones security-zone untrust interfaces ge-0/0/7.0 host-inbound-traffic system-services dhcp set security zones security-zone untrust interfaces ge-0/0/7.0 host-inbound-traffic system-services tftp set security zones security-zone untrust interfaces ge-0/0/7.0 host-inbound-traffic system-services netconf set security zones security-zone untrust interfaces ge-0/0/6.0 host-inbound-traffic system-services dhcp set security zones security-zone untrust interfaces ge-0/0/6.0 host-inbound-traffic system-services tftp set security zones security-zone untrust interfaces ge-0/0/6.0 host-inbound-traffic system-services netconf set security zones security-zone untrust interfaces dl0.0 host-inbound-traffic system-services tftp
为 表 3 中指定的每个应用程序和每个链路创建时间性能监控探针。
在此步骤中，我们将为 Office365 应用程序设置
icmp-ping探测类型。Office365 使用 MPLS 链接。此探测测试探测与 Office365 使用的 IP 地址 40.97.223.114 的连接。探针测试运行 5 次，间隔 6 秒。不应违反的预期阈值是 5 次连续测试丢失和/或返回传输时间 （RTT） 为 300000 微秒。接口 ge-0/0/6 上的网关 IP 地址为 192.168.220.1set services rpm probe office365_rpm_primary test office365_test_primary probe-type icmp-ping set services rpm probe office365_rpm_primary test office365_test_primary target address 40.97.223.114 set services rpm probe office365_rpm_primary test office365_test_primary probe-count 5 set services rpm probe office365_rpm_primary test office365_test_primary probe-interval 6 set services rpm probe office365_rpm_primary test office365_test_primary thresholds successive-loss 5 set services rpm probe office365_rpm_primary test office365_test_primary rtt 300000 set services rpm probe office365_rpm_primary test office365_test_primary destination-interface ge-0/0/6.0 set services rpm probe office365_rpm_primary test office365_test_primary next-hop 192.168.220.1
为同一应用程序创建第二个探测器。请务必使用此应用程序的辅助接口详细信息。宽带互联网链路上默认网关的 IP 地址为 10.10.10.1。
set services rpm probe office365_rpm_secondary test office365_test_secondary probe-type icmp-ping set services rpm probe office365_rpm_secondary test office365_test_secondary target address 40.97.223.114 set services rpm probe office365_rpm_secondary test office365_test_secondary probe-count 5 set services rpm probe office365_rpm_secondary test office365_test_secondary probe-interval 6 set services rpm probe office365_rpm_secondary test office365_test_secondary thresholds successive-loss 5 set services rpm probe office365_rpm_secondary test office365_test_secondary rtt 300000 set services rpm probe office365_rpm_secondary test office365_test_secondary destination-interface ge-0/0/7.0 set services rpm probe office365_rpm_secondary test office365_test_secondary next-hop 10.10.10.1
为 Skype 应用程序创建两个探测器。
在此步骤中，我们将设置较短的探测间隔（1 秒）和较短的 RTT（60000 微秒）。此配置反映了应用程序的更高链路保证。请注意，与 Office365 相比，主探测器的接口为 ge-0/0/7，要探测的 IP 地址不同。此步骤中使用的 IP 地址是我们用于探测的目标地址。也就是说，每个目标地址都属于我们已为其创建探测的应用程序。
set services rpm probe skype_rpm_primary test skype_test_primary probe-type icmp-ping set services rpm probe skype_rpm_primary test skype_test_primary target address 13.107.8.2 set services rpm probe skype_rpm_primary test skype_test_primary probe-count 5 set services rpm probe skype_rpm_primary test skype_test_primary probe-interval 1 set services rpm probe skype_rpm_primary test skype_test_primary thresholds successive-loss 5 set services rpm probe skype_rpm_primary test skype_test_primary rtt 60000 set services rpm probe skype_rpm_primary test skype_test_primary destination-interface ge-0/0/7.0 set services rpm probe skype_rpm_primary test skype_test_primary next-hop 10.10.10.1 set services rpm probe skype_rpm_secondary test skype_test_secondary probe-type icmp-ping set services rpm probe skype_rpm_secondary test skype_test_secondary target address 13.107.8.2 set services rpm probe skype_rpm_secondary test skype_test_secondary probe-count 5 set services rpm probe skype_rpm_secondary test skype_test_secondary probe-interval 1 set services rpm probe skype_rpm_secondary test skype_test_secondary thresholds successive-loss 5 set services rpm probe skype_rpm_secondary test skype_test_secondary rtt 60000 set services rpm probe skype_rpm_secondary test skype_test_secondary destination-interface ge-0/0/6.0 set services rpm probe skype_rpm_secondary test skype_test_secondary next-hop 192.168.220.1
使用相同的模式为其余应用程序配置探测。
