예: 레이어 3 네트워크의 SRX 시리즈 방화벽에서 액티브/액티브 멀티노드 고가용성으로 IPSec VPN 구성
이 예는 액티브-액티브 멀티노드 고가용성 설정을 위해 IPsec VPN을 구성하고 확인하는 방법을 보여줍니다.
개요
멀티노드 고가용성은 여러 SRG1(SRG1+)과 함께 액티브/액티브 모드에서 IPsec VPN을 지원합니다. 각 SRG는 여전히 두 노드 간 액티브-백업 모드로 작동하지만, 서로 다른 SRG는 서로 다른 노드에서 활성화될 수 있습니다. 이 모델을 사용하면 두 노드에서 동시에 여러 활성 IPsec 터널을 설정할 수 있어 두 노드 모두에서 암호화 및 복호화가 가능하고 대역폭 활용도가 향상됩니다.
이 예에서는 두 방화벽 간에 멀티노드 고가용성(MNHA)을 구성하고 MNHA 방화벽 쌍에서 피어 디바이스로의 고가용성 IPsec VPN 터널을 설정합니다. MNHA 설정에서 방화벽 간의 원활한 페일오버를 통해 IPsec 터널을 성공적으로 설정하고 유지할 수 있도록 하는 데 중점을 둡니다.
사전 요구 사항 예
소프트웨어 요구 사항 |
|
시작하기 전에
이점 |
MNHA 설정의 액티브/액티브 IPsec VPN은 두 노드가 동시에 VPN 트래픽을 종료 및 전달할 수 있도록 하여 가용성과 성능을 개선하고, 로드 공유를 지원하고, 더 빠른 컨버전스를 가능하게 하며, 장애 시 트래픽 중단을 최소화합니다. |
자세히 알아보기 |
|
자세히 알아보기 |
기능 개요
사용된 기술 |
|
기본 검증 작업 |
|
토폴로지 개요
그림 1 은 이 예에서 사용되는 토폴로지를 보여줍니다.
그림 1: 레이어 3 구축의 액티브/액티브 멀티노드 고가용성
토폴로지는 MNHA 클러스터를 형성하고 원격 방화벽(SRX-03)에 대한 IPsec VPN 터널을 설정하는 두 개의 방화벽과 함께 멀티노드 고가용성(MNHA)을 사용하는 활성/활성 IPsec VPN 구축을 보여줍니다.
SRX-03 디바이스는 MNHA 설정의 피어 디바이스 역할을 하며 SRX-01 및 SRX-02 디바이스로 각각 개별 IPsec VPN 터널을 설정합니다. SRX-03의 관점에서 MNHA 쌍은 단일 논리적 VPN 엔드포인트로 작동합니다.
내부 호스트의 트래픽은 라우터 1 → MNHA 설정→ IPsec 터널 → 라우터 2 → SRX-03 → 라우터 3을 통해 흐릅니다. 반환 트래픽은 동일한 암호화된 경로를 따릅니다. 이 예는 SRX-03(피어 디바이스)이 연결된 라우터 3에서 원격 호스트 PC가 연결된 라우터 1로의 트래픽 도달 가능성을 확인합니다.
- SRX-01 및 SRX-02는 여러 SRG(SRG1+)와 MNHA 쌍으로 작동하여 두 노드 모두에서 트래픽을 능동적으로 처리할 수 있습니다.
- 각 SRG는 내부적으로 액티브-백업 모드로 실행되는 반면, 전체 솔루션은 SRG 전반에 걸쳐 액티브-액티브 VPN 포워딩을 제공합니다.
- 노드는 유동 루프백 IP 주소를 사용하여 제어 및 VPN 상태를 동기화하는 HA 링크 영역의 라우팅되고 암호화된 ICL(Inter-Chassis Link)을 통해 연결됩니다. 이 예에서 링크는 라우팅된 중간 네트워크를 통과하는 대신 디바이스 간에 직접 ge-0/0/2.0 인터페이스를 사용합니다.
- 트러스트 존 인터페이스는 라우터 1(AS 65030)을 통해 MNHA 클러스터를 내부 네트워크로 연결합니다.
- 신뢰할 수 없는 영역 인터페이스는 SRX-01과 SRX-02를 모두 라우터 2(AS 65035)에 연결하여 원격 VPN 사이트에 대한 업스트림 도달 가능성을 제공합니다.
- 각 SRX 호스트의 루프백 인터페이스(lo0.0)는 유동 IP 주소를 호스팅합니다.
- SRX-03은 MNHA 클러스터에서 IPsec VPN 터널을 종료하고 라우터 3에 연결합니다.
- 원격 SRX는 자체 루프백 인터페이스를 VPN 엔드포인트로 사용하여 물리적 인터페이스 상태와 관계없이 터널 안정성을 보장합니다.
- VPN 인터페이스는 VPN 영역에 배치되어 암호화된 트래픽을 신뢰할 수 없는 전송 네트워크와 분리합니다.
- MNHA 클러스터와 SRX-03 사이에는 서로 다른 SRG에 바인딩된 여러 IPsec 터널이 설정됩니다. 노드 또는 SRG에 장애가 발생하면 VPN 엔드포인트가 유동 IP 주소를 사용하기 때문에 트래픽은 터널 재협상 없이 나머지 활성 SRG로 리디렉션됩니다.
다음 표에는 이 예에서 사용되는 인터페이스 구성에 대한 세부 정보가 나와 있습니다.
