付録:eBGPルーティングプロトコルを使用したレイヤー3の出口(フルアクティブ/アクティブピアリング)
注:
キャンパスファブリックでVLANまたはVRFの作成を作成するときは、次のベストプラクティスを覚えておいてください。スイッチテンプレートにすべてのVLANを作成し、キャンパスファブリック設定ダイアログにインポートします。ジュニパー Mistポータルの他の場所にVLANを作成すると、最終的に一貫性が失われ、問題の解決が困難になります。必要に応じて、ファブリックは必要なVRFを作成します。ジュニパー Mist ポータルの他の場所には、手動で VRF を作成しないでください。スイッチテンプレート内にポートプロファイルを作成し、変更がファブリック内のすべてのスイッチで同期されるようにすることをお勧めします。
開始する前に、ルーティングプロトコル交換の実装方法、ポイントツーポイントリンクの設定方法、VRFを間接的に識別するためのVLAN割り当ての分散方法を決定するための設計を作成する必要があります。IP Clos設計のアクセススイッチなど、ファブリック内の別の場所にVRFが作成されている場合でも、レイヤー3の出口が設定されると、すべてのサービスブロック機能で自動的に再作成されます。
WAN ルーター接続ごとに、追加のトランスポート VLAN を VRF に追加してから、サービスブロック機能でカスタム VRF として設定する必要があります。この設計では 2 つの WAN ルーターを使用するため、各 VRF では BGP ピアリングを確立するために、サービスブロック機能上に 2 つの追加のトランスポート VLAN が必要です。トランスポートVLANを使用する場合、EVPNファブリックのオーバーレイネットワーク定義にトランスポートVLANを含めないでください。これらのVLANは、ネットワークを定義する際のキャンパスファブリック設定ダイアログで選択されていない限り、スイッチテンプレートに追加できます。または、ローカルで必要なサービスブロック機能でのみ作成できます。すべてのトランスポートVLANは、ネットワーク名とVLAN IDのみで作成する必要があります。
ポイントツーポイントリンクを定義する際、ファブリックで使用される範囲(デフォルトでは10.255.240.0/20)と重複しない範囲からIPアドレスを選択します。/31サブネットマスクが一般的に使用され、偶数のIPアドレスをWANルーターに、奇数のIPアドレスをファブリックに割り当てます。システムでは、物理接続を介した各ポイントツーポイントリンクに対してVLANを定義する必要があります。このアプローチでは、複数のVRFを1本のアップリンクケーブル上で多重化でき、VLANは関連するVRFを内部的に参照することができます。eBGPの場合、ピアリングセッションにプライベートAS番号も定義する必要があります。デフォルトでは、ファブリックは内部的にEVPNコントロールプレーンに65000 ASを使用し、各ノードの設定可能なASプールから65001から始まるAS番号を割り当てます。これらの割り当てとの競合を回避するには、65000未満のプライベートAS番号を使用することをお勧めします。
分離のためにVRFごとに個別のプライベートASを使用することは技術的には可能ですが、QFXプラットフォームは最大16個のローカルVRFをサポートしているため、これは良いプラクティスとは見なされません。 サービスブロック機能上のすべてのVRF間で共有ASを使用することが推奨されるアプローチです。この例では、WANルーターごとに異なるASが選択されました。
下の図は、ファブリックの 2 つのサービスブロック機能が最初の WAN ルーターにどのように接続されるかを示しています。
図1:ルーター1
WANへのBGP
WANへのBGP
下の図は、ファブリックの 2 つのサービスブロック機能が 2 番目の WAN ルーターにどのように接続されるかを示しています。各 VRF の VLAN の 2 番目のブロックが使用されていることに注意してください。
図2:ルーター2の
WANへのBGP
WANへのBGP
以下は、サービスブロック機能としてのcore1とcore2、および2つのWANルーターの完全な構成表です。eBGP用に選択されたAS番号も表示されます。
| スイッチ | スイッチAS | VRF | コアP2P IP | コアIF | WANルーター | WANルーターP2P IP | WANルーターAS | WANルーターのIF | VLAN ID |
|---|---|---|---|---|---|---|---|---|---|
| コア1 | 64911 | カスタマーA | 10.255.224.1/31 | ge-0/0/3.101 | WANルーター1 | 10.255.224.0/31 | 64901 | ge-0/0/1.101 | 101 |
| コア1 | 64911 | カスタマーB | 10.255.224.3/31 | ge-0/0/3.102 | WANルーター1 | 10.255.224.2/31 | 64901 | ge-0/0/1.102 | 102 |
| コア1 | 64911 | デバイス | 10.255.224.5/31 | ge-0/0/3.103 | WANルーター1 | 10.255.224.4/31 | 64901 | ge-0/0/1.103 | 103 |
| コア1 | 64911 | カスタマーA | 10.255.225.1/31 | ge-0/0/4.101 | WANルーター2 | 10.255.225.0/31 | 64902 | ge-0/0/1.101 | 101 |
| コア1 | 64911 | カスタマーB | 10.255.225.3/31 | ge-0/0/4.102 | WANルーター2 | 10.255.225.2/31 | 64902 | ge-0/0/1.102 | 102 |
| コア1 | 64911 | デバイス | 10.255.225.5/31 | ge-0/0/4.103 | WANルーター2 | 10.255.225.4/31 | 64902 | ge-0/0/1.103 | 103 |
| コア2 | 64911 | カスタマーA | 10.255.226.1/31 | ge-0/0/3.201 | WANルーター1 | 10.255.226.0/31 | 64901 | ge-0/0/2.201 | 201 |
| コア2 | 64911 | カスタマーB | 10.255.226.3/31 | ge-0/0/3.202 | WANルーター1 | 10.255.226.2/31 | 64901 | ge-0/0/2.202 | 202 |
| コア2 | 64911 | デバイス | 10.255.226.5/31 | ge-0/0/3.203 | WANルーター1 | 10.255.226.4/31 | 64901 | ge-0/0/2.203 | 203 |
| コア2 | 64911 | カスタマーA | 10.255.227.1/31 | ge-0/0/4.201 | WANルーター2 | 10.255.227.0/31 | 64902 | ge-0/0/2.201 | 201 |
| コア2 | 64911 | カスタマーB | 10.255.227.3/31 | ge-0/0/4.202 | WANルーター2 | 10.255.227.2/31 | 64902 | ge-0/0/2.202 | 202 |
| コア2 | 64911 | デバイス | 10.255.227.5/31 | ge-0/0/4.203 | WANルーター2 | 10.255.227.4/31 | 64902 | ge-0/0/2.203 | 203 |
ファブリック作成
以下のコードブロックは、このファブリックで使用されるスイッチテンプレートのエクスポートされたバージョンを示しています。これにより、インポート時に設定を確認できます。ご覧のとおり、VRFごとに最低2つのVLANがあります。L3出口モデルでは、WANルーターとVRFごとに1つのVLANが必要であることに留意してください)。
{
"additional_config_cmds": [],
"networks": {
"vlan1099": {
"vlan_id": 1099,
"subnet": "10.99.99.0/24"
},
"vlan1088": {
"vlan_id": 1088,
"subnet": "10.88.88.0/24"
},
"vlan1033": {
"vlan_id": 1033,
"subnet": "10.33.33.0/24"
},
"vlan1091": {
"vlan_id": 1091,
"subnet": "10.99.91.0/24"
},
"vlan1081": {
"vlan_id": 1081,
"subnet": "10.88.81.0/24"
},
"vlan1031": {
"vlan_id": 1031,
"subnet": "10.33.31.0/24"
}
},
"port_usages": {
"vlan1099": {
"mode": "access",
"disabled": false,
"port_network": "vlan1099",
"voip_network": null,
"stp_edge": false,
"mac_auth_protocol": null,
"all_networks": false,
"networks": null,
"port_auth": null,
"enable_mac_auth": null,
"mac_auth_only": null,
"guest_network": null,
"bypass_auth_when_server_down": null,
"speed": "auto",
"duplex": "auto",
"mac_limit": 0,
"persist_mac": false,
"poe_disabled": false,
"enable_qos": false,
"storm_control": {},
"mtu": null,
"description": "",
"disable_autoneg": false
},
"vlan1088": {
"mode": "access",
"disabled": false,
"port_network": "vlan1088",
"voip_network": null,
"stp_edge": false,
"mac_auth_protocol": null,
"all_networks": false,
"networks": null,
"port_auth": null,
"enable_mac_auth": null,
"mac_auth_only": null,
"guest_network": null,
"bypass_auth_when_server_down": null,
"speed": "auto",
"duplex": "auto",
"mac_limit": 0,
"persist_mac": false,
"poe_disabled": false,
"enable_qos": false,
"storm_control": {},
"mtu": null,
"description": "",
"disable_autoneg": false
},
"dynamic": {
"mode": "dynamic",
"reset_default_when": "link_down",
"rules": []
}
},
"switch_matching": {
"enable": true,
"rules": []
},
"switch_mgmt": {
"config_revert_timer": 10,
"root_password": "<password>",
"protect_re": {
"enabled": false
},
"tacacs": {
"enabled": false
}
},
"mist_nac": {
"enabled": true,
"network": null
},
"radius_config": {
"auth_servers": [],
"acct_servers": [],
"auth_servers_timeout": 5,
"auth_servers_retries": 3,
"fast_dot1x_timers": false,
"acct_interim_interval": 0,
"auth_server_selection": "ordered",
"coa_enabled": false,
"coa_port": ""
},
"vrf_config": {
"enabled": false
},
"remote_syslog": {
"enabled": false
},
"snmp_config": {
"enabled": false
},
"dhcp_snooping": {
"enabled": false
},
"dns_servers": [],
"dns_suffix": [],
"ntp_servers": [],
"acl_policies": [],
"port_mirroring": {},
"name": "campus-fabric"
}
キャンパスファブリック設定ダイアログ内に「ネットワークの設定」というページがあります。ここで、スイッチテンプレートから3 * 2 = 6VLANをインポートします。この場合、結果は次の画像のようになります。
図3:スイッチテンプレート.png)
からのネットワークインポート
からのネットワークインポート
次のステップでは、以下に示すように、3つのVRFをすべて作成し、それぞれに2つのネットワークを接続します。
図4:3つのVRFの.png)
を作成する
を作成する
次に、各 VRF に移動して、手動ルートをすべて削除します。後でVRFを識別するため、各VRFに少なくとも2つのVLANが接続されていることを確認してください。
図5:最初のVRF.png)
に割り当てるネットワーク
に割り当てるネットワーク
これは2番目のVRF用です。
図6:2番目のVRF.png)
に割り当てるネットワーク
に割り当てるネットワーク
これは3番目のVRF用です。
図7:ネットワークが第3のVRF.png)
に割り当てる
に割り当てる
Core1 スイッチの設定
この例では、サービスブロック機能は仮想であり、コアスイッチ上に同じ場所に配置されています。そのため、2つのコアスイッチを設定する必要があります。以下の疑似コードブロックは、 core1スイッチで設定する必要がある内容を説明しています。
# create the following transport networks either in a switch-template or locally on each service switch # create network name:trans101 with VLAN-ID:101 # create network name:trans102 with VLAN-ID:102 # create network name:trans103 with VLAN-ID:103 # create network name:trans201 with VLAN-ID:201 # create network name:trans202 with VLAN-ID:202 # create network name:trans203 with VLAN-ID:203 # # configure the Additional IP-Subnet 10.255.224.1 255.255.255.254 to Network/VLAN:trans101 # configure the Additional IP-Subnet 10.255.224.3 255.255.255.254 to Network/VLAN:trans102 # configure the Additional IP-Subnet 10.255.224.5 255.255.255.254 to Network/VLAN:trans103 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/3 as L3-Sub-Interfaces with MTU=9018 # # configure the Additional IP-Subnet 10.255.225.1 255.255.255.254 to Network/VLAN:trans201 # configure the Additional IP-Subnet 10.255.225.3 255.255.255.254 to Network/VLAN:trans202 # configure the Additional IP-Subnet 10.255.225.5 255.255.255.254 to Network/VLAN:trans203 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/4 as L3-Sub-Interfaces with MTU=9018 # # configure on VRF # configure on instance customera # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans101 # add to existing overlay-vlans the vlan:trans201 # # configure on instance customerb # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans102 # add to existing overlay-vlans the vlan:trans202 # # configure on instance devices # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans103 # add to existing overlay-vlans the vlan:trans203 # # Enable BGP # Create an Export policy called 'export-vrfs' # Add to this export Policy the following Networks as: # - Add Term w. Name=exclude-default Prefix=0.0.0.0/0 Protocol=None Then=Reject # - Add Term w. Name=fabric-all-no-hosts Prefix=0.0.0.0/0-30 Protocol=None Then=Accept # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept # # Create an Export policy called 'import-default' # - Name=default Prefix=0.0.0.0/0 Protocol=BGP Action=Accept # # Create a BGP Group with: # - Name=customera0 # - Type=External # - Network (VLAN)=trans101 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.0 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb0 # - Type=External # - Network (VLAN)=trans102 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.2 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=devices0 # - Type=External # - Network (VLAN)=trans103 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.4 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customera1 # - Type=External # - Network (VLAN)=trans201 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.225.0 Neighbor_AS=64902 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb1 # - Type=External # - Network (VLAN)=trans202 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.225.2 Neighbor_AS=64902 Hold-Time=90 # # Create a BGP Group with: # - Name=devices1 # - Type=External # - Network (VLAN)=trans203 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.225.4 Neighbor_AS=64902 Hold-Time=90
以下に、上記の構成の大部分を示すスクリーンショットをいくつか紹介します。最初のスクリーンショットは、ローカルで定義された追加のトランスポートVLANを示しています。6つのうち最初の2つだけが下のスクリーンショットに表示されています。VLAN1099などのオーバーレイVLANは、スイッチテンプレートを介して継承されることに注意してください。
