SUR CETTE PAGE
Exemple : Services nouvelle génération Haute disponibilité à états interchâssis pour le NAT et le pare-feu dynamique
Cet exemple montre comment configurer la haute disponibilité interchâssis des services nouvelle génération pour les services de pare-feu dynamiques et de NAT.
Vue d’ensemble
Deux routeurs sont configurés de manière identique pour faciliter le basculement dynamique des services de pare-feu et de NAT en cas de défaillance du châssis.
La configuration
Pour configurer la haute disponibilité entre châssis Pour cet exemple, effectuez les tâches suivantes :
- Configuration rapide de la CLI
- Configuration des interfaces pour châssis 1.
- Configurer les informations de routage pour le châssis 1
- Configuration du NAT et du pare-feu dynamique pour le châssis 1
- Configuration de l’ensemble de services
- Configuration des interfaces pour le châssis 2
- Configurer les informations de routage pour Chassis 2
Configuration rapide de la CLI
Pour configurer rapidement cet exemple sur les routeurs, copiez les commandes suivantes et collez-les dans la fenêtre du terminal du routeur après avoir supprimé les sauts de ligne et les avoir remplacées par des informations d’interface spécifiques à votre site.
La configuration suivante concerne le châssis 1.
[edit] set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.2 set interfaces vms-4/0/0 redundancy-options routing-instance HA set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.1/32 set interfaces vms-4/0/0 unit 20 family inet set interfaces vms-4/0/0 unit 20 service-domain inside set interfaces vms-4/0/0 unit 30 family inet set interfaces vms-4/0/0 unit 30 service-domain outside set interfaces ge-2/0/0 vlan-tagging set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.1/24 set routing-instances HA instance-type vrf set routing-instances HA interface ge-2/0/0.0 set routing-instances HA interface vms-4/0/0.10 set routing-instances HA route-distinguisher 1:1 set policy-options policy-statement dummy term 1 then reject set routing-instances HA vrf-import dummy set routing-instances HA vrf-export dummy set routing-instances HA routing-options static route route 5.5.5.1/32 next-hop vms-4/0/0.10 set routing-instances HA routing-options static route route 5.5.5.2/32 next-hop 20.1.1.2 set services nat pool p2 address 32.0.0.0/24 set services nat pool p2 port automatic random-allocation set services nat pool p2 address-allocation round-robin set services nat rule r2 match-direction input set services nat rule r2 term t1 from source-address 129.0.0.0/8 set services nat rule r2 term t1 from source-address 128.0.0.0/8 set services nat rule r2 term t1 then translated source-pool p2 set services nat rule r2 term t1 then translated translation-type napt-44 set services nat rule r2 term t1 then translated address-pooling paired set services nat rule r2 term t1 then syslog set services stateful-firewall rule r2 match-direction input set services stateful-firewall rule r2 term t1 from source-address any-unicast set services stateful-firewall rule r2 term t1 then accept set services stateful-firewall rule r2 term t1 then syslog set services service-set ss2 replicate-services replication-threshold 180 set services service-set ss2 replicate-services stateful-firewall set services service-set ss2 replicate-services nat set services service-set ss2 stateful-firewall-rules r2 set services service-set ss2 nat-rules r2 set services service-set ss2 next-hop-service inside-service-interface vms-4/0/0.20 set services service-set ss2 next-hop-service outside-service-interface vms-4/0/0.30 set services service-set ss2 syslog host local class session-logs set services service-set ss2 syslog host local class stateful-firewall-logs set services service-set ss2 syslog host local class nat-logs
La configuration suivante concerne le châssis 2. Les informations de NAT, de pare-feu dynamique et d’ensemble de services doivent être identiques pour les châssis 1 et 2.