| 디바이스 | 인터페이스 | 영역 | IP 주소 | 구성 대상 |
|---|---|---|---|---|
SRX-01 |
lo0.0 | 언트러스트 |
10.11.0.1/32 |
유동 IP 주소 IKE(Internet Key Exchange) 게이트웨이 주소 |
10.12.0.1/32 |
IKE(Internet Key Exchange) 게이트웨이 주소 |
|||
ge-0/0/2.0 |
HA 링크 |
10.22.0.2/24 |
ICL 연결 |
|
ge-0/0/4.0 |
언트러스트 |
10.5.0.1/24 |
R2 라우터에 연결 |
|
ge-0/0/3.0 |
신뢰 |
10.3.0.2/24 |
R1 라우터에 연결 |
|
SRX-02 |
lo0.0 |
언트러스트 |
10.12.0.1/32 |
유동 IP 주소 IKE(Internet Key Exchange) 게이트웨이 주소 |
10.11.0.1/32 |
IKE(Internet Key Exchange) 게이트웨이 주소 |
|||
ge-0/0/2.0 |
HA 링크 |
10.22.0.1/24 |
ICL 연결 |
|
ge-0/0/3.0 |
신뢰 |
10.2.0.2/24 |
R1 라우터에 연결 |
|
ge-0/0/4.0 |
언트러스트 |
10.4.0.1/24 |
R2 라우터에 연결 |
|
SRX-03 |
lo0.0 | 언트러스트 |
10.112.0.1/32 |
IKE(Internet Key Exchange) 게이트웨이 주소 |
10.112.0.5/32 |
IKE(Internet Key Exchange) 게이트웨이 주소 |
|||
ge-0/0/0.0 |
언트러스트 |
10.7.0.1/24 |
R2 라우터에 연결 |
|
ge-0/0/1.0 |
신뢰 |
10.6.0.2/24 |
라우터 연결 |
| 디바이스 | 인터페이스 | IP 주소 | 구성 대상 |
|---|---|---|---|
| 라우터 2(R2) | lo0 | 10.111.0.2/32 |
R2의 루프백 인터페이스 주소 |
ge-0/0/1 |
10.4.0.2/24 |
연결 대상 |
|
ge-0/0/0 |
10.5.0.2/24 |
연결 대상 |
|
ge-0/0/2 |
10.7.0.2/24 |
(VPN 피어 디바이스)에 |
|
| 라우터 1(R1) | lo0 | 10.111.0.1/32 |
R1의 루프백 인터페이스 주소 |
ge-0/0/0 |
10.3.0.1/24 |
연결 대상 |
|
ge-0/0/1 |
10.2.0.1/24 |
연결 대상 |
|
|
|
호스트 네트워크에 연결 | |
| 라우터 3(R3) | ge-0/0/0 |
10.6.0.1/24 |
연결 대상 |
| lo0 | 10.6.255.1/32 |
R3의 루프백 인터페이스 주소 |
방화벽 구성
VPN 피어 디바이스 구성
일치하는 IPsec VPN 옵션으로 VPN 피어 디바이스 SRX-03을 구성합니다. 터널을 성공적으로 가동하려면 IKE 및 IPsec 매개 변수(피어, 제안 및 정책)가 SRX-01 및 SRX-02의 옵션과 일치하는지 확인합니다.
검증
표시 명령을 사용하여 구성이 제대로 작동하는지 확인합니다.
| 명령 | 검증 작업 |
|---|---|
|
피어 노드의 상태를 포함하여 보안 디바이스에 MNHA 상태의 세부 정보를 표시합니다. |
show securiti ike security-associationsshow securiti ipsec security-associations |
IPsec VPN 연결에 대한 상태 표시 |
멀티노드 고가용성 설정 확인
목적
보안 디바이스에 구성된 멀티노드 고가용성 설정의 세부 정보를 보고 확인합니다.
작업
운영 모드에서 다음 명령을 실행합니다.
SRX-01
user@srx-01> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Grid-id: 0
Local-id: 2
Local-IP: 10.22.0.2
HA Peer Information:
Peer Id: 1 IP address: 10.22.0.1 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Configured BFD Detection Time: 3 * 200ms
Cold Sync Status: COMPLETE
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: ROUTING
Status: BACKUP
Activeness Priority: 200
Preemption: ENABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
Services Redundancy Group: 2
Deployment Type: ROUTING
Status: ACTIVE
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: READY
SRX-02
user@srx-02> show chassis high-availability information
Node failure codes:
HW Hardware monitoring LB Loopback monitoring
MB Mbuf monitoring SP SPU monitoring
CS Cold Sync monitoring SU Software Upgrade
Node Status: ONLINE
Grid-id: 0
Local-id: 1
Local-IP: 10.22.0.1
HA Peer Information:
Peer Id: 2 IP address: 10.22.0.2 Interface: ge-0/0/2.0
Routing Instance: default
Encrypted: YES Conn State: UP
Configured BFD Detection Time: 3 * 200ms
Cold Sync Status: COMPLETE
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: ROUTING
Status: ACTIVE
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 2
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: NOT READY
Services Redundancy Group: 2
Deployment Type: ROUTING
Status: BACKUP
Activeness Priority: 200
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 2
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
의미
명령 출력에서 다음 세부 사항을 확인합니다.
IP 주소 및 ID와 같은 로컬 노드 및 피어 노드 세부 정보.
필드
Encrypted: YES는 트래픽이 보호되고 있음을 나타냅니다.필드
Deployment Type: ROUTING는 레이어 3 모드 구성, 즉 네트워크의 양쪽에 라우터가 있음을 나타냅니다.필드
Services Redundancy Group: 1Services Redundancy Group: 2는 해당 노드에서 SRG1 및 SRG2(활성 또는 백업)의 상태를 나타냅니다.
멀티노드 고가용성 서비스 중복 그룹 확인
목적
SRG가 구성되고 올바르게 작동하는지 확인합니다.
작업
운영 모드에서 다음 명령을 실행합니다.
user@srx-01> show chassis high-availability services-redundancy-group 1
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 1
Deployment Type: ROUTING
Status: BACKUP
Activeness Priority: 200
Preemption: ENABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: COMPLETE
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : ACTIVE
Health Status: HEALTHY
Failover Readiness: N/A
Signal Route Info:
Active Signal Route:
IP: 10.39.1.1
Routing Instance: default
Status: NOT INSTALLED
Backup Signal Route:
IP: 10.39.1.2
Routing Instance: default
Status: INSTALLED
Split-brain Prevention Probe Info:
DST-IP: 10.111.0.1
SRC-IP: 10.3.0.2
Routing Instance: default
Type: ICMP Probe
Status: NOT RUNNING
Result: N/A Reason: N/A
BFD Monitoring:
Status: UNKNOWN
SRC-IP: 10.5.0.1 DST-IP: 10.5.0.2
Routing Instance: default
Type: SINGLE-HOP
IFL Name: ge-0/0/3.0
State: INSTALLED
Interface Monitoring:
Status: UP
IF Name: ge-0/0/4 State: Up
IF Name: ge-0/0/3 State: Up
IP SRGID Table:
SRGID IP Prefix Routing Table
1 10.11.0.0/24 default
user@srx-01> show chassis high-availability services-redundancy-group 2
SRG failure event codes:
BF BFD monitoring
IP IP monitoring
IF Interface monitoring
CP Control Plane monitoring
Services Redundancy Group: 2
Deployment Type: ROUTING
Status: ACTIVE
Activeness Priority: 1
Preemption: DISABLED
Process Packet In Backup State: NO
Control Plane State: READY
System Integrity Check: N/A
Failure Events: NONE
Peer Information:
Peer Id: 1
Status : BACKUP
Health Status: HEALTHY
Failover Readiness: READY
Signal Route Info:
Active Signal Route:
IP: 10.49.1.1
Routing Instance: default
Status: INSTALLED
Backup Signal Route:
IP: 10.49.1.2
Routing Instance: default
Status: NOT INSTALLED
Split-brain Prevention Probe Info:
DST-IP: 10.111.0.1
SRC-IP: 10.12.0.1
Routing Instance: default
Type: ICMP Probe
Status: NOT RUNNING
Result: N/A Reason: N/A
BFD Monitoring:
Status: UNKNOWN
SRC-IP: 10.5.0.1 DST-IP: 10.5.0.2
Routing Instance: default
Type: SINGLE-HOP
IFL Name: ge-0/0/3.0
State: INSTALLED
Interface Monitoring:
Status: UP
IF Name: ge-0/0/4 State: Up
IF Name: ge-0/0/3 State: Up
IP SRGID Table:
SRGID IP Prefix Routing Table
2 10.12.0.0/24 default
의미
명령 출력에서 다음 세부 사항을 확인합니다.