図8:サービスブロック機能.png)
に関するローカルネットワーク
に関するローカルネットワーク
追加の IP 設定から始めます。2つのサービスブロック機能間で同じVLANが使用されますが、それぞれが異なるポイントツーポイントIPアドレスを使用することに注意してください。また、トランスポートVLANは、BGPピアリングを定義する際、対応するBGPへの参照として機能することにも留意してください。
図9:トランスポートネットワーク.png)
用の追加IPアドレス
用の追加IPアドレス
定義する6つのトランスポートVLANのうちの1つの例を次に示します。
図10:トランスポートVLAN .png)
用のピアリングIPアドレス
用のピアリングIPアドレス
ポート設定では、レイヤー3サブインターフェイスを使用し、定義された最初のサブインターフェイスセットに関連付けることが不可欠です。
図11:トランスポートVLAN 最初のWANルーター.png)
のポート設定
のポート設定
もう一方のWANルーターに向けた2番目のポート設定では、残りのサブインターフェイスがそれに応じて関連付けられます。
図12:トランスポートVLAN 2番目のWANルーター.png)
のポート設定
のポート設定
次のステップでは、すべてのトランスポートVLANをカスタムネットワークとして各VRFに追加して、VRF内で認識されるようにします。示したように、各VRFには最終的に4つのネットワークが含まれます。2つはオーバーレイで使用され、2つはサービスブロック機能で追加された追加のトランスポートVLANです。
図13:トランスポートVLANとオーバーレイVLANを備えたカスタマイズされたVRF .png)
個々のカスタムVRFは、以下の例のようになります。
図14:トランスポートVLANを追加したVRF1 .png)
注:
スイッチテンプレートとキャンパスファブリック設定インターフェイスを使用してオーバーレイVLANを追加または削除する場合は、サービスブロック機能上のカスタムVRFでも同じ変更を行う必要があります。これらのVLANは自動的に追加されないため、このステップを見落とすと、WANルーターにアドバタイズされません。
次に、3 つの VRF と 2 つの WAN ルーターがあるため、6 つのピアすべてで eBGP 設定全体を入力する必要があります。完了すると、概要ページは次の画像のようになります。
次のステップは、2つのルーティングポリシーを定義することです。
図15:ルーティングポリシー.png)
この例では、エクスポート ルート ポリシーに次の条件が含まれています。
- Term=
exclude-defaultは、最初のWANルーターから学習したデフォルトルートが2番目のWANルーターにエクスポートされないようにし、その逆も防止します。 - Term=
fabric-all-no-hostsは、設定されたすべてのVRFとそれに関連するVLANにわたるファブリックからのすべてのルートを自動的にエクスポートします。ただし、ポイントツーポイントリンクと単一ホストルートは除外されます。これは、プレフィックス0.0.0.0/0-30を使用することで実現します。ここで、Junos OSで0-30を指定すると、/30までの「orlonger」プレフィックス範囲を表します。 - Term=
overlaylo0は、DHCPリレーに使用されるオーバーレイループバックIPアドレスをホストプレフィックスレベルまでエクスポートします。これらは通常、lo0.xインターフェイスに個別に割り当てられるためです。これを実現するために、プレフィックス 172.16.192.0/24-32 が使用され、範囲をホストレベルのプレフィックスまで拡張できますが、これは前のステートメントでは行われていません。
図16:エクスポートポリシー.png)
必要に応じて、ホストIPアドレスで表されるファブリック内の個々のクライアントのルートを含む、すべてのルートをエクスポートする 0.0.0.0/0-32 などの単一の用語を使用することで、ルールセットを簡略化できます。このアプローチはデバッグにも役立ちます。WANルーターのASパス情報を調べることで、どのEVPNファブリックスイッチが特定のホストIPを通知しているのかが明らかになります。
ただし、このアプローチでは、大量のルートがWANルーターと交換される可能性があるのに対し、デフォルト設定の 0.0.0.0/0-30 では、ルート共有が設定されたVLANにのみ関連付けられたプレフィックスに制限されるのに対し、欠点があります。
10.99.99.0/24 *[BGP/170] 01:00:32, localpref 100, from 10.255.224.1
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.224.1 via ge-0/0/1.101
> to 10.255.226.1 via ge-0/0/2.101
[BGP/170] 01:00:32, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.226.1 via ge-0/0/2.101
10.99.99.99/32 *[BGP/170] 00:01:33, localpref 100, from 10.255.224.1
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.224.1 via ge-0/0/1.101
> to 10.255.226.1 via ge-0/0/2.101
[BGP/170] 00:01:33, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.226.1 via ge-0/0/2.101
インポートポリシーは、WANルーターからデフォルトルートをインポートします。
図17:ポリシー
のインポート
のインポート
図18 は、必要なエントリが呼び出された単一のBGPピアリングエントリの設定を示しています。
図18:ピアリングエントリー
BGP例
BGP例
また、WAN ルーターを BGP ネイバーとして定義する必要があります。
図19に示すように警告メッセージが表示される場合があります。それらは無視しても問題ありません。
図19:潜在的な警告メッセージ
注:
スイッチテンプレートとキャンパスファブリック設定インターフェイスを使用してオーバーレイVLANを追加または削除する場合は、サービスブロック機能上のカスタムVRFでも同じ変更を行う必要があります。これらのVLANは自動的に追加されないため、このステップを見落とすと、WANルーターにアドバタイズされません。
Core2 スイッチの設定
以下の擬似コードは、 core2 スイッチに適用する必要がある設定を表しています。最初の WAN ルーターからの変更点が強調表示されます。
# create the following transport networks either in a switch-template or locally on each service switch # create network name:trans101 with VLAN-ID:101 # create network name:trans102 with VLAN-ID:102 # create network name:trans103 with VLAN-ID:103 # create network name:trans201 with VLAN-ID:201 # create network name:trans202 with VLAN-ID:202 # create network name:trans203 with VLAN-ID:203 # # configure the Additional IP-Subnet 10.255.226.1 255.255.255.254 to Network/VLAN:trans101 # configure the Additional IP-Subnet 10.255.226.3 255.255.255.254 to Network/VLAN:trans102 # configure the Additional IP-Subnet 10.255.226.5 255.255.255.254 to Network/VLAN:trans103 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/3 as L3-Sub-Interfaces with MTU=9018 # # configure the Additional IP-Subnet 10.255.227.1 255.255.255.254 to Network/VLAN:trans201 # configure the Additional IP-Subnet 10.255.227.3 255.255.255.254 to Network/VLAN:trans202 # configure the Additional IP-Subnet 10.255.227.5 255.255.255.254 to Network/VLAN:trans203 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/4 as L3-Sub-Interfaces with MTU=9018 # # configure on VRF # configure on instance customera # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans101 # add to existing overlay-vlans the vlan:trans201 # # configure on instance customerb # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans102 # add to existing overlay-vlans the vlan:trans202 # # configure on instance devices # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans103 # add to existing overlay-vlans the vlan:trans203 # # Enable BGP # Create an Export policy called 'export-vrfs' # Add to this export Policy the following Networks as: # - Add Term w. Name=exclude-default Prefix=0.0.0.0/0 Protocol=None Then=Reject # - Add Term w. Name=fabric-all-no-hosts Prefix=0.0.0.0/0-30 Protocol=None Then=Accept # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept # # Create an Export policy called 'import-default' # - Name=default Prefix=0.0.0.0/0 Protocol=BGP Action=Accept # # Create a BGP Group with: # - Name=customera0 # - Type=External # - Network (VLAN)=trans101 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.0 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb0 # - Type=External # - Network (VLAN)=trans102 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.2 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=devices0 # - Type=External # - Network (VLAN)=trans103 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.4 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customera1 # - Type=External # - Network (VLAN)=trans201 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.227.0 Neighbor_AS=64902 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb1 # - Type=External # - Network (VLAN)=trans202 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.227.2 Neighbor_AS=64902 Hold-Time=90 # # Create a BGP Group with: # - Name=devices1 # - Type=External # - Network (VLAN)=trans203 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.227.4 Neighbor_AS=64902 Hold-Time=90
ポイントツーポイントサブネットとBGPネイバーを除き、core2スイッチの設定はcore1スイッチの設定と同じです。
図20:Core2スイッチの追加IP設定
図21:Core2スイッチBGPネイバー設定
WANルーターとしてのジュニパーMX
以下のコードブロックは、ポイントツーポイントインターフェイスのJunos OS CLI設定、すべてのBGPネイバーを含む完全なBGP設定、各WANルーターのインポートおよびエクスポートルートポリシーを示しています。ファブリックにアドバタイズする必要があるため、設定を完了するためにデフォルトのルートとインターフェイスを追加する必要がある場合がありますが、デバイスがそれらのルートをどのように学習するのかは不明です。
最初の WAN ルーターの CLI 設定は次のとおりです。