set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.1 set interfaces vms-4/0/0 redundancy-options routing-instance HA set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.2/32 set interfaces vms-4/0/0 unit 20 family inet set interfaces vms-4/0/0 unit 20 service-domain inside set interfaces vms-4/0/0 unit 30 family inet set interfaces vms-4/0/0 unit 30 service-domain outside set interfaces ge-2/0/0 vlan-tagging set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.2/24 set routing-instances HA instance-type vrf set routing-instances HA interface ge-2/0/0.0 set routing-instances HA interface vms-4/0/0.10 set routing-instances HA route-distinguisher 1:1 set policy-options policy-statement dummy term 1 then reject set routing-instances HA vrf-import dummy set routing-instances HA vrf-export dummy set routing-instances HA routing-options static route 5.5.5.2/32 next-hop vms-4/0/0.10 set routing-instances HA routing-options static route 5.5.5.1/32 next-hop 20.1.1.1 set services nat pool p2 address 32.0.0.0/24 set services nat pool p2 port automatic random-allocation set services nat pool p2 address-allocation round-robin set services nat rule r2 match-direction input set services nat rule r2 term t1 from source-address 129.0.0.0/8 set services nat rule r2 term t1 from source-address 128.0.0.0/8 set services nat rule r2 term t1 then translated source-pool p2 set services nat rule r2 term t1 then translated translation-type napt-44 set services nat rule r2 term t1 then translated address-pooling paired set services nat rule r2 term t1 then syslog set services stateful-firewall rule r2 match-direction input set services stateful-firewall rule r2 term t1 from source-address any-unicast set services stateful-firewall rule r2 term t1 then accept set services stateful-firewall rule r2 term t1 then syslog set services service-set ss2 replicate-services replication-threshold 180 set services service-set ss2 replicate-services stateful-firewall set services service-set ss2 replicate-services nat set services service-set ss2 stateful-firewall-rules r2 set services service-set ss2 nat-rules r2 set services service-set ss2 next-hop-service inside-service-interface vms-4/0/0.20 set services service-set ss2 next-hop-service outside-service-interface vms-4/0/0.30 set services service-set ss2 syslog host local class session-logs set services service-set ss2 syslog host local class stateful-firewall-logs set services service-set ss2 syslog host local class nat-logs
Configuration des interfaces pour châssis 1.
Procédure étape par étape
Les interfaces de chaque paire de routeurs HA sont configurées de la même manière, à l’exception des options PIC de service suivantes :
redundancy-options redundancy-peer ipaddress addressunit unit-number family inet address addressd’une unité, autre que 0, qui contient l’optionip-address-owner service-plane
Pour configurer des interfaces :
Configurez le PIC de service redondant sur le châssis 1.
[edit interfaces} user@host# set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.2 user@host# set interfaces vms-4/0/0 redundancy-options routing-instance HA user@host# set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane user@host# set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.1/32 user@host# set interfaces vms-4/0/0 unit 20 family inet user@host# set interfaces vms-4/0/0 unit 20 service-domain inside user@host# set interfaces vms-4/0/0 unit 30 family inet user@host# set interfaces vms-4/0/0 unit 30 service-domain outside
Configurez les interfaces du châssis 1 qui sont utilisées comme liens interchâssis pour le trafic de synchronisation.
user@host# set interfaces ge-2/0/0 vlan-tagging user@host# set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.1/24
Configurez les interfaces restantes selon vos besoins.
Résultats
user@host# show interfaces
ge-2/0/0 {
vlan-tagging;
unit 0 {
vlan-id 100;
family inet {
address 20.1.1.1/24;
}
}
}
vms-4/0/0 {
redundancy-options {
redundancy-peer {
ipaddress 5.5.5.2;
}
routing-instance HA;
}
unit 10 {
ip-address-owner service-plane;
family inet {
address 5.5.5.1/32;
}
}
unit 20 {
family inet;
family inet6;
service-domain inside;
}
unit 30 {
family inet;
family inet6;
service-domain outside;
}
}
}
Configurer les informations de routage pour le châssis 1
Procédure étape par étape
La configuration de routage détaillée n’est pas incluse pour cet exemple. Une instance de routage est requise pour le trafic de synchronisation HA entre les châssis, comme suit :
Configurez les instances de routage pour le châssis 1.