구축 유형, 상태, 활성 및 백업 신호 경로와 같은 피어 노드 세부 정보.
스플릿 브레인 방지 프로브, IP 모니터링 및 BFD 모니터링 상태.
연관된 IP 접두사 테이블입니다.
IPsec VPN 상태 확인
목적
SRG 수준에서 IKE(Internet Key Exchange) 보안 연결 상태를 확인하여 VPN 상태를 확인합니다.
작업
SRX-01, SRX-02 및 SRX-03(VPN 피어 디바이스)에서 다음 명령을 실행합니다.
SRX-01
user@srx-01> show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 16777489 UP 1fef3ef467ee0439 8c2139689c37cbc8 IKEv2 10.112.0.1 33554706 UP a3eb35ebcb216367 2ad794a8e09152c4 IKEv2 10.112.0.5
user@srx-01> show security ike security-associations srg-id 1 Index State Initiator cookie Responder cookie Mode Remote Address 16777489 UP 1fef3ef467ee0439 8c2139689c37cbc8 IKEv2 10.112.0.1 16777491 UP 81dc38812e7869d0 f6c9b8cddd8228a6 IKEv2 10.112.0.1
user@srx-01> show security ike security-associations srg-id 2 Index State Initiator cookie Responder cookie Mode Remote Address 33554706 UP a3eb35ebcb216367 2ad794a8e09152c4 IKEv2 10.112.0.5
user@srx-01> show security ipsec security-associations Total active tunnels: 2 Total IPsec sas: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <17277217 ESP:aes-cbc-256/sha256 0x27ea1472 1225/ unlim - root 500 10.112.0.1 >17277217 ESP:aes-cbc-256/sha256 0x4f257994 1225/ unlim - root 500 10.112.0.1 <34054492 ESP:aes-cbc-256/sha256 0x5b93d8cb 1078/ unlim - root 500 10.112.0.5 >34054492 ESP:aes-cbc-256/sha256 0x7c1356b8 1078/ unlim - root 500 10.112.0.5
user@srx-01> show security ipsec statistics ESP Statistics: Encrypted bytes: 5772 Decrypted bytes: 2604 Encrypted packets: 37 Decrypted packets: 31 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication failures: 0, Replay errors: 0 ESP authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0 Invalid SPI: 0, TS check fail: 0 Exceeds tunnel MTU: 0 Discarded: 0
SRX-02
user@srx-02> show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 16777503 UP ed0571780c0e05a7 9d760fc5677e5072 IKEv2 10.112.0.1 33554720 UP 8b6ca20b53f20e90 4249b4b9afe23888 IKEv2 10.112.0.5
user@srx-02> show security ike security-associations srg-id 1 Index State Initiator cookie Responder cookie Mode Remote Address 16777503 UP ed0571780c0e05a7 9d760fc5677e5072 IKEv2 10.112.0.1
user@srx-02> show security ike security-associations srg-id 2 Index State Initiator cookie Responder cookie Mode Remote Address 33554720 UP 8b6ca20b53f20e90 4249b4b9afe23888 IKEv2 10.112.0.5
user@srx-01> show security ipsec security-associations
Total active tunnels: 2 Total IPsec sas: 2
ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway
<17277217 ESP:aes-cbc-256/sha256 0xba7f1385 1524/ unlim - root 500 10.112.0.1
>17277217 ESP:aes-cbc-256/sha256 0x8dd71e97 1524/ unlim - root 500 10.112.0.1
<34054492 ESP:aes-cbc-256/sha256 0xb9de9d4b 1136/ unlim - root 500 10.112.0.5
>34054492 ESP:aes-cbc-256/sha256 0x5daab807 1136/ unlim - root 500 10.112.0.5
SRX-03
user@srx-03> show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 305 UP ed0571780c0e05a7 9d760fc5677e5072 IKEv2 10.11.0.1 306 UP 8b6ca20b53f20e90 4249b4b9afe23888 IKEv2 10.12.0.1
user@srx-03> show security ipsec security-associations Total active tunnels: 2 Total IPsec sas: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <500064 ESP:aes-cbc-256/sha256 0x5daab807 1014/ unlim - root 500 10.12.0.1 >500064 ESP:aes-cbc-256/sha256 0xb9de9d4b 1014/ unlim - root 500 10.12.0.1 <500063 ESP:aes-cbc-256/sha256 0x8dd71e97 1402/ unlim - root 500 10.11.0.1 >500063 ESP:aes-cbc-256/sha256 0xba7f1385 1402/ unlim - root 500 10.11.0.1
user@srx-03> show security ipsec statistics ESP Statistics: Encrypted bytes: 5928 Decrypted bytes: 3192 Encrypted packets: 38 Decrypted packets: 38 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication failures: 0, Replay errors: 0 ESP authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0 Invalid SPI: 0, TS check fail: 0 Exceeds tunnel MTU: 0 Discarded: 0
의미
명령 출력에서 다음 세부 사항을 확인합니다.
- 원격 피어의 IP 주소입니다.
- 두 원격 피어 모두에 대해 UP으로 표시된 상태는 1단계 및 2단계 설정의 성공적인 연결을 나타냅니다.
- 원격 피어 IP 주소, IKE(Internet Key Exchange) 정책 및 외부 인터페이스가 모두 정확합니다.
- IPsec 터널이 작동 중이고, 트래픽을 적극적으로 전달하며, 오류 없이 작동합니다
VPN 전반의 트래픽 플로우 테스트
목적
VPN 전반의 트래픽 플로우를 확인합니다.