set system host-name wanrouter1 # delete interfaces ge-0/0/1 set interfaces ge-0/0/1 flexible-vlan-tagging set interfaces ge-0/0/1 mtu 9014 set interfaces ge-0/0/1 unit 101 description trans101 set interfaces ge-0/0/1 unit 101 vlan-id 101 set interfaces ge-0/0/1 unit 101 family inet address 10.255.224.0/31 set interfaces ge-0/0/1 unit 102 description trans102 set interfaces ge-0/0/1 unit 102 vlan-id 102 set interfaces ge-0/0/1 unit 102 family inet address 10.255.224.2/31 set interfaces ge-0/0/1 unit 103 description trans103 set interfaces ge-0/0/1 unit 103 vlan-id 103 set interfaces ge-0/0/1 unit 103 family inet address 10.255.224.4/31 # delete interfaces ge-0/0/2 set interfaces ge-0/0/2 flexible-vlan-tagging set interfaces ge-0/0/2 mtu 9014 set interfaces ge-0/0/2 unit 101 description trans101 set interfaces ge-0/0/2 unit 101 vlan-id 101 set interfaces ge-0/0/2 unit 101 family inet address 10.255.226.0/31 set interfaces ge-0/0/2 unit 102 description trans102 set interfaces ge-0/0/2 unit 102 vlan-id 102 set interfaces ge-0/0/2 unit 102 family inet address 10.255.226.2/31 set interfaces ge-0/0/2 unit 103 description trans103 set interfaces ge-0/0/2 unit 103 vlan-id 103 set interfaces ge-0/0/2 unit 103 family inet address 10.255.226.4/31 # needed in and export policy delete policy-options set policy-options policy-statement fabric term 1 from protocol bgp set policy-options policy-statement fabric term 1 from route-filter 0.0.0.0/0 orlonger set policy-options policy-statement fabric term 1 then accept set policy-options policy-statement fabric term 2 then reject set policy-options policy-statement internet term 1 from protocol static set policy-options policy-statement internet term 1 from route-filter 0.0.0.0/0 exact set policy-options policy-statement internet term 1 then accept set policy-options policy-statement internet term 2 then reject # delete routing-instances public-int set routing-instances public-int instance-type virtual-router set routing-instances public-int interface ge-0/0/1.101 set routing-instances public-int interface ge-0/0/1.102 set routing-instances public-int interface ge-0/0/1.103 set routing-instances public-int interface ge-0/0/2.101 set routing-instances public-int interface ge-0/0/2.102 set routing-instances public-int interface ge-0/0/2.103 # delete routing-instances public-int protocols bgp group customera set routing-instances public-int protocols bgp group customera type external set routing-instances public-int protocols bgp group customera family inet unicast set routing-instances public-int protocols bgp group customera multipath multiple-as set routing-instances public-int protocols bgp group customera local-as 64901 set routing-instances public-int protocols bgp group customera hold-time 90 set routing-instances public-int protocols bgp group customera import fabric set routing-instances public-int protocols bgp group customera export internet set routing-instances public-int protocols bgp group customera bfd-liveness-detection minimum-interval 1000 set routing-instances public-int protocols bgp group customera bfd-liveness-detection multiplier 3 set routing-instances public-int protocols bgp group customera bfd-liveness-detection session-mode automatic set routing-instances public-int protocols bgp group customera neighbor 10.255.224.1 peer-as 64911 set routing-instances public-int protocols bgp group customera neighbor 10.255.226.1 peer-as 64911 # delete routing-instances public-int protocols bgp group customerb set routing-instances public-int protocols bgp group customerb type external set routing-instances public-int protocols bgp group customerb family inet unicast set routing-instances public-int protocols bgp group customerb multipath multiple-as set routing-instances public-int protocols bgp group customerb local-as 64901 set routing-instances public-int protocols bgp group customerb hold-time 90 set routing-instances public-int protocols bgp group customerb import fabric set routing-instances public-int protocols bgp group customerb export internet set routing-instances public-int protocols bgp group customerb bfd-liveness-detection minimum-interval 1000 set routing-instances public-int protocols bgp group customerb bfd-liveness-detection multiplier 3 set routing-instances public-int protocols bgp group customerb bfd-liveness-detection session-mode automatic set routing-instances public-int protocols bgp group customerb neighbor 10.255.224.3 peer-as 64911 set routing-instances public-int protocols bgp group customerb neighbor 10.255.226.3 peer-as 64911 # delete routing-instances public-int protocols bgp group devices set routing-instances public-int protocols bgp group devices type external set routing-instances public-int protocols bgp group devices family inet unicast set routing-instances public-int protocols bgp group devices multipath multiple-as set routing-instances public-int protocols bgp group devices local-as 64901 set routing-instances public-int protocols bgp group devices hold-time 90 set routing-instances public-int protocols bgp group devices import fabric set routing-instances public-int protocols bgp group devices export internet set routing-instances public-int protocols bgp group devices bfd-liveness-detection minimum-interval 1000 set routing-instances public-int protocols bgp group devices bfd-liveness-detection multiplier 3 set routing-instances public-int protocols bgp group devices bfd-liveness-detection session-mode automatic set routing-instances public-int protocols bgp group devices neighbor 10.255.224.5 peer-as 64911 set routing-instances public-int protocols bgp group devices neighbor 10.255.226.5 peer-as 64911
2 番目の WAN ルーターの設定は次のとおりです。
set system host-name wanrouter2 # delete interfaces ge-0/0/1 set interfaces ge-0/0/1 flexible-vlan-tagging set interfaces ge-0/0/1 mtu 9014 set interfaces ge-0/0/1 unit 201 description trans201 set interfaces ge-0/0/1 unit 201 vlan-id 201 set interfaces ge-0/0/1 unit 201 family inet address 10.255.225.0/31 set interfaces ge-0/0/1 unit 202 description trans202 set interfaces ge-0/0/1 unit 202 vlan-id 202 set interfaces ge-0/0/1 unit 202 family inet address 10.255.225.2/31 set interfaces ge-0/0/1 unit 203 description trans203 set interfaces ge-0/0/1 unit 203 vlan-id 203 set interfaces ge-0/0/1 unit 203 family inet address 10.255.225.4/31 # delete interfaces ge-0/0/2 set interfaces ge-0/0/2 flexible-vlan-tagging set interfaces ge-0/0/2 mtu 9014 set interfaces ge-0/0/2 unit 201 description trans201 set interfaces ge-0/0/2 unit 201 vlan-id 201 set interfaces ge-0/0/2 unit 201 family inet address 10.255.227.0/31 set interfaces ge-0/0/2 unit 202 description trans202 set interfaces ge-0/0/2 unit 202 vlan-id 202 set interfaces ge-0/0/2 unit 202 family inet address 10.255.227.2/31 set interfaces ge-0/0/2 unit 203 description trans203 set interfaces ge-0/0/2 unit 203 vlan-id 203 set interfaces ge-0/0/2 unit 203 family inet address 10.255.227.4/31 # needed in and export policy delete policy-options set policy-options policy-statement fabric term 1 from protocol bgp set policy-options policy-statement fabric term 1 from route-filter 0.0.0.0/0 orlonger set policy-options policy-statement fabric term 1 then accept set policy-options policy-statement fabric term 2 then reject set policy-options policy-statement internet term 1 from protocol static set policy-options policy-statement internet term 1 from route-filter 0.0.0.0/0 exact set policy-options policy-statement internet term 1 then accept set policy-options policy-statement internet term 2 then reject # delete routing-instances public-int set routing-instances public-int instance-type virtual-router set routing-instances public-int interface ge-0/0/1.201 set routing-instances public-int interface ge-0/0/1.202 set routing-instances public-int interface ge-0/0/1.203 set routing-instances public-int interface ge-0/0/2.201 set routing-instances public-int interface ge-0/0/2.202 set routing-instances public-int interface ge-0/0/2.203 # delete routing-instances public-int protocols bgp group customera set routing-instances public-int protocols bgp group customera type external set routing-instances public-int protocols bgp group customera family inet unicast set routing-instances public-int protocols bgp group customera multipath multiple-as set routing-instances public-int protocols bgp group customera local-as 64902 set routing-instances public-int protocols bgp group customera hold-time 90 set routing-instances public-int protocols bgp group customera import fabric set routing-instances public-int protocols bgp group customera export internet set routing-instances public-int protocols bgp group customera bfd-liveness-detection minimum-interval 1000 set routing-instances public-int protocols bgp group customera bfd-liveness-detection multiplier 3 set routing-instances public-int protocols bgp group customera bfd-liveness-detection session-mode automatic set routing-instances public-int protocols bgp group customera neighbor 10.255.225.1 peer-as 64911 set routing-instances public-int protocols bgp group customera neighbor 10.255.227.1 peer-as 64911 # delete routing-instances public-int protocols bgp group customerb set routing-instances public-int protocols bgp group customerb type external set routing-instances public-int protocols bgp group customerb family inet unicast set routing-instances public-int protocols bgp group customerb multipath multiple-as set routing-instances public-int protocols bgp group customerb local-as 64902 set routing-instances public-int protocols bgp group customerb hold-time 90 set routing-instances public-int protocols bgp group customerb import fabric set routing-instances public-int protocols bgp group customerb export internet set routing-instances public-int protocols bgp group customerb bfd-liveness-detection minimum-interval 1000 set routing-instances public-int protocols bgp group customerb bfd-liveness-detection