user@host# set routing-instances HA instance-type vrf user@host# set routing-instances HA interface ge-2/0/0.0 user@host# set routing-instances HA interface vms-4/0/0.10 user@host# set routing-instances HA route-distinguisher 1:1 user@host# set policy-options policy-statement dummy term 1 then reject user@host# set routing-instances HA vrf-import dummy user@host# set routing-instances HA vrf-export dummy user@host# set routing-instances HA routing-options static route route 5.5.5.1/32 next-hop vms-4/0/0.10 user@host# set routing-instances HA routing-options static route route 5.5.5.2/32 next-hop 20.1.1.2
Résultats
user@host# show routing-instances
HA {
instance-type vrf;
interface ge-2/0/0.0;
interface vms-4/0/0.10;
route-distinguisher 1:1;
vrf-import dummy;
vrf-export dummy;
routing-options {
static {
route 5.5.5.1/32 next-hop vms-4/0/0.10;
route 5.5.5.2/32 next-hop 20.1.1.2;
}
}
}
Configuration du NAT et du pare-feu dynamique pour le châssis 1
Procédure étape par étape
Configurez le NAT et le pare-feu dynamique de manière identique sur les deux routeurs. Pour configurer le NAT et le pare-feu dynamique :
Configurez le NAT selon vos besoins.
user@host# set services nat pool p2 address 32.0.0.0/24 user@host# set services nat pool p2 port automatic random-allocation user@host# set services nat pool p2 address-allocation round-robin user@host# set services nat rule r2 match-direction input user@host# set services nat rule r2 term t1 from source-address 129.0.0.0/8 user@host# set services nat rule r2 term t1 from source-address 128.0.0.0/8 user@host# set services nat rule r2 term t1 then translated source-pool p2 user@host# set services nat rule r2 term t1 then translated translation-type napt-44 user@host# set services nat rule r2 term t1 then translated address-pooling paired user@host# set services nat rule r2 term t1 then syslog
Configurez le pare-feu dynamique selon vos besoins.
user@host# set services stateful-firewall rule r2 match-direction input user@host# set services stateful-firewall rule r2 term t1 from source-address any-unicast user@host# set services stateful-firewall rule r2 term t1 then accept user@host# set services stateful-firewall rule r2 term t1 then syslog
Résultats
user@host# show services nat
nat {
pool p2 {
address 32.0.0.0/24;
port {
automatic {
random-allocation;
}
}
address-allocation round-robin;
}
rule r2 {
match-direction input;
term t1 {
from {
source-address {
129.0.0.0/8;
128.0.0.0/8;
}
}
then {
translated {
source-pool p2;
translation-type {
napt-44;
}
address-pooling paired;
}
syslog;
}
}
}
}
}
user@host show services stateful-firewell
rule r2 {
match-direction input;
term t1 {
from {
source-address {
any-unicast;
}
}
then {
accept;
syslog;
}
}
}
Configuration de l’ensemble de services
Procédure étape par étape
Configurez le service de manière identique sur les deux routeurs. Pour configurer l’ensemble de services :
Configurez les options de réplication de l’ensemble de services.
user@host# set services service-set ss2 replicate-services replication-threshold 180 user@host# set services service-set ss2 replicate-services stateful-firewall user@host# set services service-set ss2 replicate-services nat
Configurez les références à la solution NAT et aux règles de pare-feu dynamiques pour l’ensemble de services.
user@host# set services service-set ss2 stateful-firewall-rules r2 user@host# set services service-set ss2 nat-rules r2
Configurez l’interface de service de saut suivant sur le vms-PIC.
user@host# set services service-set ss2 next-hop-service inside-service-interface vms-4/0/0.20 user@host# set services service-set ss2 next-hop-service outside-service-interface vms-4/0/0.30
Configurez les options de journalisation souhaitées.