작업
피어 VPN 방화벽(SRX-03)에 연결된 라우터 3의 명령을 사용하여 ping 호스트가 연결된 라우터 1로의 트래픽 플로우를 테스트합니다.
운영 모드에서 명령을 입력합니다.ping
user@router-03> ping 10.1.0.1 source 10.6.0.1 count 2 PING 10.1.0.1 (10.1.0.1): 56 data bytes 64 bytes from 10.1.0.1: icmp_seq=0 ttl=62 time=16.757 ms 64 bytes from 10.1.0.1: icmp_seq=1 ttl=62 time=4.536 ms --- 10.1.0.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.536/10.646/16.757/6.111 ms
user@router-03> ping 10.1.1.1 source 10.6.255.1 count 2 PING 10.1.1.1 (10.1.1.1): 56 data bytes 64 bytes from 10.1.1.1: icmp_seq=0 ttl=62 time=4.747 ms 64 bytes from 10.1.1.1: icmp_seq=1 ttl=62 time=4.876 ms --- 10.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.747/4.812/4.876/0.064 ms
의미
이 ping 출력은 원격 사이트와 내부 네트워크 간의 IPsec VPN을 통해 성공적인 엔드 투 엔드 연결을 확인합니다.
명령이 ping 실패하면 라우팅, 보안 정책, 종료 호스트 또는 ESP 패킷의 암호화 및 복호화에 문제가 있을 수 있습니다
섀시 간 링크(ICL) 암호화 상태 확인
목적
섀시 간 링크(ICL) 상태를 확인합니다.
작업
다음에서 다음 명령을 실행합니다.SRX-01
user@srx-01> show security ipsec security-associations ha-link-encryption detail
ID: 495005 Virtual-system: root, VPN Name: L3HA_IPSEC_VPN
Local Gateway: 10.22.0.2, Remote Gateway: 10.22.0.1
Traffic Selector Name: __L3HA_IPSEC_VPN__ICL__1__0__multi_node__
Local Identity: ipv4(180.100.1.2-180.100.1.2)
Remote Identity: ipv4(180.100.1.1-180.100.1.1)
TS Type: traffic-selector
Version: IKEv2
Quantum Secured: No
Hardware Offloaded: No
PFS group: N/A, Packet Encapsulation: None, Dest port: 0
Passive mode tunneling: Disabled
DF-bit: clear, Copy-Outer-DSCP: Disabled, Bind-interface: st0.16000, Policy-name: L3HA_IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
HA Link Encryption Mode: Inter-Chassis-Link
Location: FPC -, PIC -
Anchorship: Thread -
Distribution-Profile: default-profile
Direction: inbound, SPI: 0x000a3f8b, AUX-SPI: 0
, VPN Monitoring: UP Mode: Always-Send Interval: 10secs Threshold: 10
Hard lifetime: Expires in 288 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 220 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 0, PIC 0
Anchorship: Thread 0
IKE SA Index: 16777052
Direction: outbound, SPI: 0x000449f7, AUX-SPI: 0
, VPN Monitoring: UP Mode: Always-Send Interval: 10secs Threshold: 10
Hard lifetime: Expires in 288 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 220 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 0, PIC 0
Anchorship: Thread 0
IKE SA Index: 16777052
의미
명령 출력은 MNHA ICL 링크를 암호화하는 데 사용되는 IPsec SA를 제공합니다. SRX-01과 SRX-02 간의 제어, 라우팅 및 상태 동기화 트래픽을 보호합니다
주의:
명령 출력에 표시된 IP 범위(180.100.1.x)는 ICL IPsec 트래픽 선택기 역할을 합니다. 시스템은 이 IP 범위를 동적으로 할당하므로 변경하거나 수정하지 않는 것이 중요합니다. 또한 더 넓은 180.x.x.x IP 범위에 대해 BFD(Bidirectional Forwarding Detection)가 자동으로 활성화됩니다.
모든 디바이스에서 명령 설정
vSRX 가상 방화벽(SRX-01)
set chassis high-availability local-id 2 set chassis high-availability local-id local-ip 10.22.0.2 set chassis high-availability peer-id 1 peer-ip 10.22.0.1 set chassis high-availability peer-id 1 interface ge-0/0/2.0 set chassis high-availability peer-id 1 vpn-profile L3HA_IPSEC_VPN set chassis high-availability peer-id 1 liveness-detection minimum-interval 200 set chassis high-availability peer-id 1 liveness-detection multiplier 3 set chassis high-availability services-redundancy-group 1 deployment-type routing set chassis high-availability services-redundancy-group 1 peer-id 1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip src-ip 10.3.0.2 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 src-ip 10.5.0.1 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 session-type singlehop set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.5.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 1 active-signal-route 10.39.1.1 set chassis high-availability services-redundancy-group 1 backup-signal-route 10.39.1.2 set chassis high-availability services-redundancy-group 1 prefix-list SRG1_PFX set chassis high-availability services-redundancy-group 1 managed-services ipsec set chassis high-availability services-redundancy-group 1 preemption set chassis high-availability services-redundancy-group 1 activeness-priority 200 set chassis high-availability services-redundancy-group 2 peer-id 1 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip src-ip 10.12.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 src-ip 10.5.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 session-type singlehop set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.5.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 2 active-signal-route 10.49.1.1 set chassis high-availability services-redundancy-group 2 backup-signal-route 10.49.1.2 set chassis high-availability services-redundancy-group 2 prefix-list SRG2_PFX set chassis high-availability services-redundancy-group 2 managed-services ipsec set chassis high-availability services-redundancy-group 2 activeness-priority 1 set security ike proposal L3HA_IKE_PROP description l3ha_link_encr_tunnel set security ike proposal L3HA_IKE_PROP authentication-method pre-shared-keys set security ike proposal L3HA_IKE_PROP dh-group group14 set security ike proposal L3HA_IKE_PROP authentication-algorithm sha-256 set security ike proposal L3HA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal L3HA_IKE_PROP lifetime-seconds 300 set security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG1_IKE_PROP dh-group group14 set security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG1_IKE_PROP lifetime-seconds 3600 set security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG2_IKE_PROP dh-group group14 set security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG2_IKE_PROP lifetime-seconds 3600 set security ike policy L3HA_IKE_POL description l3ha_link_encr_tunnel set security ike policy L3HA_IKE_POL proposals L3HA_IKE_PROP set security ike policy L3HA_IKE_POL pre-shared-key ascii-text "$abc123" set security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP set security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$abc123" set security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP set security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$abc123" set security ike gateway L3HA_IKE_GW ike-policy L3HA_IKE_POL set security ike gateway L3HA_IKE_GW version v2-only set security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1 set security ike gateway SRG1_IKE_GW1 address 10.112.0.1 set security ike gateway SRG1_IKE_GW1 external-interface lo0 set security ike gateway SRG1_IKE_GW1 local-address 10.11.0.1 set security ike gateway SRG1_IKE_GW1 version v2-only set security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500 set security ike gateway SRG2_IKE_GW500 address 10.112.0.5 set security ike gateway SRG2_IKE_GW500 external-interface lo0 set security ike gateway SRG2_IKE_GW500 local-address 10.12.0.1 set security ike gateway SRG2_IKE_GW500 version v2-only set security ipsec proposal L3HA_IPSEC_PROP description l3ha_link_encr_tunnel set security ipsec proposal L3HA_IPSEC_PROP protocol esp set security ipsec proposal L3HA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal L3HA_IPSEC_PROP