multiplier 3 set routing-instances public-int protocols bgp group customerb bfd-liveness-detection session-mode automatic set routing-instances public-int protocols bgp group customerb neighbor 10.255.225.3 peer-as 64911 set routing-instances public-int protocols bgp group customerb neighbor 10.255.227.3 peer-as 64911 # delete routing-instances public-int protocols bgp group devices set routing-instances public-int protocols bgp group devices type external set routing-instances public-int protocols bgp group devices family inet unicast set routing-instances public-int protocols bgp group devices multipath multiple-as set routing-instances public-int protocols bgp group devices local-as 64902 set routing-instances public-int protocols bgp group devices hold-time 90 set routing-instances public-int protocols bgp group devices import fabric set routing-instances public-int protocols bgp group devices export internet set routing-instances public-int protocols bgp group devices bfd-liveness-detection minimum-interval 1000 set routing-instances public-int protocols bgp group devices bfd-liveness-detection multiplier 3 set routing-instances public-int protocols bgp group devices bfd-liveness-detection session-mode automatic set routing-instances public-int protocols bgp group devices neighbor 10.255.225.5 peer-as 64911 set routing-instances public-int protocols bgp group devices neighbor 10.255.227.5 peer-as 64911
以下のCLIコマンドを使用して、WANルーター1でのデバッグを支援できます。
root@wanrouter1> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 3 Peers: 6 Down peers: 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
10.255.224.1 64911 195 189 0 0 1:25:10 Establ
public-int.inet.0: 5/6/6/0
10.255.224.3 64911 194 189 0 0 1:25:14 Establ
public-int.inet.0: 5/6/6/0
10.255.224.5 64911 192 189 0 0 1:25:14 Establ
public-int.inet.0: 5/6/6/0
10.255.226.1 64911 197 188 0 0 1:25:05 Establ
public-int.inet.0: 5/6/6/0
10.255.226.3 64911 196 188 0 0 1:25:06 Establ
public-int.inet.0: 5/6/6/0
10.255.226.5 64911 195 189 0 0 1:25:00 Establ
public-int.inet.0: 5/6/6/0
#
root@wanrouter1> show route table public-int.inet.0
#
public-int.inet.0: 33 destinations, 51 routes (33 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
#
0.0.0.0/0 *[Static/5] 01:25:28
> to 192.168.230.1 via ge-0/0/0.0
10.31.31.0/24 *[BGP/170] 01:24:06, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.224.5 via ge-0/0/1.103
> to 10.255.226.5 via ge-0/0/2.103
[BGP/170] 01:24:06, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.224.5 via ge-0/0/1.103
10.33.33.0/24 *[BGP/170] 01:24:06, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.224.5 via ge-0/0/1.103
> to 10.255.226.5 via ge-0/0/2.103
[BGP/170] 01:24:06, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.224.5 via ge-0/0/1.103
10.81.81.0/24 *[BGP/170] 01:24:06, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.224.3 via ge-0/0/1.102
> to 10.255.226.3 via ge-0/0/2.102
[BGP/170] 01:24:06, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.224.3 via ge-0/0/1.102
10.88.88.0/24 *[BGP/170] 01:24:06, localpref 100, from 10.255.224.3
AS path: 64911 65002 65004 65005 I, validation-state: unverified
to 10.255.224.3 via ge-0/0/1.102
> to 10.255.226.3 via ge-0/0/2.102
[BGP/170] 01:24:06, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
> to 10.255.226.3 via ge-0/0/2.102
10.91.91.0/24 *[BGP/170] 01:24:06, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.224.1 via ge-0/0/1.101
> to 10.255.226.1 via ge-0/0/2.101
[BGP/170] 01:24:06, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.224.1 via ge-0/0/1.101
10.99.99.0/24 *[BGP/170] 01:24:41, localpref 100, from 10.255.224.1
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.224.1 via ge-0/0/1.101
> to 10.255.226.1 via ge-0/0/2.101
[BGP/170] 01:24:41, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.226.1 via ge-0/0/2.101
10.255.224.0/31 *[Direct/0] 01:25:28
> via ge-0/0/1.101
10.255.224.0/32 *[Local/0] 01:25:28
Local via ge-0/0/1.101
10.255.224.2/31 *[Direct/0] 01:25:28
> via ge-0/0/1.102
10.255.224.2/32 *[Local/0] 01:25:28
Local via ge-0/0/1.102
10.255.224.4/31 *[Direct/0] 01:25:28
> via ge-0/0/1.103
10.255.224.4/32 *[Local/0] 01:25:28
Local via ge-0/0/1.103
10.255.226.0/31 *[Direct/0] 01:25:27
> via ge-0/0/2.101
10.255.226.0/32 *[Local/0] 01:25:27
Local via ge-0/0/2.101
10.255.226.2/31 *[Direct/0] 01:25:27
> via ge-0/0/2.102
10.255.226.2/32 *[Local/0] 01:25:27
Local via ge-0/0/2.102
10.255.226.4/31 *[Direct/0] 01:25:27
> via ge-0/0/2.103
10.255.226.4/32 *[Local/0] 01:25:27
Local via ge-0/0/2.103
172.16.192.1/32 *[BGP/170] 01:24:41, localpref 100, from 10.255.224.1
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.224.1 via ge-0/0/1.101
> to 10.255.226.1 via ge-0/0/2.101
[BGP/170] 01:24:41, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.226.1 via ge-0/0/2.101
172.16.192.2/32 *[BGP/170] 01:24:07, localpref 100, from 10.255.224.1
AS path: 64911 65002 65004 65006 I, validation-state: unverified
to 10.255.224.1 via ge-0/0/1.101
> to 10.255.226.1 via ge-0/0/2.101
[BGP/170] 01:24:07, localpref 100
AS path: 64911 65001 65004 65006 I, validation-state: unverified
> to 10.255.226.1 via ge-0/0/2.101
172.16.192.3/32 *[BGP/170] 01:24:07, localpref 100, from 10.255.224.3
AS path: 64911 65002 65004 65006 I, validation-state: unverified
to 10.255.224.3 via ge-0/0/1.102
> to 10.255.226.3 via ge-0/0/2.102
[BGP/170] 01:24:07, localpref 100
AS path: 64911 65001 65004 65006 I, validation-state: unverified
> to 10.255.226.3 via ge-0/0/2.102
172.16.192.4/32 *[BGP/170] 01:24:07, localpref 100, from 10.255.224.5
AS path: 64911 65002 65004 65006 I, validation-state: unverified
to 10.255.224.5 via ge-0/0/1.103
> to 10.255.226.5 via ge-0/0/2.103
[BGP/170] 01:24:07, localpref 100
AS path: 64911 65001 65004 65006 I, validation-state: unverified
> to 10.255.226.5 via ge-0/0/2.103
172.16.192.5/32 *[BGP/170] 01:24:41, localpref 100, from 10.255.224.3
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.224.3 via ge-0/0/1.102
> to 10.255.226.3 via ge-0/0/2.102
[BGP/170] 01:24:41, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.226.3 via ge-0/0/2.102
172.16.192.6/32 *[BGP/170] 01:24:41, localpref 100, from 10.255.224.5
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.224.5 via ge-0/0/1.103
> to 10.255.226.5 via ge-0/0/2.103
[BGP/170] 01:24:41, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.226.5 via ge-0/0/2.103
172.16.192.7/32 *[BGP/170] 01:25:23, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.224.1 via ge-0/0/1.101
[BGP/170] 01:25:17, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.226.1 via ge-0/0/2.101
172.16.192.8/32 *[BGP/170] 01:25:27, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.224.3 via ge-0/0/1.102
[BGP/170] 01:25:18, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.226.3 via ge-0/0/2.102
172.16.192.9/32 *[BGP/170] 01:25:27, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.224.5 via ge-0/0/1.103
[BGP/170] 01:25:13, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.226.5 via ge-0/0/2.103
172.16.192.10/32 *[BGP/170] 01:25:17, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.226.1 via ge-0/0/2.101
[BGP/170] 01:25:23, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.224.1 via ge-0/0/1.101
172.16.192.11/32 *[BGP/170] 01:25:18, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.226.3 via ge-0/0/2.102
[BGP/170] 01:25:27, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.224.3 via ge-0/0/1.102
172.16.192.12/32 *[BGP/170] 01:25:13, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.226.5 via ge-0/0/2.103
[BGP/170] 01:25:27, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.224.5 via ge-0/0/1.103
192.168.230.0/24 *[Direct/0] 01:25:28
> via ge-0/0/0.0
192.168.230.99/32 *[Local/0] 01:25:28
Local via ge-0/0/0.0
以下のCLIコマンドを使用して、WANルーター2でのデバッグを支援できます。
root@wanrouter2> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 3 Peers: 6 Down peers: 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
10.255.225.1 64911 201 193 0 0 1:27:07 Establ
public-int.inet.0: 5/7/7/0
10.255.225.3 64911 200 193 0 0 1:27:04 Establ
public-int.inet.0: 5/7/7/0
10.255.225.5 64911 197 192 0 0 1:27:00 Establ
public-int.inet.0: 5/7/7/0
10.255.227.1 64911 200 192 0 0 1:27:02 Establ
public-int.inet.0: 5/7/7/0
10.255.227.3 64911 200 192 0 0 1:26:58 Establ
public-int.inet.0: 5/7/7/0
10.255.227.5 64911 198 193 0 0 1:27:08 Establ
public-int.inet.0: 5/7/7/0
#
root@wanrouter2> show route table public-int.inet.0
#
public-int.inet.0: 33 destinations, 57 routes (33 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
#
0.0.0.0/0 *[Static/5] 01:27:27
> to 192.168.231.1 via ge-0/0/0.0
10.31.31.0/24 *[BGP/170] 01:26:27, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.225.5 via ge-0/0/1.203