set services rpm probe salesforce_rpm_primary test salesforce_test_primary probe-type icmp-ping set services rpm probe salesforce_rpm_primary test salesforce_test_primary target address 96.43.144.26 set services rpm probe salesforce_rpm_primary test salesforce_test_primary probe-count 5 set services rpm probe salesforce_rpm_primary test salesforce_test_primary probe-interval 6 set services rpm probe salesforce_rpm_primary test salesforce_test_primary thresholds successive-loss 5 set services rpm probe salesforce_rpm_primary test salesforce_test_primary rtt 300000 set services rpm probe salesforce_rpm_primary test salesforce_test_primary destination-interface ge-0/0/6.0 set services rpm probe salesforce_rpm_primary test salesforce_test_primary next-hop 192.168.220.1 set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary probe-type icmp-ping set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary target address 96.43.144.26 set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary probe-count 5 set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary probe-interval 6 set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary thresholds successive-loss 5 set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary rtt 300000 set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary destination-interface ge-0/0/7.0 set services rpm probe salesforce_rpm_secondary test salesforce_test_secondary next-hop 10.10.10.1 set services rpm probe dropbox_rpm_primary test dropbox_test_primary probe-type icmp-ping set services rpm probe dropbox_rpm_primary test dropbox_test_primary target address 162.125.248.1 set services rpm probe dropbox_rpm_primary test dropbox_test_primary probe-count 5 set services rpm probe dropbox_rpm_primary test dropbox_test_primary probe-interval 1 set services rpm probe dropbox_rpm_primary test dropbox_test_primary thresholds successive-loss 5 set services rpm probe dropbox_rpm_primary test dropbox_test_primary rtt 200000 set services rpm probe dropbox_rpm_primary test dropbox_test_primary destination-interface ge-0/0/7.0 set services rpm probe dropbox_rpm_primary test dropbox_test_primary next-hop 10.10.10.1 set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary probe-type icmp-ping set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary target address 162.125.248.1 set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary probe-count 5 set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary probe-interval 1 set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary thresholds successive-loss 5 set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary rtt 200000 set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary destination-interface ge-0/0/6.0 set services rpm probe dropbox_rpm_secondary test dropbox_test_secondary next-hop 192.168.220.1 set services rpm probe zoom_rpm_primary test zoom_test_primary probe-type icmp-ping set services rpm probe zoom_rpm_primary test zoom_test_primary target address 3.80.20.128 set services rpm probe zoom_rpm_primary test zoom_test_primary probe-count 5 set services rpm probe zoom_rpm_primary test zoom_test_primary probe-interval 1 set services rpm probe zoom_rpm_primary test zoom_test_primary thresholds successive-loss 5 set services rpm probe zoom_rpm_primary test zoom_test_primary rtt 60000 set services rpm probe zoom_rpm_primary test zoom_test_primary destination-interface ge-0/0/6.0 set services rpm probe zoom_rpm_primary test zoom_test_primary next-hop 192.168.220.1 set services rpm probe zoom_rpm_secondary test zoom_test_secondary probe-type icmp-ping set services rpm probe zoom_rpm_secondary test zoom_test_secondary target address 3.80.20.128 set services rpm probe zoom_rpm_secondary test zoom_test_secondary probe-count 5 set services rpm probe zoom_rpm_secondary test zoom_test_secondary probe-interval 1 set services rpm probe zoom_rpm_secondary test zoom_test_secondary thresholds successive-loss 5 set services rpm probe zoom_rpm_secondary test zoom_test_secondary rtt 60000 set services rpm probe zoom_rpm_secondary test zoom_test_secondary destination-interface ge-0/0/7.0 set services rpm probe zoom_rpm_secondary test zoom_test_secondary next-hop 10.10.10.1 set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary probe-type icmp-ping set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary target address 216.115.208.241 set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary probe-count 5 