lifetime-seconds 300 set security ipsec proposal SRG1_IPSEC_PROP protocol esp set security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800 set security ipsec proposal SRG2_IPSEC_PROP protocol esp set security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800 set security ipsec policy L3HA_IPSEC_POL description l3ha_link_encr_tunnel set security ipsec policy L3HA_IPSEC_POL proposals L3HA_IPSEC_PROP set security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL501 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL502 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL503 proposals SRG2_IPSEC_PROP set security ipsec vpn L3HA_IPSEC_VPN ha-link-encryption set security ipsec vpn L3HA_IPSEC_VPN ike gateway L3HA_IKE_GW set security ipsec vpn L3HA_IPSEC_VPN ike ipsec-policy L3HA_IPSEC_POL set security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1 set security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1 set security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1 set security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels on-traffic set security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500 set security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500 set security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.1.1.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.6.255.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels on-traffic set security zones security-zone vpn host-inbound-traffic system-services ping set security zones security-zone vpn host-inbound-traffic protocols bgp set security zones security-zone vpn host-inbound-traffic protocols bfd set security zones security-zone vpn interfaces st0.1 set security zones security-zone vpn interfaces st0.500 set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services ssh set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces lo0.0 set security zones security-zone untrust interfaces ge-0/0/4.0 set security zones security-zone trust host-inbound-traffic system-services ike set security zones security-zone trust host-inbound-traffic system-services ping set security zones security-zone trust host-inbound-traffic system-services ssh set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust host-inbound-traffic protocols bgp set security zones security-zone trust host-inbound-traffic protocols bfd set security zones security-zone trust interfaces ge-0/0/3.0 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/2.0 set security policies default-policy permit-all set interfaces ge-0/0/1 unit 0 family inet set interfaces ge-0/0/2 description ha_link set interfaces ge-0/0/2 unit 0 family inet address 10.22.0.2/24 set interfaces ge-0/0/3 description trust set interfaces ge-0/0/3 unit 0 family inet address 10.3.0.2/24 set interfaces ge-0/0/4 description route2 set interfaces ge-0/0/4 unit 0 family inet address 10.5.0.1/24 set interfaces lo0 description untrust set interfaces lo0 unit 0 family inet address 10.11.0.1/32 set interfaces lo0 unit 0 family inet address 10.12.0.1/32 set interfaces st0 unit 1 family inet set interfaces st0 unit 1 family inet6 set interfaces st0 unit 500 family inet set interfaces st0 unit 500 family inet6 set policy-options prefix-list SRG1_PFX 10.11.0.0/24 set policy-options prefix-list SRG2_PFX 10.12.0.0/24 set policy-options route-filter-list srg1_rf_list 10.11.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.1.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.6.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.12.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.1.1.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.6.255.0/24 orlonger set policy-options policy-statement ipsec_pol term 1 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 1 from condition active_route_exists_srg1 set policy-options policy-statement ipsec_pol term 1 then metric 10 set policy-options policy-statement ipsec_pol term 1 then accept set policy-options policy-statement ipsec_pol term 2 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 2 from condition backup_route_exists_srg1 set policy-options policy-statement ipsec_pol term 2 then metric 20 set policy-options policy-statement ipsec_pol term 2 then accept set policy-options policy-statement ipsec_pol term 3 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 3 from condition active_route_exists_srg2 set policy-options policy-statement ipsec_pol term 3 then metric 10 set policy-options policy-statement ipsec_pol term 3 then accept set policy-options policy-statement ipsec_pol term 4 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 4 from condition backup_route_exists_srg2 set policy-options policy-statement ipsec_pol term 4 then metric 20 set policy-options policy-statement ipsec_pol term 4 then accept set policy-options policy-statement ipsec_pol term default then reject set policy-options condition active_route_exists_srg1 if-route-exists address-family inet 10.39.1.1/32 set policy-options condition active_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet 10.49.1.1/32 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet 10.39.1.2/32 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet 10.49.1.2/32 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet table inet.0 set protocols bgp group 65030 type internal set protocols bgp group 65030 local-address 10.3.0.2 set protocols bgp group 65030 export ipsec_pol set protocols bgp group 65030 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65030 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65030 bfd-liveness-detection multiplier 3 set protocols bgp group 65030 neighbor 10.3.0.1 set protocols bgp group 65035 type external set protocols bgp group 65035 export ipsec_pol set protocols bgp group 65035 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65035 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65035 bfd-liveness-detection multiplier 3 set protocols bgp group 65035 neighbor 10.5.0.2 peer-as 65035 set routing-options autonomous-system 65030 set routing-options static route 10.6.0.1/32 next-hop st0.1 set routing-options static route 10.7.0.0/16 next-hop 10.5.0.2 set routing-options static route 10.112.0.0/24 next-hop 10.5.0.2
vSRX 가상 방화벽(SRX-02)