> to 10.255.227.5 via ge-0/0/2.203
[BGP/170] 01:26:27, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.225.5 via ge-0/0/1.203
10.33.33.0/24 *[BGP/170] 01:26:27, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.225.5 via ge-0/0/1.203
> to 10.255.227.5 via ge-0/0/2.203
[BGP/170] 01:26:27, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.225.5 via ge-0/0/1.203
10.81.81.0/24 *[BGP/170] 01:26:27, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.225.3 via ge-0/0/1.202
> to 10.255.227.3 via ge-0/0/2.202
[BGP/170] 01:26:27, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.225.3 via ge-0/0/1.202
10.88.88.0/24 *[BGP/170] 01:26:27, localpref 100, from 10.255.225.3
AS path: 64911 65002 65004 65005 I, validation-state: unverified
to 10.255.225.3 via ge-0/0/1.202
> to 10.255.227.3 via ge-0/0/2.202
[BGP/170] 01:26:27, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
> to 10.255.227.3 via ge-0/0/2.202
10.91.91.0/24 *[BGP/170] 01:26:27, localpref 100
AS path: 64911 65001 65004 65005 I, validation-state: unverified
to 10.255.225.1 via ge-0/0/1.201
> to 10.255.227.1 via ge-0/0/2.201
[BGP/170] 01:26:27, localpref 100
AS path: 64911 65002 65004 65005 I, validation-state: unverified
> to 10.255.225.1 via ge-0/0/1.201
10.99.99.0/24 *[BGP/170] 01:27:03, localpref 100, from 10.255.225.1
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.225.1 via ge-0/0/1.201
> to 10.255.227.1 via ge-0/0/2.201
[BGP/170] 01:27:03, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.227.1 via ge-0/0/2.201
10.255.225.0/31 *[Direct/0] 01:27:28
> via ge-0/0/1.201
10.255.225.0/32 *[Local/0] 01:27:28
Local via ge-0/0/1.201
10.255.225.2/31 *[Direct/0] 01:27:28
> via ge-0/0/1.202
10.255.225.2/32 *[Local/0] 01:27:28
Local via ge-0/0/1.202
10.255.225.4/31 *[Direct/0] 01:27:28
> via ge-0/0/1.203
10.255.225.4/32 *[Local/0] 01:27:28
Local via ge-0/0/1.203
10.255.227.0/31 *[Direct/0] 01:27:27
> via ge-0/0/2.201
10.255.227.0/32 *[Local/0] 01:27:27
Local via ge-0/0/2.201
10.255.227.2/31 *[Direct/0] 01:27:27
> via ge-0/0/2.202
10.255.227.2/32 *[Local/0] 01:27:27
Local via ge-0/0/2.202
10.255.227.4/31 *[Direct/0] 01:27:27
> via ge-0/0/2.203
10.255.227.4/32 *[Local/0] 01:27:27
Local via ge-0/0/2.203
172.16.192.1/32 *[BGP/170] 01:27:03, localpref 100, from 10.255.225.1
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.225.1 via ge-0/0/1.201
> to 10.255.227.1 via ge-0/0/2.201
[BGP/170] 01:27:03, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.227.1 via ge-0/0/2.201
172.16.192.2/32 *[BGP/170] 01:26:28, localpref 100, from 10.255.225.1
AS path: 64911 65002 65004 65006 I, validation-state: unverified
to 10.255.225.1 via ge-0/0/1.201
> to 10.255.227.1 via ge-0/0/2.201
[BGP/170] 01:26:28, localpref 100
AS path: 64911 65001 65004 65006 I, validation-state: unverified
> to 10.255.227.1 via ge-0/0/2.201
172.16.192.3/32 *[BGP/170] 01:26:28, localpref 100, from 10.255.225.3
AS path: 64911 65002 65004 65006 I, validation-state: unverified
to 10.255.225.3 via ge-0/0/1.202
> to 10.255.227.3 via ge-0/0/2.202
[BGP/170] 01:26:28, localpref 100
AS path: 64911 65001 65004 65006 I, validation-state: unverified
> to 10.255.227.3 via ge-0/0/2.202
172.16.192.4/32 *[BGP/170] 01:26:28, localpref 100, from 10.255.225.5
AS path: 64911 65002 65004 65006 I, validation-state: unverified
to 10.255.225.5 via ge-0/0/1.203
> to 10.255.227.5 via ge-0/0/2.203
[BGP/170] 01:26:28, localpref 100
AS path: 64911 65001 65004 65006 I, validation-state: unverified
> to 10.255.227.5 via ge-0/0/2.203
172.16.192.5/32 *[BGP/170] 01:27:03, localpref 100, from 10.255.225.3
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.225.3 via ge-0/0/1.202
> to 10.255.227.3 via ge-0/0/2.202
[BGP/170] 01:27:03, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.227.3 via ge-0/0/2.202
172.16.192.6/32 *[BGP/170] 01:27:03, localpref 100, from 10.255.225.5
AS path: 64911 65002 65003 65005 I, validation-state: unverified
to 10.255.225.5 via ge-0/0/1.203
> to 10.255.227.5 via ge-0/0/2.203
[BGP/170] 01:27:03, localpref 100
AS path: 64911 65001 65003 65005 I, validation-state: unverified
> to 10.255.227.5 via ge-0/0/2.203
172.16.192.7/32 *[BGP/170] 01:27:22, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.225.1 via ge-0/0/1.201
[BGP/170] 01:27:17, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.227.1 via ge-0/0/2.201
172.16.192.8/32 *[BGP/170] 01:27:19, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.225.3 via ge-0/0/1.202
[BGP/170] 01:27:12, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.227.3 via ge-0/0/2.202
172.16.192.9/32 *[BGP/170] 01:27:14, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.225.5 via ge-0/0/1.203
[BGP/170] 01:27:23, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.227.5 via ge-0/0/2.203
172.16.192.10/32 *[BGP/170] 01:27:17, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.227.1 via ge-0/0/2.201
[BGP/170] 01:27:22, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.225.1 via ge-0/0/1.201
172.16.192.11/32 *[BGP/170] 01:27:12, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.227.3 via ge-0/0/2.202
[BGP/170] 01:27:19, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.225.3 via ge-0/0/1.202
172.16.192.12/32 *[BGP/170] 01:27:23, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.227.5 via ge-0/0/2.203
[BGP/170] 01:27:14, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.225.5 via ge-0/0/1.203
192.168.231.0/24 *[Direct/0] 01:27:28
> via ge-0/0/0.0
192.168.231.98/32 *[Local/0] 01:27:28
Local via ge-0/0/0.0
WANルーターとしてのジュニパーSRXシリーズファイアウォール
以下の表と構成例は、クラスターモードでSRXシリーズファイアウォールを使用する場合と、MXルーターをWANルーターとして使用する場合の違いを示しています。ファブリック側では、MXルーターの設定から変更されるのはSRXクラスターのインターフェイス名だけです。SRXシリーズファイアウォールはアクティブ/アクティブクラスターモードで実行されるため、考慮すべきWANルーター設定とASNは1つだけです。この単一の構成には、同様のMXルーターベースの構成にはないクラスター管理コマンドとトラストゾーン管理コマンドも含まれています。
このSRXシリーズファイアウォールベースのアプローチは、MXルーターで冗長イーサネット(reth)インターフェイスやリンクアグリゲーショングループ(LAG)を設定するよりも複雑ではありません。さらに、仮想ゲートウェイなどを挿入するために、ファブリック側に追加のCLIが必要になります。
ASパスの先頭付加による潜在的な非対称ルートの問題の防止
ステートフルファイアウォールがファブリックに接続されている場合、非対称ルーティングの潜在的なリスクが存在します。以下のシナリオを考えてみましょう。ファブリック外のクライアントが、WANルーターを介してファブリック内のクライアントへのTCP接続を開始します。最初の TCPスリーウェイハンドシェイクの間、SYNパケットは最初のWANルーターによって処理されます。ただし、ファブリッククライアントからのSYN-ACK応答は、両方のルーターがファブリックに同じデフォルトルートをアドバタイズするため、2番目のWANルーターによって処理される場合があります。ファブリックは、好みを認識することなく、ECMPロードバランシングまたはその他の内部メカニズムにより、2番目のWANルーターを選択する場合があります。ステートフルファイアウォール(WANルーターとして機能する)がセッション状態を共有しない場合、2番目のWANルーターは、最初のWANルーターで開始されたセッションの記録がないため、リターンパケットを破棄する可能性があります。
この問題を回避するには、2番目のWANルーターによってアドバタイズされるデフォルトルートの優先度を下げ、通常の条件下ではリターントラフィックが最初のWANルーターに送信されるようにすることができます。BGPでは、これは通常、 ASパスの先頭に付加することで実現されるため、2番目のWANルーターへのルートの魅力が低下します。以下に示すSRXクラスター設定では、ファブリックに対して2つのエクスポートフィルターを使用します。そのうちの1つは、デフォルトルートの先頭にASパスを追加します。次に、これらのフィルターが、優先度の低いWANルーターに基づいてファブリックネイバーに適用されます。
set policy-options policy-statement internet0 term 1 from protocol static set policy-options policy-statement internet0 term 1 from route-filter 0.0.0.0/0 exact set policy-options policy-statement internet0 term 1 then accept set policy-options policy-statement internet0 term 2 then reject set policy-options policy-statement internet1 term 1 from protocol static set policy-options policy-statement internet1 term 1 from route-filter 0.0.0.0/0 exact set policy-options policy-statement internet1 term 1 then as-path-prepend "64999 64999" set policy-options policy-statement internet1 term 1 then accept set policy-options policy-statement internet1 term 2 then reject
ファブリックとのBGPピアリングが確立されると、ファブリックが受信したデフォルトルートを確認できます。以下の例では、core1スイッチがサービスブロック機能として機能します。
root@core1> show route aspath-regex ".* 64901 .*"
.
devices.inet.0: 13 destinations, 19 routes (13 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 00:10:21, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.224.4 via ge-0/0/5.103
[BGP/170] 00:10:21, localpref 100
AS path: 64999 64999 64901 I, validation-state: unverified
> to 10.255.225.4 via ge-0/0/6.203
[EVPN/170] 00:10:21
> to 10.255.240.7 via ge-0/0/1.0
to 10.255.240.9 via ge-0/0/2.0
.
customerb.inet.0: 14 destinations, 20 routes (14 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 00:10:21, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.224.2 via ge-0/0/5.102
[BGP/170] 00:10:21, localpref 100
AS path: 64999 64999 64901 I, validation-state: unverified
> to 10.255.225.2 via ge-0/0/6.202
[EVPN/170] 00:10:21
> to 10.255.240.7 via ge-0/0/1.0
to 10.255.240.9 via ge-0/0/2.0
.
customera.inet.0: 14 destinations, 20 routes (14 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 00:08:53, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.224.0 via ge-0/0/5.101
[BGP/170] 00:08:53, localpref 100
AS path: 64999 64999 64901 I, validation-state: unverified
> to 10.255.225.0 via ge-0/0/6.201
[EVPN/170] 00:08:53
> to 10.255.240.7 via ge-0/0/1.0
to 10.255.240.9 via ge-0/0/2.0
.
