Chiffrement des liens de contrôle HA du cluster de châssis
Connectez les ports de contrôle dédiés sur le nœud 0 et le nœud 1. Connectez les ports fabriqués définis par l’utilisateur sur le nœud 0 et le nœud 1. Pour configurer deux châssis en mode cluster, procédez comme suit :
Activez le mode cluster de châssis sur les deux nuds, reportez-vous à la section Présentation de la configuration du cluster de châssis SRX Series.
- Après avoir activé le cluster de châssis, dans l’appareil 1, configurez le chiffrement des liens HA comme indiqué dans l’exemple de configuration ci-dessous, validez et redémarrez. L’appareil 1 doit être configuré avec la configuration de chiffrement de liaison HA noeud0 et noeud1 avant de valider et de redémarrer.
[edit] user@host# set groups node0 security ike proposal HA authentication-method pre-shared-keys user@host# set groups node0 security ike proposal HA dh-group group20 user@host# set groups node0 security ike proposal HA authentication-algorithm sha-256 user@host# set groups node0 security ike proposal HA encryption-algorithm aes-256-cbc user@host# set groups node0 security ike policy HA proposals HA user@host# prompt groups node0 security ike policy HA pre-shared-key ascii-text This Should Be A Strong And Secure Key Retype This Should Be A Strong And Secure Key user@host# set groups node0 security ike gateway HA ike-policy HA user@host# set groups node0 security ike gateway HA version v2-only user@host# set groups node0 security ipsec proposal HA protocol esp user@host# set groups node0 security ipsec proposal HA authentication-algorithm hmac-sha1-96 user@host# set groups node0 security ipsec proposal HA encryption-algorithm aes-256-cbc user@host# set groups node0 security ipsec policy HA perfect-forward-secrecy keys group20 user@host# set groups node0 security ipsec policy HA proposal HA user@host# set groups node0 security ipsec vpn HA ha-link-encryption user@host# set groups node0 security ipsec vpn HA ike gateway HA user@host# set groups node0 security ipsec vpn HA ike ipsec-policy HA user@host# set groups node1 security ike proposal HA authentication-method pre-shared-keys user@host# set groups node1 security ike proposal HA dh-group group20 user@host# set groups node1 security ike proposal HA authentication-algorithm sha-256 user@host# set groups node1 security ike proposal HA encryption-algorithm aes-256-cbc user@host# set groups node1 security ike policy HA proposals HA user@host# prompt groups node1 security ike policy HA pre-shared-key ascii-text New ascii-text(secret): juniper Retype This Should Be A Strong And Secure Key user@host# set groups node1 security ike gateway HA ike-policy HA user@host# set groups node1 security ike gateway HA version v2-only user@host# set groups node1 security ipsec proposal HA protocol esp user@host# set groups node1 security ipsec proposal HA authentication-algorithm hmac-sha1-96 user@host# set groups node1 security ipsec proposal HA encryption-algorithm aes-256-cbc user@host# set groups node1 security ipsec policy HA perfect-forward-secrecy keys group20 user@host# set groups node1 security ipsec policy HA proposals HA user@host# set groups node1 security ipsec vpn HA ha-link-encryption user@host# set groups node1 security ipsec vpn HA ike gateway HA user@host# set groups node1 security ipsec vpn HA ike ipsec-policy HA user@host# commit user@host> request system reboot - Pour poursuivre la configuration et la validation de l’appareil 2, vous devez vous assurer que l’appareil 1 et l’appareil 2 ne sont pas accessibles l’un à l’autre. Une façon d’y parvenir est d’éteindre l’appareil 1 à ce stade.
- Une fois que l’appareil 2 est opérationnel, configurez le chiffrement de la liaison HA comme indiqué dans l’exemple de configuration ci-dessous sur l’appareil 2. L’équipement 2 doit être configuré avec la configuration de chiffrement de liaison HA noeud0 et noeud1. Validez sur le nœud 1 (périphérique 2), puis redémarrez le nœud 1 (périphérique 2).
[edit] user@host# set groups node0 security ike proposal HA authentication-method pre-shared-keys user@host# set groups node0 security ike proposal HA dh-group group20 user@host# set groups node0 security ike proposal HA authentication-algorithm sha-256 user@host# set groups node0 security ike proposal HA encryption-algorithm aes-256-cbc user@host# set groups node0 security ike policy HA proposals HA user@host# prompt groups node0 security ike policy HA pre-shared-key ascii-text This Should Be A Strong And Secure Key Retype This Should Be A Strong And Secure Key user@host# set groups node0 security ike gateway HA ike-policy HA user@host# set groups node0 security ike gateway HA version v2-only user@host# set groups node0 security ipsec proposal HA protocol esp user@host# set groups node0 security ipsec proposal HA authentication-algorithm hmac-sha1-96 user@host# set groups node0 security ipsec proposal HA encryption-algorithm aes-256-cbc user@host# set groups node0 security ipsec policy HA perfect-forward-secrecy keys group20 user@host# set groups node0 security ipsec policy HA proposal HA user@host# set groups node0 security ipsec vpn HA ha-link-encryption user@host# set groups node0 security ipsec vpn HA ike gateway HA user@host# set groups node0 security ipsec vpn HA ike ipsec-policy HA user@host# set groups node1 security ike proposal HA authentication-method pre-shared-keys user@host# set groups node1 security ike proposal HA dh-group group20 user@host# set groups node1 security ike proposal HA authentication-algorithm sha-256 user@host# set groups node1 security ike proposal HA encryption-algorithm aes-256-cbc user@host# set groups node1 security ike policy HA proposals HA user@host# prompt groups node1 security ike policy HA pre-shared-key ascii-text New ascii-text(secret): juniper Retype This Should Be A Strong And Secure Key user@host# set groups node1 security ike gateway HA ike-policy HA user@host# set groups node1 security ike gateway HA version v2-only user@host# set groups node1 security ipsec proposal HA protocol esp user@host# set groups node1 security ipsec proposal HA authentication-algorithm hmac-sha1-96 user@host# set groups node1 security ipsec proposal HA encryption-algorithm aes-256-cbc user@host# set groups node1 security ipsec policy HA perfect-forward-secrecy keys group20 user@host# set groups node1 security ipsec policy HA proposals HA user@host# set groups node1 security ipsec vpn HA ha-link-encryption user@host# set groups node1 security ipsec vpn HA ike gateway HA user@host# set groups node1 security ipsec vpn HA ike ipsec-policy HA user@host# commit user@host> request system rebootREMARQUE : Pour activer le chiffrement des liens HA sur le nœud 1 à l’étape 3, l’autre nœud doit être à l’état perdu pour que la validation puisse être effectuée. Vous devez donc vous occuper de ce timing, sinon l’étape 3 doit être refaite jusqu’à ce que l’activation du chiffrement des liens HA sur le commit du nœud 1 soit effectuée.