set chassis high-availability local-id 1 set chassis high-availability local-id local-ip 10.22.0.1 set chassis high-availability peer-id 2 peer-ip 10.22.0.2 set chassis high-availability peer-id 2 interface ge-0/0/2.0 set chassis high-availability peer-id 2 vpn-profile L3HA_IPSEC_VPN set chassis high-availability peer-id 2 liveness-detection minimum-interval 200 set chassis high-availability peer-id 2 liveness-detection multiplier 3 set chassis high-availability services-redundancy-group 1 deployment-type routing set chassis high-availability services-redundancy-group 1 peer-id 2 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 1 activeness-probe dest-ip src-ip 10.2.0.2 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 src-ip 10.4.0.1 set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 session-type singlehop set chassis high-availability services-redundancy-group 1 monitor bfd-liveliness 10.4.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 1 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 1 active-signal-route 10.39.1.1 set chassis high-availability services-redundancy-group 1 backup-signal-route 10.39.1.2 set chassis high-availability services-redundancy-group 1 prefix-list SRG1_PFX set chassis high-availability services-redundancy-group 1 managed-services ipsec set chassis high-availability services-redundancy-group 1 activeness-priority 1 set chassis high-availability services-redundancy-group 2 peer-id 2 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip 10.111.0.1 set chassis high-availability services-redundancy-group 2 activeness-probe dest-ip src-ip 10.12.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 src-ip 10.4.0.1 set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 session-type singlehop set chassis high-availability services-redundancy-group 2 monitor bfd-liveliness 10.4.0.2 interface ge-0/0/3.0 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/3 set chassis high-availability services-redundancy-group 2 monitor interface ge-0/0/4 set chassis high-availability services-redundancy-group 2 active-signal-route 10.49.1.1 set chassis high-availability services-redundancy-group 2 backup-signal-route 10.49.1.2 set chassis high-availability services-redundancy-group 2 prefix-list SRG2_PFX set chassis high-availability services-redundancy-group 2 managed-services ipsec set chassis high-availability services-redundancy-group 2 activeness-priority 200 set security ike proposal L3HA_IKE_PROP description l3ha_link_encr_tunnel set security ike proposal L3HA_IKE_PROP authentication-method pre-shared-keys set security ike proposal L3HA_IKE_PROP dh-group group14 set security ike proposal L3HA_IKE_PROP authentication-algorithm sha-256 set security ike proposal L3HA_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal L3HA_IKE_PROP lifetime-seconds 300 set security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG1_IKE_PROP dh-group group14 set security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG1_IKE_PROP lifetime-seconds 3600 set security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG2_IKE_PROP dh-group group14 set security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG2_IKE_PROP lifetime-seconds 3600 set security ike policy L3HA_IKE_POL description l3ha_link_encr_tunnel set security ike policy L3HA_IKE_POL proposals L3HA_IKE_PROP set security ike policy L3HA_IKE_POL pre-shared-key ascii-text "$abc123" set security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP set security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$abc123" set security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP set security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$abc123" set security ike gateway L3HA_IKE_GW ike-policy L3HA_IKE_POL set security ike gateway L3HA_IKE_GW version v2-only set security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1 set security ike gateway SRG1_IKE_GW1 address 10.112.0.1 set security ike gateway SRG1_IKE_GW1 external-interface lo0 set security ike gateway SRG1_IKE_GW1 local-address 10.11.0.1 set security ike gateway SRG1_IKE_GW1 version v2-only set security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500 set security ike gateway SRG2_IKE_GW500 address 10.112.0.5 set security ike gateway SRG2_IKE_GW500 external-interface lo0 set security ike gateway SRG2_IKE_GW500 local-address 10.12.0.1 set security ike gateway SRG2_IKE_GW500 version v2-only set security ipsec proposal L3HA_IPSEC_PROP description l3ha_link_encr_tunnel set security ipsec proposal L3HA_IPSEC_PROP protocol esp set security ipsec proposal L3HA_IPSEC_PROP encryption-algorithm aes-256-gcm set security ipsec proposal L3HA_IPSEC_PROP lifetime-seconds 300 set security ipsec proposal SRG1_IPSEC_PROP protocol esp set security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800 set security ipsec proposal SRG2_IPSEC_PROP protocol esp set security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800 set security ipsec policy L3HA_IPSEC_POL description l3ha_link_encr_tunnel set security ipsec policy L3HA_IPSEC_POL proposals L3HA_IPSEC_PROP set security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL501 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL502 proposals SRG2_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL503 proposals SRG2_IPSEC_PROP set security ipsec vpn L3HA_IPSEC_VPN ha-link-encryption set security ipsec vpn L3HA_IPSEC_VPN ike gateway L3HA_IKE_GW set security ipsec vpn L3HA_IPSEC_VPN ike ipsec-policy L3HA_IPSEC_POL set security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1 set security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1 set security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1 set security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels on-traffic set security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500 set security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500 set security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.1.1.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.6.255.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels on-traffic set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services ssh set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust interfaces lo0.0 set security zones security-zone untrust interfaces ge-0/0/4.0 set security zones security-zone vpn host-inbound-traffic system-services ping set security zones security-zone vpn host-inbound-traffic protocols bgp set security zones security-zone vpn host-inbound-traffic protocols bfd set security zones security-zone vpn interfaces st0.1 set security zones security-zone vpn interfaces st0.500 set security zones security-zone trust host-inbound-traffic system-services ike set security zones security-zone trust host-inbound-traffic system-services ping set security zones security-zone trust host-inbound-traffic system-services ssh set security zones security-zone trust host-inbound-traffic protocols bgp set security zones security-zone trust host-inbound-traffic protocols bfd set security zones security-zone trust interfaces ge-0/0/3.0 set security zones security-zone halink host-inbound-traffic system-services ike set security zones security-zone halink host-inbound-traffic system-services ping set security zones security-zone halink host-inbound-traffic system-services high-availability set security zones security-zone halink host-inbound-traffic system-services ssh set security zones security-zone halink host-inbound-traffic protocols bfd set security zones security-zone halink host-inbound-traffic protocols bgp set security zones security-zone halink interfaces ge-0/0/2.0 set security policies default-policy permit-all set interfaces ge-0/0/1 unit 0 family inet set interfaces ge-0/0/2 description ha_link set interfaces ge-0/0/2 unit 0 family inet address 10.22.0.1/24 set interfaces ge-0/0/3 description trust set interfaces ge-0/0/3 unit 0 family inet address 10.2.0.2/24 set interfaces ge-0/0/4 description router2 set interfaces ge-0/0/4 unit 0 family inet address 10.4.0.1/24 set interfaces lo0 unit 0 family inet address 10.11.0.1/32 set interfaces lo0 unit 0 family inet address 10.12.0.1/32 set interfaces st0 unit 1 family inet set interfaces st0 unit 1 family inet6 set interfaces st0 unit 500 family inet set interfaces st0 unit 500 family inet6 set policy-options prefix-list SRG1_PFX 10.11.0.0/24 set policy-options prefix-list SRG2_PFX 10.12.0.0/24 set policy-options route-filter-list srg1_rf_list 10.11.