アップリンクトラフィックが一貫して1つのWANルーターを優先するようにするために、ファブリック構成にも同様のアプローチをお勧めします。これは、ASパスの先頭に付加して、2番目のWANにアドバタイズされるルートの魅力ルーター低くすることで実現されます。上記のMXルーター例では共有の「export-vrfs」フィルターを使用していますが、図22に示すように、「export-vrfs0」と「export-vrfs1」の2つの別々のフィルターを使用します。
図22:1つの
ではなく2つのエクスポートフィルター
ではなく2つのエクスポートフィルター
見た目は同じかもしれませんが、「export-vrfs1」のすべてのステートメントには、 図 23 のように先頭に AP-path が設定されています。
図23:セカンドフィルタールールには、常にAP-Pathの先頭に
が含まれます
が含まれます
SRXクラスターとのBGPピアリングが確立されたら、以下の例に示すように、ファブリック内のASパスの先頭に付加されたSRXクラスターが表示されていることを確認します。まず、ファブリックのサービスブロック機能(ここではcore1スイッチ)の設定を確認します。
root@core1> show configuration | display set | match export-vrf set groups top policy-options policy-statement export-vrfs0 term 01_exclude-default from route-filter-list 0-0-0-0_0 set groups top policy-options policy-statement export-vrfs0 term 01_exclude-default then reject set groups top policy-options policy-statement export-vrfs0 term 02_fabric-all-no-hosts from route-filter-list 0-0-0-0_0-30 set groups top policy-options policy-statement export-vrfs0 term 02_fabric-all-no-hosts then accept set groups top policy-options policy-statement export-vrfs0 term 03_overlaylo0 from route-filter-list 172-16-192-0_24-32 set groups top policy-options policy-statement export-vrfs0 term 03_overlaylo0 then accept set groups top policy-options policy-statement export-vrfs1 term 01_exclude-default from route-filter-list 0-0-0-0_0 set groups top policy-options policy-statement export-vrfs1 term 01_exclude-default then reject set groups top policy-options policy-statement export-vrfs1 term 02_fabric-all-no-hosts from route-filter-list 0-0-0-0_0-30 set groups top policy-options policy-statement export-vrfs1 term 02_fabric-all-no-hosts then as-path-prepend "64998 64998" set groups top policy-options policy-statement export-vrfs1 term 02_fabric-all-no-hosts then accept set groups top policy-options policy-statement export-vrfs1 term 03_overlaylo0 from route-filter-list 172-16-192-0_24-32 set groups top policy-options policy-statement export-vrfs1 term 03_overlaylo0 then as-path-prepend "64998 64998" set groups top policy-options policy-statement export-vrfs1 term 03_overlaylo0 then accept set groups top routing-instances customera protocols bgp group customera0 export export-vrfs0 set groups top routing-instances customera protocols bgp group customera1 export export-vrfs1 set groups top routing-instances customerb protocols bgp group customerb0 export export-vrfs0 set groups top routing-instances customerb protocols bgp group customerb1 export export-vrfs1 set groups top routing-instances devices protocols bgp group devices0 export export-vrfs0 set groups top routing-instances devices protocols bgp group devices1 export export-vrfs1 # set groups top policy-options route-filter-list 0-0-0-0_0 0.0.0.0/0 exact set groups top policy-options route-filter-list 0-0-0-0_0-30 0.0.0.0/0 upto /30 set groups top policy-options route-filter-list 172-16-192-0_24-32 172.16.192.0/24 upto /32
次に、以下の例のように、SRXクラスター上の設定に従ってルートを受信することも確認します。
# neighbor-IP:10.255.224.1 which is assigned on srx-cluster to vrf:customera interface ge-0/0/2.1091 root@srx1> show route receive-protocol bgp 10.255.224.1 . public-int.inet.0: 46 destinations, 101 routes (46 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * 10.99.91.0/24 10.255.224.1 64911 65002 65004 65005 I * 10.99.99.0/24 10.255.224.1 64911 65002 65004 65005 I * 172.16.192.1/32 10.255.224.1 64911 65002 65004 65005 I * 172.16.192.4/32 10.255.224.1 64911 65002 65004 65006 I * 172.16.192.7/32 10.255.224.1 64911 I 172.16.192.10/32 10.255.224.1 64911 65002 65004 65001 I . # neighbor-IP:10.255.226.1 which is assigned on srx-cluster to vrf:customera interface ge-0/0/3.1091 root@srx1> show route receive-protocol bgp 10.255.226.1 . public-int.inet.0: 46 destinations, 101 routes (46 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path 10.99.91.0/24 10.255.226.1 64911 65001 65004 65005 I 10.99.99.0/24 10.255.226.1 64911 65001 65004 65005 I 172.16.192.1/32 10.255.226.1 64911 65001 65004 65005 I 172.16.192.4/32 10.255.226.1 64911 65001 65004 65006 I 172.16.192.7/32 10.255.226.1 64911 65001 65004 65002 I * 172.16.192.10/32 10.255.226.1 64911 I . # neighbor-IP:10.255.225.1 which is assigned on srx-cluster to vrf:customera interface ge-7/0/2.1099 root@srx1> show route receive-protocol bgp 10.255.225.1 . public-int.inet.0: 46 destinations, 101 routes (46 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path 10.99.91.0/24 10.255.225.1 64998 64998 64911 65002 65004 65005 I 10.99.99.0/24 10.255.225.1 64998 64998 64911 65002 65004 65005 I 172.16.192.1/32 10.255.225.1 64998 64998 64911 65002 65004 65005 I 172.16.192.4/32 10.255.225.1 64998 64998 64911 65002 65004 65006 I 172.16.192.7/32 10.255.225.1 64998 64998 64911 I 172.16.192.10/32 10.255.225.1 64998 64998 64911 65002 65004 65001 I . # neighbor-IP:10.255.227.1 which is assigned on srx-cluster to vrf:customera interface ge-7/0/3.1099 root@srx1> show route receive-protocol bgp 10.255.227.1 . public-int.inet.0: 46 destinations, 101 routes (46 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path 10.99.91.0/24 10.255.227.1 64998 64998 64911 65001 65004 65005 I 10.99.99.0/24 10.255.227.1 64998 64998 64911 65001 65004 65005 I 172.16.192.1/32 10.255.227.1 64998 64998 64911 65001 65004 65005 I 172.16.192.4/32 10.255.227.1 64998 64998 64911 65001 65004 65006 I 172.16.192.7/32 10.255.227.1 64998 64998 64911 65001 65004 65002 I 172.16.192.10/32 10.255.227.1 64998 64998 64911 I
表2 は、サービスブロック機能としてのコア1スイッチとコア2スイッチの設定情報と、SRXクラスターのWANルーターの設定を示しています。 表1 (MX WANルーター用)に関して変更点をマークしました(太字はMXルーター用)。
| スイッチ | スイッチAS | VRF | コアP2P IP | コアIF | WANルーター | WANルーターP2P IP | WANルーターAS | WANルーターのIF | VLAN ID |
|---|---|---|---|---|---|---|---|---|---|
| コア1 | 64911 | カスタマーA | 10.255.224.1/31 | ge-0/0/5.101 | ノード0 | 10.255.224.0/31 | 64901 | ge-0/0/2.101 | 101 |
| コア1 | 64911 | カスタマーB | 10.255.224.3/31 | ge-0/0/5.102 | ノード0 | 10.255.224.2/31 | 64901 | ge-0/0/2.102 | 102 |
| コア1 | 64911 | デバイス | 10.255.224.5/31 | ge-0/0/5.103 | ノード0 | 10.255.224.4/31 | 64901 | ge-0/0/2.103 | 103 |
| コア1 | 64911 | カスタマーA | 10.255.225.1/31 | ge-0/0/6.101 | ノード1 | 10.255.225.0/31 | 64901 | ge-7/0/2.101 | 101 |
| コア1 | 64911 | カスタマーB | 10.255.225.3/31 | ge-0/0/6.102 | ノード1 | 10.255.225.2/31 | 64901 | ge-7/0/2.102 | 102 |
| コア1 | 64911 | デバイス | 10.255.225.5/31 | ge-0/0/6.103 | ノード1 | 10.255.225.4/31 | 64901 | ge-7/0/2.103 | 103 |
| コア2 | 64911 | カスタマーA | 10.255.226.1/31 | ge-0/0/5.201 | ノード0 | 10.255.226.0/31 | 64901 | ge-0/0/3.201 | 201 |
| コア2 | 64911 | カスタマーB | 10.255.226.3/31 | ge-0/0/5.202 | ノード0 | 10.255.226.2/31 | 64901 | ge-0/0/3.202 | 202 |
| コア2 | 64911 | デバイス | 10.255.226.5/31 | ge-0/0/5.203 | ノード0 | 10.255.226.4/31 | 64901 | ge-0/0/3.203 | 203 |
| コア2 | 64911 | カスタマーA | 10.255.227.1/31 | ge-0/0/6.201 | ノード1 | 10.255.227.0/31 | 64901 | ge-7/0/3.201 | 201 |
| コア2 | 64911 | カスタマーB | 10.255.227.3/31 | ge-0/0/6.202 | ノード1 | 10.255.227.2/31 | 64901 | ge-7/0/3.202 | 202 |
| コア2 | 64911 | デバイス | 10.255.227.5/31 | ge-0/0/6.203 | ノード1 | 10.255.227.4/31 | 64901 | ge-7/0/3.203 | 203 |
以下の擬似コードは、この例で core1スイッチ で設定する必要がある内容を説明しています。
# create the following transport networks either in a switch-template or locally on each service switch # create network name:trans101 with VLAN-ID:101 # create network name:trans102 with VLAN-ID:102 # create network name:trans103 with VLAN-ID:103 # create network name:trans201 with VLAN-ID:201 # create network name:trans202 with VLAN-ID:202 # create network name:trans203 with VLAN-ID:203 # # configure the Additional IP-Subnet 10.255.224.1/31 to Network/VLAN:trans101 # configure the Additional IP-Subnet 10.255.224.3/31 to Network/VLAN:trans102 # configure the Additional IP-Subnet 10.255.224.5/31 to Network/VLAN:trans103 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/5 as L3-Sub-Interfaces with MTU=9018 # # configure the Additional IP-Subnet 10.255.225.1/31 to Network/VLAN:trans201 # configure the Additional IP-Subnet 10.255.225.3/31 to Network/VLAN:trans202 # configure the Additional IP-Subnet 10.255.225.5/31 to Network/VLAN:trans203 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/6 as L3-Sub-Interfaces with MTU=9018 # # configure on VRF # configure on instance customera # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans101 # add to existing overlay-vlans the vlan:trans201 # # configure on instance customerb # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans102 # add to existing overlay-vlans the vlan:trans202 # # configure on instance devices # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans103 # add to existing overlay-vlans the vlan:trans203 # # Enable BGP # Create an Import policy called 'export-vrfs0' # Add to this export Policy the following Networks as: # - Add Term w. Name=exclude-default Prefix=0.0.0.0/0 Protocol=None Then=Reject # - Add Term w. Name=fabric-all-no-hosts Prefix=0.0.0.0/0-30 Protocol=None Then=Accept # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept # # Create an Export policy called 'export-vrfs1' # Add to this export Policy the following Networks as: # - Add Term w. Name=exclude-default Prefix=0.0.0.0/0 Protocol=None Then=Reject # - Add Term w. Name=fabric-all-no-hosts Prefix=0.0.0.0/0-30 Protocol=None Then=Accept Add Action->Prepend AS Path='64998 64998' # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept Add Action->Prepend AS Path='64998 64998' # # Create an Export policy called 'import-default' # - Name=default Prefix=0.0.0.0/0 Protocol=BGP Action=Accept # # Create a BGP Group with: # - Name=customera0 # - Type=External # - Network (VLAN)=trans101 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs0 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.0 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb0 # - Type=External # - Network (VLAN)=trans102 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs0 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.2 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=devices0 # - Type=External # - Network (VLAN)=trans103 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs0 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.4 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customera1 # - Type=External # - Network (VLAN)=trans201 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs1 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.225.0 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb1 # - Type=External # - Network (VLAN)=trans202 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs1 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.225.2 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=devices1 # - Type=External # - Network (VLAN)=trans203 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs1 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.225.4 Neighbor_AS=64901 Hold-Time=90
以下の擬似コードは、この例で core2スイッチ で設定する必要がある内容を説明しています。