set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary probe-interval 1 set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary thresholds successive-loss 5 set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary rtt 60000 set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary destination-interface ge-0/0/7.0 set services rpm probe gotomeeting_rpm_primary test gotomeeting_test_primary next-hop 10.10.10.1 set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary probe-type icmp-ping set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary target address 216.115.208.241 set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary probe-count 5 set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary probe-interval 1 set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary thresholds successive-loss 5 set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary rtt 60000 set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary destination-interface ge-0/0/6.0 set services rpm probe gotomeeting_rpm_secondary test gotomeeting_test_secondary next-hop 192.168.220.1 set services rpm probe youtube_rpm_primary test youtube_test_primary probe-type http-get set services rpm probe youtube_rpm_primary test youtube_test_primary target url https://youtube.com set services rpm probe youtube_rpm_primary test youtube_test_primary probe-count 5 set services rpm probe youtube_rpm_primary test youtube_test_primary probe-interval 10 set services rpm probe youtube_rpm_primary test youtube_test_primary thresholds successive-loss 5 set services rpm probe youtube_rpm_primary test youtube_test_primary rtt 150000 set services rpm probe youtube_rpm_primary test youtube_test_primary destination-interface ge-0/0/7.0 set services rpm probe youtube_rpm_primary test youtube_test_primary next-hop 10.10.10.1 set services rpm probe youtube_rpm_secondary test youtube_test_secondary probe-type http-get set services rpm probe youtube_rpm_secondary test youtube_test_secondary target url https://youtube.com set services rpm probe youtube_rpm_secondary test youtube_test_secondary probe-count 5 set services rpm probe youtube_rpm_secondary test youtube_test_secondary probe-interval 10 set services rpm probe youtube_rpm_secondary test youtube_test_secondary thresholds successive-loss 5 set services rpm probe youtube_rpm_secondary test youtube_test_secondary rtt 150000 set services rpm probe youtube_rpm_secondary test youtube_test_secondary destination-interface ge-0/0/6.0 set services rpm probe youtube_rpm_secondary test youtube_test_secondary next-hop 192.168.220.1 set services rpm probe slack_rpm_primary test slack_test_primary probe-type icmp-ping set services rpm probe slack_rpm_primary test slack_test_primary target address 216.115.208.241 set services rpm probe slack_rpm_primary test slack_test_primary probe-count 5 set services rpm probe slack_rpm_primary test slack_test_primary probe-interval 1 set services rpm probe slack_rpm_primary test slack_test_primary thresholds successive-loss 5 set services rpm probe slack_rpm_primary test slack_test_primary rtt 60000 set services rpm probe slack_rpm_primary test slack_test_primary destination-interface ge-0/0/7.0 set services rpm probe slack_rpm_primary test slack_test_primary next-hop 10.10.10.1 set services rpm probe slack_rpm_secondary test slack_test_secondary probe-type icmp-ping set services rpm probe slack_rpm_secondary test slack_test_secondary target address 216.115.208.241 set services rpm probe slack_rpm_secondary test slack_test_secondary probe-count 5 set services rpm probe slack_rpm_secondary test slack_test_secondary probe-interval 1 set services rpm probe slack_rpm_secondary test slack_test_secondary thresholds successive-loss 5 set services rpm probe slack_rpm_secondary test slack_test_secondary rtt 60000 set services rpm probe slack_rpm_secondary test slack_test_secondary destination-interface ge-0/0/6.0 set services rpm probe slack_rpm_secondary test slack_test_secondary next-hop 192.168.220.1
为每个应用程序创建一个路由实例。确保与其他链路相比，通过该应用程序的主链路的路由具有较低的优先级值。优先级值越低，路由越优先。确保业务关键型应用程序使用 LTE 备份接口。
在此步骤中，我们将为 Office365 应用程序配置路由实例。主链路是 MPLS 链路。将此链路网关的首选项值设置为 10，使其成为最首选的路由。宽带互联网链路网关的优先值为 20，使其成为第二好的优选选项。LTE 备份链路的首选项值为 30，是最不首选的选项。