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.1.0.0/24 orlonger set policy-options route-filter-list srg1_rf_list 10.6.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.12.0.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.1.1.0/24 orlonger set policy-options route-filter-list srg2_rf_list 10.6.255.0/24 orlonger set policy-options policy-statement ipsec_pol term 1 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 1 from condition active_route_exists_srg1 set policy-options policy-statement ipsec_pol term 1 then metric 10 set policy-options policy-statement ipsec_pol term 1 then accept set policy-options policy-statement ipsec_pol term 2 from route-filter-list srg1_rf_list set policy-options policy-statement ipsec_pol term 2 from condition backup_route_exists_srg1 set policy-options policy-statement ipsec_pol term 2 then metric 20 set policy-options policy-statement ipsec_pol term 2 then accept set policy-options policy-statement ipsec_pol term 3 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 3 from condition active_route_exists_srg2 set policy-options policy-statement ipsec_pol term 3 then metric 10 set policy-options policy-statement ipsec_pol term 3 then accept set policy-options policy-statement ipsec_pol term 4 from route-filter-list srg2_rf_list set policy-options policy-statement ipsec_pol term 4 from condition backup_route_exists_srg2 set policy-options policy-statement ipsec_pol term 4 then metric 20 set policy-options policy-statement ipsec_pol term 4 then accept set policy-options policy-statement ipsec_pol term default then reject set policy-options condition active_route_exists_srg1 if-route-exists address-family inet 10.39.1.1/32 set policy-options condition active_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet 10.49.1.1/32 set policy-options condition active_route_exists_srg2 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet 10.39.1.2/32 set policy-options condition backup_route_exists_srg1 if-route-exists address-family inet table inet.0 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet 10.49.1.2/32 set policy-options condition backup_route_exists_srg2 if-route-exists address-family inet table inet.0 set protocols bgp group 65030 type internal set protocols bgp group 65030 local-address 10.2.0.2 set protocols bgp group 65030 export ipsec_pol set protocols bgp group 65030 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65030 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65030 bfd-liveness-detection multiplier 3 set protocols bgp group 65030 neighbor 10.2.0.1 set protocols bgp group 65035 type external set protocols bgp group 65035 export ipsec_pol set protocols bgp group 65035 bfd-liveness-detection minimum-interval 500 set protocols bgp group 65035 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group 65035 bfd-liveness-detection multiplier 3 set protocols bgp group 65035 neighbor 10.4.0.2 peer-as 65035 set routing-options autonomous-system 65030 set routing-options static route 10.6.0.1/32 next-hop st0.1 set routing-options static route 10.7.0.0/24 next-hop 10.4.0.2 set routing-options static route 10.112.0.0/24 next-hop 10.4.0.2
vSRX 가상 방화벽(SRX-03)
set security ike proposal SRG1_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG1_IKE_PROP dh-group group14 set security ike proposal SRG1_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG1_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG1_IKE_PROP lifetime-seconds 3600 set security ike proposal SRG2_IKE_PROP authentication-method pre-shared-keys set security ike proposal SRG2_IKE_PROP dh-group group14 set security ike proposal SRG2_IKE_PROP authentication-algorithm sha-256 set security ike proposal SRG2_IKE_PROP encryption-algorithm aes-256-cbc set security ike proposal SRG2_IKE_PROP lifetime-seconds 3600 set security ike policy SRG1_IKE_POL1 proposals SRG1_IKE_PROP set security ike policy SRG1_IKE_POL1 pre-shared-key ascii-text "$abc123" set security ike policy SRG2_IKE_POL500 proposals SRG2_IKE_PROP set security ike policy SRG2_IKE_POL500 pre-shared-key ascii-text "$abc123" set security ike gateway SRG1_IKE_GW1 ike-policy SRG1_IKE_POL1 set security ike gateway SRG1_IKE_GW1 address 10.11.0.1 set security ike gateway SRG1_IKE_GW1 external-interface lo0 set security ike gateway SRG1_IKE_GW1 local-address 10.112.0.1 set security ike gateway SRG1_IKE_GW1 version v2-only set security ike gateway SRG2_IKE_GW500 ike-policy SRG2_IKE_POL500 set security ike gateway SRG2_IKE_GW500 address 10.12.0.1 set security ike gateway SRG2_IKE_GW500 external-interface lo0 set security ike gateway SRG2_IKE_GW500 local-address 10.112.0.5 set security ike gateway SRG2_IKE_GW500 version v2-only set security ipsec proposal SRG1_IPSEC_PROP protocol esp set security ipsec proposal SRG1_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG1_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG1_IPSEC_PROP lifetime-seconds 1800 set security ipsec proposal SRG2_IPSEC_PROP protocol esp set security ipsec proposal SRG2_IPSEC_PROP authentication-algorithm hmac-sha-256-128 set security ipsec proposal SRG2_IPSEC_PROP encryption-algorithm aes-256-cbc set security ipsec proposal SRG2_IPSEC_PROP lifetime-seconds 1800 set security ipsec policy SRG1_IPSEC_POL1 proposals SRG1_IPSEC_PROP set security ipsec policy SRG2_IPSEC_POL500 proposals SRG2_IPSEC_PROP set security ipsec vpn SRG1_IPSEC_VPN1 bind-interface st0.1 set security ipsec vpn SRG1_IPSEC_VPN1 ike gateway SRG1_IKE_GW1 set security ipsec vpn SRG1_IPSEC_VPN1 ike ipsec-policy SRG1_IPSEC_POL1 set security ipsec vpn SRG1_IPSEC_VPN1 establish-tunnels immediately set security ipsec vpn SRG2_IPSEC_VPN500 bind-interface st0.500 set security ipsec vpn SRG2_IPSEC_VPN500 ike gateway SRG2_IKE_GW500 set security ipsec vpn SRG2_IPSEC_VPN500 ike ipsec-policy SRG2_IPSEC_POL500 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 local-ip 10.6.255.