# create the following transport networks either in a switch-template or locally on each service switch # create network name:trans101 with VLAN-ID:101 # create network name:trans102 with VLAN-ID:102 # create network name:trans103 with VLAN-ID:103 # create network name:trans201 with VLAN-ID:201 # create network name:trans202 with VLAN-ID:202 # create network name:trans203 with VLAN-ID:203 # # configure the Additional IP-Subnet 10.255.226.1/31 to Network/VLAN:trans101 # configure the Additional IP-Subnet 10.255.226.3/31 to Network/VLAN:trans102 # configure the Additional IP-Subnet 10.255.226.5/31 to Network/VLAN:trans103 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/5 as L3-Sub-Interfaces with MTU=9018 # # configure the Additional IP-Subnet 10.255.227.1/31 to Network/VLAN:trans201 # configure the Additional IP-Subnet 10.255.227.3/31 to Network/VLAN:trans202 # configure the Additional IP-Subnet 10.255.227.5/31 to Network/VLAN:trans203 # Then bind these 3 Network/VLANs to Port Interface ge-0/0/6 as L3-Sub-Interfaces with MTU=9018 # # configure on VRF # configure on instance customera # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans101 # add to existing overlay-vlans the vlan:trans201 # # configure on instance customerb # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans102 # add to existing overlay-vlans the vlan:trans202 # # configure on instance devices # Override Template Defined VRF Instance=Checked/Enabled # add to existing overlay-vlans the vlan:trans103 # add to existing overlay-vlans the vlan:trans203 # # Enable BGP # Create an Export policy called 'export-vrfs0' # Add to this export Policy the following Networks as: # - Add Term w. Name=exclude-default Prefix=0.0.0.0/0 Protocol=None Then=Reject # - Add Term w. Name=fabric-all-no-hosts Prefix=0.0.0.0/0-30 Protocol=None Then=Accept # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept # # Create an Export policy called 'export-vrfs1' # Add to this export Policy the following Networks as: # - Add Term w. Name=exclude-default Prefix=0.0.0.0/0 Protocol=None Then=Reject # - Add Term w. Name=fabric-all-no-hosts Prefix=0.0.0.0/0-30 Protocol=None Then=Accept Add Action->Prepend AS Path='64998 64998' # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept Add Action->Prepend AS Path='64998 64998' # # Create an Export policy called 'import-default' # - Name=default Prefix=0.0.0.0/0 Protocol=BGP Action=Accept # # Create a BGP Group with: # - Name=customera0 # - Type=External # - Network (VLAN)=trans101 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs0 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.0 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb0 # - Type=External # - Network (VLAN)=trans102 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs0 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.2 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=devices0 # - Type=External # - Network (VLAN)=trans103 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs0 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.4 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customera1 # - Type=External # - Network (VLAN)=trans201 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs1 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.227.0 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=customerb1 # - Type=External # - Network (VLAN)=trans202 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs1 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.227.2 Neighbor_AS=64901 Hold-Time=90 # # Create a BGP Group with: # - Name=devices1 # - Type=External # - Network (VLAN)=trans203 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs1 and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.227.4 Neighbor_AS=64901 Hold-Time=90
個々のサービスブロック機能(ここではコア1スイッチとコア2スイッチ)の設定が終了すると、概要表は 図24のようになります。
図 24 は、コア 1 スイッチとコア 2 スイッチの個々のサービスブロック機能を設定した後の BGP の概要を示しています。
図24:BGPファイアウォールをWANルーター
として使用した場合のSRXシリーズ設定の概要
として使用した場合のSRXシリーズ設定の概要
以下のJunos OS CLIは、この例でSRXシリーズファイアウォールクラスターに必要な設定全体を表しています。
set groups node0 system host-name srx1_node0
set groups node1 system host-name srx2_node1
set apply-groups "${node}"
set chassis aggregated-devices ethernet device-count 10
set chassis cluster control-link-recovery
set chassis cluster reth-count 5
set chassis cluster initial-hold 60
set chassis cluster redundancy-group 1 node 0 priority 200
set chassis cluster redundancy-group 1 node 1 priority 100
set chassis cluster redundancy-group 1 gratuitous-arp-count 4
# Interface monitoring turned OFF for vSRX
# set chassis cluster redundancy-group 1 interface-monitor ge-0/0/2 weight 255
# set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255
# set chassis cluster redundancy-group 1 interface-monitor ge-7/0/2 weight 255
# set chassis cluster redundancy-group 1 interface-monitor ge-7/0/3 weight 255
set interfaces fab0 fabric-options member-interfaces ge-0/0/0
set interfaces fab1 fabric-options member-interfaces ge-7/0/0
#
# rebuild trust zone to clear old interfaces bound
delete security zones security-zone trust
set security zones security-zone trust tcp-rst
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
#
delete interfaces ge-0/0/2
set interfaces ge-0/0/2 flexible-vlan-tagging
set interfaces ge-0/0/2 mtu 9018
set interfaces ge-0/0/2 unit 101 description trans101
set interfaces ge-0/0/2 unit 101 vlan-id 101
set interfaces ge-0/0/2 unit 101 family inet address 10.255.224.0/31
set security zones security-zone trust interfaces ge-0/0/2.101 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-0/0/2.101 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-0/0/2.101 host-inbound-traffic system-services ping
set interfaces ge-0/0/2 unit 102 description trans102
set interfaces ge-0/0/2 unit 102 vlan-id 102
set interfaces ge-0/0/2 unit 102 family inet address 10.255.224.2/31
set security zones security-zone trust interfaces ge-0/0/2.102 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-0/0/2.102 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-0/0/2.102 host-inbound-traffic system-services ping
set interfaces ge-0/0/2 unit 103 description trans103
set interfaces ge-0/0/2 unit 103 vlan-id 103
set interfaces ge-0/0/2 unit 103 family inet address 10.255.224.4/31
set security zones security-zone trust interfaces ge-0/0/2.103 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-0/0/2.103 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-0/0/2.103 host-inbound-traffic system-services ping
#
delete interfaces ge-0/0/3
set interfaces ge-0/0/3 flexible-vlan-tagging
set interfaces ge-0/0/3 mtu 9018
set interfaces ge-0/0/3 unit 101 description trans101
set interfaces ge-0/0/3 unit 101 vlan-id 101
set interfaces ge-0/0/3 unit 101 family inet address 10.255.226.0/31
set security zones security-zone trust interfaces ge-0/0/3.101 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-0/0/3.101 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-0/0/3.101 host-inbound-traffic system-services ping
set interfaces ge-0/0/3 unit 102 description trans102
set interfaces ge-0/0/3 unit 102 vlan-id 102
set interfaces ge-0/0/3 unit 102 family inet address 10.255.226.2/31
set security zones security-zone trust interfaces ge-0/0/3.102 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-0/0/3.102 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-0/0/3.102 host-inbound-traffic system-services ping
set interfaces ge-0/0/3 unit 103 description trans103
set interfaces ge-0/0/3 unit 103 vlan-id 103
set interfaces ge-0/0/3 unit 103 family inet address 10.255.226.4/31
set security zones security-zone trust interfaces ge-0/0/3.103 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-0/0/3.103 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-0/0/3.103 host-inbound-traffic system-services ping
delete interfaces ge-7/0/2
set interfaces ge-7/0/2 flexible-vlan-tagging
set interfaces ge-7/0/2 mtu 9018
set interfaces ge-7/0/2 unit 201 description trans201
set interfaces ge-7/0/2 unit 201 vlan-id 201
set interfaces ge-7/0/2 unit 201 family inet address 10.255.225.0/31
set security zones security-zone trust interfaces ge-7/0/2.201 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-7/0/2.201 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-7/0/2.201 host-inbound-traffic system-services ping
set interfaces ge-7/0/2 unit 202 description trans202
set interfaces ge-7/0/2 unit 202 vlan-id 202
set interfaces ge-7/0/2 unit 202 family inet address 10.255.225.2/31
set security zones security-zone trust interfaces ge-7/0/2.202 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-7/0/2.202 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-7/0/2.202 host-inbound-traffic system-services ping
set interfaces ge-7/0/2 unit 203 description trans203
set interfaces ge-7/0/2 unit 203 vlan-id 203
set interfaces ge-7/0/2 unit 203 family inet address 10.255.225.4/31
set security zones security-zone trust interfaces ge-7/0/2.203 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-7/0/2.203 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-7/0/2.203 host-inbound-traffic system-services ping
#
delete interfaces ge-7/0/3
set interfaces ge-7/0/3 flexible-vlan-tagging
set interfaces ge-7/0/3 mtu 9018
set interfaces ge-7/0/3 unit 201 description trans201
set interfaces ge-7/0/3 unit 201 vlan-id 201
set interfaces ge-7/0/3 unit 201 family inet address 10.255.227.0/31
set security zones security-zone trust interfaces ge-7/0/3.201 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-7/0/3.201 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-7/0/3.201 host-inbound-traffic system-services ping
set interfaces ge-7/0/3 unit 202 description trans202
set interfaces ge-7/0/3 unit 202 vlan-id 202
set interfaces ge-7/0/3 unit 202 family inet address 10.255.227.2/31
set security zones security-zone trust interfaces ge-7/0/3.202 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-7/0/3.202 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-7/0/3.202 host-inbound-traffic system-services ping
set interfaces ge-7/0/3 unit 203 description trans203
set interfaces ge-7/0/3 unit 203 vlan-id 203
set interfaces ge-7/0/3 unit 203 family inet address 10.255.227.4/31
set security zones security-zone trust interfaces ge-7/0/3.203 host-inbound-traffic protocols bgp
set security zones security-zone trust interfaces ge-7/0/3.203 host-inbound-traffic protocols bfd
set security zones security-zone trust interfaces ge-7/0/3.203 host-inbound-traffic system-services ping