set routing-instances office365_RInstance instance-type forwarding set routing-instances office365_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 10 set routing-instances office365_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 20 set routing-instances office365_RInstance routing-options static route 0/0 qualified-next-hop dl0.0 set routing-instances office365_RInstance routing-options static route 0/0 preference 30
使用与上一步中相同的模式为其余应用程序配置路由实例。
set routing-instances skype_RInstance instance-type forwarding set routing-instances skype_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 10 set routing-instances skype_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 20 set routing-instances salesforce_RInstance instance-type forwarding set routing-instances salesforce_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 10 set routing-instances salesforce_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 20 set routing-instances salesforce_RInstance routing-options static route 0/0 qualified-next-hop dl0.0 preference 30 set routing-instances dropbox_RInstance instance-type forwarding set routing-instances dropbox_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 10 set routing-instances dropbox_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 20 set routing-instances slack_RInstance instance-type forwarding set routing-instances slack_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 10 set routing-instances slack_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 20 set routing-instances zoom_RInstance instance-type forwarding set routing-instances zoom_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 10 set routing-instances zoom_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 20 set routing-instances zoom_RInstance routing-options static route 0/0 qualified-next-hop dl0.0 preference 30 set routing-instances gotomeeting_RInstance instance-type forwarding set routing-instances gotomeeting_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 10 set routing-instances gotomeeting_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 20 set routing-instances youtube_RInstance instance-type forwarding set routing-instances youtube_RInstance routing-options static route 0/0 qualified-next-hop 10.10.10.1 preference 10 set routing-instances youtube_RInstance routing-options static route 0/0 qualified-next-hop 192.168.220.1 preference 20
为所有应用程序配置 IP 监控策略。策略的目标是更改上一步中在路由实例中创建的路由的指标。这些策略是基于每个探测创建的。
在此步骤中，我们将为 Office365 应用程序创建 IP 监视策略。我们配置了两个探测，因此创建了两个策略 — 每个探测一个。当探测到的链路偏离允许的阈值时，策略会更改路由的优先级，以便通过其他链路重新路由应用程序流量。该策略将第二个最佳链接的指标减少到 2。
示例：当探测确定 Office35 的主链路 （MPLS） 不满足 RTT 和数据包丢失的要求时，策略允许宽带 Internet 链路的网关的衡量指标为 2。请注意，该策略会更改第二最佳路由的指标。
set services ip-monitoring policy office365_ipm_primary match rpm-probe office365_rpm_primary set services ip-monitoring policy office365_ipm_primary then preferred-route routing-instances office365_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy office365_ipm_primary then preferred-route routing-instances office365_RInstance route 0/0 preferred-metric 2
为 Office365 的辅助探测配置 IP 监视策略。下一跃点地址是主 MPLS 链路。
set services ip-monitoring policy office365_ipm_secondary match rpm-probe office365_rpm_ secondary set services ip-monitoring policy office365_ipm_ secondary then preferred-route routing-instances office365_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy office365_ipm_ secondary then preferred-route routing-instances office365_RInstance route 0/0 preferred-metric 2
按照与前两个步骤中类似的模式为其余应用程序配置 IP 监视策略。
set services ip-monitoring policy skype_ipm_primary match rpm-probe skype_rpm_primary set services ip-monitoring policy skype_ipm_primary then preferred-route routing-instances skype_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy skype_ipm_primary then preferred-route routing-instances skype_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy skype_ipm_secondary match rpm-probe skype_rpm_ secondary set services ip-monitoring policy skype_ipm_ secondary then preferred-route routing-instances skype_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy skype_ipm_ secondary then preferred-route routing-instances skype_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy salesforce_ipm_primary match rpm-probe salesforce_rpm_primary set services ip-monitoring policy salesforce_ipm_primary then preferred-route routing-instances salesforce_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy salesforce_ipm_primary then preferred-route