Example: Configuring User Logical Systems

Requirements

• Log in to the user logical system as the logical system administrator. See User Logical System Configuration Overview.
• Be sure you know which logical interfaces and optionally, which logical tunnel interface (and its IP address) are allocated to your user logical system by the master administrator. See Understanding the Master Logical System and the Master Administrator Role.

Overview

This example configures the ls-marketing-dept and ls-accounting-dept user logical systems shown in Example: Creating User Logical Systems, Their Administrators, Their Users, and an Interconnect Logical System.

This example configures the parameters described in Table 1 and Table 2.

Configuration

• Configuring the ls-marketing-dept User Logical System
• Configuring the ls-accounting-dept User Logical System

Configuring the ls-marketing-dept User Logical System

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Log in to the user logical system as the logical system administrator and enter configuration mode.
   lsmarketingadmin1@host:ls-marketing-dept> configurelsmarketingadmin1@host:ls-marketing-dept#
2. Configure the logical interface for a user logical system.
   [edit interfaces]lsmarketingadmin1@host:ls-marketing-dept# set ge-0/0/6 unit 1 family inet address 13.1.1.1/24lsmarketingadmin1@host:ls-marketing-dept# set ge-0/0/6 unit 1 vlan-id 800
3. Configure the routing instance and assign interfaces.
   [edit routing-instances]lsmarketingadmin1@host:ls-marketing-dept# set mk-vr1 instance-type virtual-routerlsmarketingadmin1@host:ls-marketing-dept# set mk-vr1 interface ge-0/0/6.1lsmarketingadmin1@host:ls-marketing-dept# set mk-vr1 interface lt-0/0/0.5
4. Configure static routes.
   [edit routing-instances]lsmarketingadmin1@host:ls-marketing-dept# set mk-vr1 routing-options static route 12.1.1.0/24 next-hop 10.0.1.2lsmarketingadmin1@host:ls-marketing-dept# set mk-vr1 routing-options static route 14.1.1.0/24 next-hop 10.0.1.4lsmarketingadmin1@host:ls-marketing-dept# set mk-vr1 routing-options static route 12.12.1.0/24 next-hop 10.0.1.1
5. Configure security zones and assign interfaces to each zone.
   [edit security zones]lsmarketingadmin1@host:ls-marketing-dept# set security-zone ls-marketing-trust interfaces ge-0/0/6.1lsmarketingadmin1@host:ls-marketing-dept# set security-zone ls-marketing-untrust interfaces lt-0/0/0.5
6. Create address book entries.
   [edit security]lsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-internal address marketers 13.1.1.0/24lsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-external address design 12.1.1.0/24lsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-external address accounting 14.1.1.0/24lsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-external address others 12.12.1.0/24lsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-external address-set otherlsys address designlsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-external address-set otherlsys address accounting
7. Attach address books to zones.
   [edit security]lsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-internal attach zone ls-marketing-trustlsmarketingadmin1@host:ls-marketing-dept# set address-book marketing-external attach zone ls-marketing-untrust
8. Configure a security policy that permits traffic from the ls-marketing-trust zone to the ls-marketing-untrust zone.
   [edit security policies from-zone ls-marketing-trust to-zone ls-marketing-untrust]lsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-to-otherlsys match source-address marketerslsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-to-otherlsys match destination-address otherlsyslsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-to-otherlsys match application anylsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-to-otherlsys then permit
9. Configure a security policy that permits traffic from the ls-marketing-untrust zone to the ls-marketing-trust zone.
   [edit security policies from-zone ls-marketing-untrust to-zone ls-marketing-trust]lsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-from-otherlsys match source-address otherlsyslsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-from-otherlsys match destination-address marketerslsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-from-otherlsys match application anylsmarketingadmin1@host:ls-marketing-dept# set policy permit-all-from-otherlsys then permit

Results

From configuration mode, confirm your configuration by entering the show routing-instances and show security commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring the ls-accounting-dept User Logical System

CLI Quick Configuration

To quickly configure this section of the example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Log in to the user logical system as the logical system administrator and enter configuration mode.
   lsaccountingadmin1@host:ls-accounting-dept> configurelsaccountingadmin1@host:ls-accounting-dept#
2. Configure the logical interface for a user logical system.
   [edit interfaces]lsaccountingadmin1@host:ls-accounting-dept# set ge-0/0/7 unit 1 family inet address 14.1.1.1/24lsaccountingadmin1@host:ls-accounting-dept# set ge-0/0/7 unit 1 vlan-id 900
3. Configure the routing instance and assign interfaces.
   [edit routing-instances]lsaccountingadmin1@host:ls-accounting-dept# set acct-vr1 instance-type virtual-routerlsaccountingadmin1@host:ls-accounting-dept# set acct-vr1 interface ge-0/0/7.1lsaccountingadmin1@host:ls-accounting-dept# set acct-vr1 interface lt-0/0/0.7
4. Configure static routes.
   [edit routing-instances]lsaccountingadmin1@host:ls-accounting-dept# set acct-vr1 routing-options static route 12.1.1.0/24 next-hop 10.0.1.2lsaccountingadmin1@host:ls-accounting-deptt# set acct-vr1 routing-options static route 13.1.1.0/24 next-hop 10.0.1.3lsaccountingadmin1@host:ls-accounting-dept# set acct-vr1 routing-options static route 12.12.1.0/24 next-hop 10.0.1.1
5. Configure security zones and assign interfaces to each zone.
   [edit security zones]lsaccountingadmin1@host:ls-accounting-dept# set security-zone ls-accounting-trust interfaces ge-0/0/7.1lsaccountingadmin1@host:ls-accounting-dept# set security-zone ls-accounting-untrust interfaces lt-0/0/0.7
6. Create address book entries.
   [edit security]lsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-internal address accounting 14.1.1.0/24lsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-external address design 12.1.1.0/24lsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-external address marketing 13.1.1.0/24lsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-external address others 12.12.1.0/24lsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-external address-set otherlsys address designlsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-external address-set otherlsys address marketing
7. Attach address books to zones.
   [edit security]lsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-internal attach zone ls-accounting-trustlsaccountingadmin1@host:ls-accounting-dept# set address-book accounting-external attach zone ls-accounting-untrust
8. Configure a security policy that permits traffic from the ls-accounting-trust zone to the ls-accounting-untrust zone.
   [edit security policies from-zone ls-accounting-trust to-zone ls-accounting-untrust]lsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-to-otherlsys match source-address accountinglsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-to-otherlsys match destination-address otherlsyslsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-to-otherlsys match application anylsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-to-otherlsys then permit
9. Configure a security policy that permits traffic from the ls-accounting-untrust zone to the ls-accounting-trust zone.
   [edit security policies from-zone ls-accounting-untrust to-zone ls-accounting-trust]lsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-from-otherlsys match source-address otherlsyslsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-from-otherlsys match destination-address accountinglsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-from-otherlsys match application anylsaccountingadmin1@host:ls-accounting-dept# set policy permit-all-from-otherlsys then permit

Results

From configuration mode, confirm your configuration by entering the show routing-instances and show security commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, perform these tasks:

• Verifying Policy Configuration

Verifying Policy Configuration

Purpose

Verify information about policies and rules.

Action

From operational mode, enter the show security policies detail command to display a summary of all policies configured on the logical system.