#
# needed in and export policy
delete policy-options
set policy-options policy-statement fabric term 1 from protocol bgp
set policy-options policy-statement fabric term 1 from route-filter 0.0.0.0/0 orlonger
set policy-options policy-statement fabric term 1 then accept
set policy-options policy-statement fabric term 3 then reject
set policy-options policy-statement internet0 term 1 from protocol static
set policy-options policy-statement internet0 term 1 from route-filter 0.0.0.0/0 exact
set policy-options policy-statement internet0 term 1 then accept
set policy-options policy-statement internet0 term 3 then reject
set policy-options policy-statement internet1 term 1 from protocol static
set policy-options policy-statement internet1 term 1 from route-filter 0.0.0.0/0 exact
set policy-options policy-statement internet1 term 1 then as-path-prepend "64999 64999"
set policy-options policy-statement internet1 term 1 then accept
set policy-options policy-statement internet1 term 3 then reject
#
delete routing-instances public-int
set routing-instances public-int instance-type virtual-router
set routing-instances public-int interface ge-0/0/2.101
set routing-instances public-int interface ge-0/0/2.102
set routing-instances public-int interface ge-0/0/2.103
set routing-instances public-int interface ge-0/0/3.101
set routing-instances public-int interface ge-0/0/3.102
set routing-instances public-int interface ge-0/0/3.103
set routing-instances public-int interface ge-7/0/2.201
set routing-instances public-int interface ge-7/0/2.202
set routing-instances public-int interface ge-7/0/2.203
set routing-instances public-int interface ge-7/0/3.201
set routing-instances public-int interface ge-7/0/3.202
set routing-instances public-int interface ge-7/0/3.203
#
delete routing-instances public-int protocols bgp group customera
delete routing-instances public-int protocols bgp group customera0
set routing-instances public-int protocols bgp group customera0 type external
set routing-instances public-int protocols bgp group customera0 family inet unicast
set routing-instances public-int protocols bgp group customera0 multipath multiple-as
set routing-instances public-int protocols bgp group customera0 local-as 64901
set routing-instances public-int protocols bgp group customera0 hold-time 90
set routing-instances public-int protocols bgp group customera0 import fabric
set routing-instances public-int protocols bgp group customera0 export internet0
set routing-instances public-int protocols bgp group customera0 bfd-liveness-detection minimum-interval 1000
set routing-instances public-int protocols bgp group customera0 bfd-liveness-detection multiplier 3
set routing-instances public-int protocols bgp group customera0 bfd-liveness-detection session-mode automatic
set routing-instances public-int protocols bgp group customera0 neighbor 10.255.224.1 peer-as 64911
set routing-instances public-int protocols bgp group customera0 neighbor 10.255.226.1 peer-as 64911
#
delete routing-instances public-int protocols bgp group customera1
set routing-instances public-int protocols bgp group customera1 type external
set routing-instances public-int protocols bgp group customera1 family inet unicast
set routing-instances public-int protocols bgp group customera1 multipath multiple-as
set routing-instances public-int protocols bgp group customera1 local-as 64901
set routing-instances public-int protocols bgp group customera1 hold-time 90
set routing-instances public-int protocols bgp group customera1 import fabric
set routing-instances public-int protocols bgp group customera1 export internet1
set routing-instances public-int protocols bgp group customera1 bfd-liveness-detection minimum-interval 1000
set routing-instances public-int protocols bgp group customera1 bfd-liveness-detection multiplier 3
set routing-instances public-int protocols bgp group customera1 bfd-liveness-detection session-mode automatic
set routing-instances public-int protocols bgp group customera1 neighbor 10.255.225.1 peer-as 64911
set routing-instances public-int protocols bgp group customera1 neighbor 10.255.227.1 peer-as 64911
#
delete routing-instances public-int protocols bgp group customerb
delete routing-instances public-int protocols bgp group customerb0
set routing-instances public-int protocols bgp group customerb0 type external
set routing-instances public-int protocols bgp group customerb0 family inet unicast
set routing-instances public-int protocols bgp group customerb0 multipath multiple-as
set routing-instances public-int protocols bgp group customerb0 local-as 64901
set routing-instances public-int protocols bgp group customerb0 hold-time 90
set routing-instances public-int protocols bgp group customerb0 import fabric
set routing-instances public-int protocols bgp group customerb0 export internet0
set routing-instances public-int protocols bgp group customerb0 bfd-liveness-detection minimum-interval 1000
set routing-instances public-int protocols bgp group customerb0 bfd-liveness-detection multiplier 3
set routing-instances public-int protocols bgp group customerb0 bfd-liveness-detection session-mode automatic
set routing-instances public-int protocols bgp group customerb0 neighbor 10.255.224.3 peer-as 64911
set routing-instances public-int protocols bgp group customerb0 neighbor 10.255.226.3 peer-as 64911
#
delete routing-instances public-int protocols bgp group customerb1
set routing-instances public-int protocols bgp group customerb1 type external
set routing-instances public-int protocols bgp group customerb1 family inet unicast
set routing-instances public-int protocols bgp group customerb1 multipath multiple-as
set routing-instances public-int protocols bgp group customerb1 local-as 64901
set routing-instances public-int protocols bgp group customerb1 hold-time 90
set routing-instances public-int protocols bgp group customerb1 import fabric
set routing-instances public-int protocols bgp group customerb1 export internet1
set routing-instances public-int protocols bgp group customerb1 bfd-liveness-detection minimum-interval 1000
set routing-instances public-int protocols bgp group customerb1 bfd-liveness-detection multiplier 3
set routing-instances public-int protocols bgp group customerb1 bfd-liveness-detection session-mode automatic
set routing-instances public-int protocols bgp group customerb1 neighbor 10.255.225.3 peer-as 64911
set routing-instances public-int protocols bgp group customerb1 neighbor 10.255.227.3 peer-as 64911
#
delete routing-instances public-int protocols bgp group devices
delete routing-instances public-int protocols bgp group devices0
set routing-instances public-int protocols bgp group devices0 type external
set routing-instances public-int protocols bgp group devices0 family inet unicast
set routing-instances public-int protocols bgp group devices0 multipath multiple-as
set routing-instances public-int protocols bgp group devices0 local-as 64901
set routing-instances public-int protocols bgp group devices0 hold-time 90
set routing-instances public-int protocols bgp group devices0 import fabric
set routing-instances public-int protocols bgp group devices0 export internet0
set routing-instances public-int protocols bgp group devices0 bfd-liveness-detection minimum-interval 1000
set routing-instances public-int protocols bgp group devices0 bfd-liveness-detection multiplier 3
set routing-instances public-int protocols bgp group devices0 bfd-liveness-detection session-mode automatic
set routing-instances public-int protocols bgp group devices0 neighbor 10.255.224.5 peer-as 64911
set routing-instances public-int protocols bgp group devices0 neighbor 10.255.226.5 peer-as 64911
#
delete routing-instances public-int protocols bgp group devices1
set routing-instances public-int protocols bgp group devices1 type external
set routing-instances public-int protocols bgp group devices1 family inet unicast
set routing-instances public-int protocols bgp group devices1 multipath multiple-as
set routing-instances public-int protocols bgp group devices1 local-as 64901
set routing-instances public-int protocols bgp group devices1 hold-time 90
set routing-instances public-int protocols bgp group devices1 import fabric
set routing-instances public-int protocols bgp group devices1 export internet1
set routing-instances public-int protocols bgp group devices1 bfd-liveness-detection minimum-interval 1000
set routing-instances public-int protocols bgp group devices1 bfd-liveness-detection multiplier 3
set routing-instances public-int protocols bgp group devices1 bfd-liveness-detection session-mode automatic
set routing-instances public-int protocols bgp group devices1 neighbor 10.255.225.5 peer-as 64911
set routing-instances public-int protocols bgp group devices1 neighbor 10.255.227.5 peer-as 64911
#
# Do not do SNAT on prefix for WAN-Interface (where the external DHCP-Server may be for Lab)
#
delete security nat source rule-set trust-to-untrust
set security nat source rule-set trust-to-untrust from zone trust
set security nat source rule-set trust-to-untrust to zone untrust
set security nat source rule-set trust-to-untrust rule source-nat-rule1 match destination-address 192.168.10.0/24
set security nat source rule-set trust-to-untrust rule source-nat-rule1 then source-nat off
set security nat source rule-set trust-to-untrust rule source-nat-rule2 match source-address 0.0.0.0/0
set security nat source rule-set trust-to-untrust rule source-nat-rule2 then source-nat interface
#
# WAN-Interfaces example
#
delete interfaces ge-0/0/1
delete interfaces ge-7/0/1
set interfaces ge-0/0/1 unit 0 family inet address 192.168.10.23/24
set interfaces ge-7/0/1 unit 0 family inet address 192.168.10.24/24
#
delete security zones security-zone untrust interfaces ge-0/0/1.0
set security zones security-zone untrust interfaces ge-0/0/1.0 host-inbound-traffic protocols all
set security zones security-zone untrust interfaces ge-0/0/1.0 host-inbound-traffic system-services all
#
delete security zones security-zone untrust interfaces ge-7/0/1.0
set security zones security-zone untrust interfaces ge-7/0/1.0 host-inbound-traffic protocols all
set security zones security-zone untrust interfaces ge-7/0/1.0 host-inbound-traffic system-services all
#
delete routing-instances public-int interface ge-0/0/1.0
delete routing-instances public-int interface ge-7/0/1.0
set routing-instances public-int interface ge-0/0/1.0
set routing-instances public-int interface ge-7/0/1.0
set routing-instances public-int routing-options static route 0.0.0.0/0 next-hop 192.168.10.1