routing-instances salesforce_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy salesforce_ipm_secondary match rpm-probe salesforce_rpm_ secondary set services ip-monitoring policy salesforce_ipm_ secondary then preferred-route routing-instances salesforce_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy salesforce_ipm_ secondary then preferred-route routing-instances salesforce_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy dropbox_ipm_primary match rpm-probe dropbox_rpm_primary set services ip-monitoring policy dropbox_ipm_primary then preferred-route routing-instances dropbox_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy dropbox_ipm_primary then preferred-route routing-instances dropbox_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy dropbox_ipm_secondary match rpm-probe dropbox_rpm_ secondary set services ip-monitoring policy dropbox_ipm_ secondary then preferred-route routing-instances dropbox_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy dropbox_ipm_ secondary then preferred-route routing-instances dropbox_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy slack_ipm_primary match rpm-probe slack_rpm_primary set services ip-monitoring policy slack_ipm_primary then preferred-route routing-instances slack_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy slack_ipm_primary then preferred-route routing-instances slack_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy slack_ipm_secondary match rpm-probe slack_rpm_ secondary set services ip-monitoring policy slack_ipm_ secondary then preferred-route routing-instances slack_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy slack_ipm_ secondary then preferred-route routing-instances slack_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy zoom_ipm_primary match rpm-probe zoom_rpm_primary set services ip-monitoring policy zoom_ipm_primary then preferred-route routing-instances zoom_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy zoom_ipm_primary then preferred-route routing-instances zoom_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy zoom_ipm_secondary match rpm-probe zoom_rpm_ secondary set services ip-monitoring policy zoom_ipm_ secondary then preferred-route routing-instances zoom_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy zoom_ipm_ secondary then preferred-route routing-instances zoom_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy gotomeeting_ipm_primary match rpm-probe gotomeeting_rpm_primary set services ip-monitoring policy gotomeeting_ipm_primary then preferred-route routing-instances gotomeeting_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy gotomeeting_ipm_primary then preferred-route routing-instances gotomeeting_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy gotomeeting_ipm_secondary match rpm-probe gotomeeting_rpm_ secondary set services ip-monitoring policy gotomeeting_ipm_ secondary then preferred-route routing-instances gotomeeting_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy gotomeeting_ipm_ secondary then preferred-route routing-instances gotomeeting_RInstance route 0/ preferred-metric 2 set services ip-monitoring policy youtube_ipm_primary match rpm-probe youtube_rpm_primary set services ip-monitoring policy youtube_ipm_primary then preferred-route routing-instances youtube_RInstance route 0/0 next-hop 192.168.220.1 set services ip-monitoring policy youtube_ipm_primary then preferred-route routing-instances youtube_RInstance route 0/0 preferred-metric 2 set services ip-monitoring policy youtube_ipm_secondary match rpm-probe youtube_rpm_ secondary set services ip-monitoring policy youtube_ipm_ secondary then preferred-route routing-instances youtube_RInstance route 0/0 next-hop 10.10.10.1 set services ip-monitoring policy youtube_ipm_ secondary then preferred-route routing-instances youtube_RInstance route 0/0 preferred-metric 2
配置基于策略的高级路由 （APBR） 配置文件，该配置文件匹配范围内的所有八个应用程序，并将流量重定向到该应用程序的相应路由实例。配置文件分为多个规则。每个规则涵盖一个应用程序和一个路由实例。
在此步骤中，规则