user@host# set services service-set ss2 syslog host local class session-logs user@host# set services service-set ss2 syslog host local class stateful-firewall-logs user@host# set services service-set ss2 syslog host local class nat-logs
Résultats
user@host# show services service-set ss2
syslog {
host local {
class {
session-logs;
inactive: stateful-firewall-logs;
nat-logs;
}
}
}
replicate-services {
replication-threshold 180;
stateful-firewall;
nat;
}
stateful-firewall-rules r2;
inactive: nat-rules r2;
next-hop-service {
inside-service-interface vms-3/0/0.20;
outside-service-interface vms-3/0/0.30;
}
}
Configuration des interfaces pour le châssis 2
Procédure étape par étape
Les interfaces de chaque paire de routeurs HA sont configurées de la même manière, à l’exception des options PIC de service suivantes :
redundancy-options redundancy-peer ipaddress addressunit unit-number family inet address addressd’une unité, autre que 0, qui contient l’optionip-address-owner service-plane
Configurez le PIC de service redondant sur le châssis 2.
Pointe
redundancy-peer ipaddressvers l’adresse de l’unité (unité 10) sur vms-4/0/0 sur le châssis sur le châssis 1 qui contient l’instructionip-address-owner service-plane.[edit interfaces} set interfaces vms-4/0/0 redundancy-options redundancy-peer ipaddress 5.5.5.1 user@host# set interfaces vms-4/0/0 redundancy-options routing-instance HA user@host# set interfaces vms-4/0/0 unit 10 ip-address-owner service-plane user@host# set interfaces vms-4/0/0 unit 10 family inet address 5.5.5.2/32 user@host# set interfaces vms-4/0/0 unit 20 family inet user@host# set interfaces vms-4/0/0 unit 20 service-domain inside user@host# set interfaces vms-4/0/0 unit 30 family inet user@host# set interfaces vms-4/0/0 unit 30 service-domain outside
Configurez les interfaces du châssis 2 qui sont utilisées comme liens interchâssis pour le trafic de synchronisation
user@host# set interfaces ge-2/0/0 vlan-tagging user@host# set interfaces ge-2/0/0 unit 0 vlan-id 100 family inet address 20.1.1.2/24
Configurez les interfaces restantes pour le châssis 2 selon vos besoins.
Résultats
user@host# show interfaces
vms-4/0/0 {
redundancy-options {
redundancy-peer {
ipaddress 5.5.5.1;
}
routing-instance HA;
}
unit 0 {
family inet;
}
unit 10 {
ip-address-owner service-plane;
family inet {
address 5.5.5.2/32;
}
}
ge-2/0/0 {
vlan-tagging;
unit 0 {
vlan-id 100;
family inet {
address 20.1.1.2/24;
}
}
unit 10 {
vlan-id 10;
family inet {
address 2.10.1.2/24;
}
Configurer les informations de routage pour Chassis 2
Procédure étape par étape
La configuration de routage détaillée n’est pas incluse pour cet exemple. Une instance de routage est requise pour le trafic de synchronisation HA entre les deux châssis et est incluse ici.
Configurer les instances de routage pour le châssis 2.
user@host# set routing-instances HA instance-type vrf user@host# set routing-instances HA interface ge-2/0/0.0 user@host# set routing-instances HA interface vms-4/0/0.10 user@host# set routing-instances HA route-distinguisher 1:1 user@host# set policy-options policy-statement dummy term 1 then reject user@host# set routing-instances HA vrf-import dummy user@host# set routing-instances HA vrf-export dummy user@host# set routing-instances HA routing-options static route 5.5.5.2/32 next-hop vms-4/0/0.10 user@host# set routing-instances HA routing-options static route 5.5.5.1/32 next-hop 20.1.1.1
Remarque :Les étapes de configuration suivantes sont identiques à celles indiquées pour le châssis 1.
Configuration du NAT et du pare-feu dynamique
Configuration de l’ensemble de services
Résultats
user@host# show services routing-instances
HA {
instance-type vrf;
interface xe-2/2/0.0;
interface vms-4/0/0.10;
route-distinguisher 1:1;
vrf-import dummy;
vrf-export dummy;
routing-options {
static {
route 5.5.5.2/32 next-hop vms-4/0/0.10;
route 5.5.5.1/32 next-hop 20.1.1.1;
}
}