office365_rule匹配应用程序junos:OFFICE365-CREATE-CONVERSATION“ 的所有流量，并将流量重定向到路由实例office365_RInstance。set security advance-policy-based-routing tunables max-route-change 0 set security advance-policy-based-routing profile apbr_profile rule office365_rule match dynamic-application junos:OFFICE365-CREATE-CONVERSATION set security advance-policy-based-routing profile apbr_profile rule office365_rule then routing-instance office365_RInstance set security advance-policy-based-routing profile apbr_profile rule skype_rule match dynamic-application junos: SKYPE set security advance-policy-based-routing profile apbr_profile rule skype_rule then routing-instance skype_RInstance set security advance-policy-based-routing profile apbr_profile rule salesforce_rule match dynamic-application junos:SALESFORCE set security advance-policy-based-routing profile apbr_profile rule salesforce_rule then routing-instance salesforce_RInstance set security advance-policy-based-routing profile apbr_profile rule dropbox_rule match dynamic-application junos: DROPBOX set security advance-policy-based-routing profile apbr_profile rule dropbox_rule then routing-instance dropbox_RInstance set security advance-policy-based-routing profile apbr_profile rule slack_rule match dynamic-application junos:SLACK set security advance-policy-based-routing profile apbr_profile rule slack_rule then routing-instance slack_RInstance set security advance-policy-based-routing profile apbr_profile rule zoom_rule match dynamic-application junos:ZOOM set security advance-policy-based-routing profile apbr_profile rule zoom_rule then routing-instance zoom_RInstance set security advance-policy-based-routing profile apbr_profile rule gotomeeting_rule match dynamic-application junos: GOTOMEETING set security advance-policy-based-routing profile apbr_profile rule gotomeeting_rule then routing-instance gotomeeting_RInstance set security advance-policy-based-routing profile apbr_profile rule youtube_rule match dynamic-application junos:YOUTUBE set security advance-policy-based-routing profile apbr_profile rule youtube_rule then routing-instance youtube_RInstance set
在此步骤中，我们不允许对正在进行的会话进行会话中路径更改，以避免对应用程序连续性产生任何影响。这是通过将参数设置为
max-route-change0 来实现的。配置与协议无关的路由表组。该组将专用实例的路由表导入主路由表。
set routing-options interface-routes rib-group inet apbr_group set routing-options rib-groups apbr_group import-rib inet.0 set routing-options rib-groups apbr_group import-rib office365_RInstance.inet.0 set routing-options rib-groups apbr_group import-rib skype_RInstance.inet.0 set routing-options rib-groups apbr_group import-rib salesforce_RInstance.inet.0 set routing-options rib-groups apbr_group import-rib dropbox_RInstance.inet.0 set routing-options rib-groups apbr_group import-rib slack_RInstance.inet.0 set routing-options rib-groups apbr_group import-rib zoom_RInstance.inet.0 set routing-options rib-groups apbr_group import-rib gotomeeting_RInstance.inet.0 set routing-options rib-groups apbr_group import-rib youtube_RInstance.inet.0
将新创建的配置文件
apbr_profile添加到安全区域信任。此配置将配置文件应用于信任区域中的流量。set security zones security-zone trust advance-policy-based-routing-profile apbr_profile
提交配置。
commit
验证
要确认配置工作正常，请执行以下任务：
验证 Junos OS 对小型 PIM 模块的检测
目的
验证 Junos OS 是否正在检测小型 PIM 模块。
行动
从操作模式：
user@host> show chassis hardware Hardware inventory: Item Version Part number Serial number Description Chassis CX0916AF0004 SRX320-POE Routing Engine REV 0x05 650-065041 CX0916AF0004 RE-SRX320-POE FPC 0 FPC PIC 0 6xGE,2xGE SFP Base PIC FPC 1 REV 02 650-073958 AH06074206 FPC PIC 0 LTE for AE Power Supply 0
意义
设备在输出中显示小型 PIM 模块 LTE for AE 。
验证小型 PIM 的固件版本
目的
检查小型 PIM 的固件版本。
行动
从操作模式：
user@host> show system firmware
Part Type Tag Current Available Status
version version
FPC 1
PIC 0 MLTE_FW 1 17.1.80 0 OK
Routing Engine 0 RE BIOS 0 3.0 3.6 OK
Routing Engine 0 RE BIOS Backup 1 3.0 3.6 OK
意义
输出显示 Mini-PIM 的固件版本为 17.1.80。如果需要，请更新固件。请参阅 LTE 小型物理接口模块上的固件升级。
验证 APBR 规则的有效性
目的
在应用 APBR 规则后验证流量处理详细信息。
行动
从操作模式：
user@host> show security advance-policy-based-routing statistics Advance Profile Based Routing statistics: Sessions Processed 5611 App rule hit on cache hit 1 App rule hit on HTTP Proxy/ALG 0 Midstream disabled rule hit on cache hit 0 URL cat rule hit on cache hit 0 DSCP rule hit on first packet 0 App and DSCP hit on first packet 0 App rule hit midstream 0 Midstream disabled rule hit midstream 0 URL cat rule hit midstream 0 App and DSCP rule hit midstream 0 DSCP rule hit midstream 0 Route changed on cache hits 1 Route changed on HTTP Proxy/ALG 0 Route changed midstream 0 Zone mismatch 0 Drop on zone mismatch 0 Next hop not found 0 Application services bypass 0
意义
输出显示有关为基于应用程序的路由规则处理的会话的详细信息、应用程序流量与 APBR 配置文件匹配的次数 （rule hit） 以及将 APBR 应用于会话的时间 （Route change）。