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 traffic-selector ts500 remote-ip 10.1.1.1/32 set security ipsec vpn SRG2_IPSEC_VPN500 establish-tunnels immediately set security zones security-zone untrust host-inbound-traffic system-services ike set security zones security-zone untrust host-inbound-traffic system-services ping set security zones security-zone untrust host-inbound-traffic system-services ssh set security zones security-zone untrust host-inbound-traffic protocols bgp set security zones security-zone untrust host-inbound-traffic protocols bfd set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust interfaces lo0.0 set security zones security-zone trust host-inbound-traffic system-services ike set security zones security-zone trust host-inbound-traffic system-services ping set security zones security-zone trust host-inbound-traffic system-services ssh set security zones security-zone trust host-inbound-traffic protocols bgp set security zones security-zone trust host-inbound-traffic protocols bfd set security zones security-zone trust interfaces ge-0/0/1.0 set security zones security-zone vpn host-inbound-traffic system-services ping set security zones security-zone vpn host-inbound-traffic protocols bgp set security zones security-zone vpn host-inbound-traffic protocols bfd set security zones security-zone vpn interfaces st0.1 set security zones security-zone vpn interfaces st0.500 set security policies default-policy permit-all set interfaces ge-0/0/0 description untrust set interfaces ge-0/0/0 unit 0 family inet address 10.7.0.1/24 set interfaces ge-0/0/1 description trust set interfaces ge-0/0/1 unit 0 family inet address 10.6.0.2/24 set interfaces lo0 unit 0 family inet address 10.112.0.1/32 set interfaces lo0 unit 0 family inet address 10.112.0.5/32 set interfaces st0 unit 1 family inet set interfaces st0 unit 500 family inet set routing-options autonomous-system 100 set routing-options static route 10.1.0.1/32 next-hop st0.1 set routing-options static route 10.4.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.5.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.6.255.0/24 next-hop 10.6.0.1 set routing-options static route 10.11.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.12.0.0/24 next-hop 10.7.0.2 set routing-options static route 10.111.0.1/32 next-hop 10.7.0.2 set routing-options static route 10.111.0.2/32 next-hop 10.7.0.2
라우터 1
set interfaces ge-0/0/0 description srx1 set interfaces ge-0/0/0 unit 0 family inet address 10.3.0.1/24 set interfaces ge-0/0/1 description srx2 set interfaces ge-0/0/1 unit 0 family inet address 10.2.0.1/24 set interfaces ge-0/0/2 description host set interfaces ge-0/0/2 vlan-tagging set interfaces ge-0/0/2 unit 100 vlan-id 100 set interfaces ge-0/0/2 unit 100 family inet address 10.1.0.1/24 set interfaces ge-0/0/2 unit 101 vlan-id 101 set interfaces ge-0/0/2 unit 101 family inet address 10.1.1.1/24 set interfaces lo0 unit 0 family inet address 10.111.0.1/32 primary set interfaces lo0 unit 0 family inet address 10.111.0.1/32 preferred set policy-options policy-statement host term 1 from route-filter 10.1.0.0/24 exact set policy-options policy-statement host term 1 from route-filter 10.1.1.0/24 exact set policy-options policy-statement host term 1 then accept set routing-options autonomous-system 65030 set routing-options static route 10.4.0.0/24 next-hop 10.2.0.2 set routing-options static route 10.5.0.0/24 next-hop 10.3.0.2 set protocols bgp group srx2 type internal set protocols bgp group srx2 local-address 10.2.0.1 set protocols bgp group srx2 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx2 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx2 bfd-liveness-detection multiplier 3 set protocols bgp group srx2 neighbor 10.2.0.2 set protocols bgp group srx1 type internal set protocols bgp group srx1 local-address 10.3.0.1 set protocols bgp group srx1 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx1 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx1 bfd-liveness-detection multiplier 3 set protocols bgp group srx1 neighbor 10.3.0.2 set protocols bgp export host
라우터 2
set interfaces ge-0/0/0 description srx1 set interfaces ge-0/0/0 unit 0 family inet address 10.5.0.2/24 set interfaces ge-0/0/1 description srx2 set interfaces ge-0/0/1 unit 0 family inet address 10.4.0.2/24 set interfaces ge-0/0/2 description srx3 set interfaces ge-0/0/2 unit 0 family inet address 10.7.0.2/24 set interfaces lo0 unit 0 family inet address 10.111.0.2/32 primary set interfaces lo0 unit 0 family inet address 10.111.0.2/32 preferred set routing-options autonomous-system 65035 set routing-options static route 10.112.0.0/24 next-hop 10.7.0.1 set protocols bgp group srx2 type external set protocols bgp group srx2 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx2 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx2 bfd-liveness-detection multiplier 3 set protocols bgp group srx2 neighbor 10.4.0.1 peer-as 65030 set protocols bgp group srx1 type external set protocols bgp group srx1 bfd-liveness-detection minimum-interval 500 set protocols bgp group srx1 bfd-liveness-detection minimum-receive-interval 500 set protocols bgp group srx1 bfd-liveness-detection multiplier 3 set protocols bgp group srx1 neighbor 10.5.0.1 peer-as 65030
라우터 3
set interfaces ge-0/0/0 unit 0 family inet address 10.6.0.1/24 set interfaces lo0 unit 0 family inet address 10.6.255.1/32 set routing-options static route 10.1.0.0/24 next-hop 10.6.0.2 set routing-options static route 10.1.1.0/24 next-hop 10.6.0.2 set routing-options static route 10.111.0.1/32 next-hop 10.6.0.2 set routing-options static route 10.112.0.1/32 next-hop 10.6.0.2
구성 출력 표시
구성 모드에서 , show security zones및 show interfaces 명령을 show high availability입력하여 구성을 확인합니다. 출력에 의도한 구성이 표시되지 않으면 이 예의 구성 지침을 반복하여 수정합니다.
vSRX 가상 방화벽(SRX-01)
user@srx-01# show chassis high-availability
chassis {
high-availability {
local-id {
2;
local-ip 10.22.0.2;
}
peer-id 1 {
peer-ip 10.22.0.1;
interface ge-0/0/2.0;
vpn-profile L3HA_IPSEC_VPN;
liveness-detection {
minimum-interval 200;
multiplier 3;
}
}
services-redundancy-group 1 {
deployment-type routing;
peer-id {
1;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.3.0.2;
}
}
monitor {
bfd-liveliness 10.5.0.2 {
src-ip 10.5.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.39.1.1;
}
backup-signal-route {
10.39.1.2;
}
prefix-list SRG1_PFX;
managed-services ipsec;
preemption;
activeness-priority 200;
}
services-redundancy-group 2 {
peer-id {
1;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.12.0.1;
}
}
monitor {
bfd-liveliness 10.5.0.2 {
src-ip 10.5.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.49.1.1;
}
backup-signal-route {
10.49.1.2;
}
prefix-list SRG2_PFX;
managed-services ipsec;
activeness-priority 1;
}
}
}
user@srx-01# show security zonessecurity-zone vpn {
host-inbound-traffic {
system-services {
ping;
}
protocols {
bgp;
bfd;
}
}
interfaces {
st0.1;
st0.500;
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
lo0.0;
ge-0/0/4.0;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/3.0;
}
}
security-zone halink {
host-inbound-traffic {
system-services {
ike;
ping;
high-availability;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/2.0;
}
}
user@srx-01# show interfaces
interfaces {
ge-0/0/1 {
unit 0 {
family inet;
}
}
ge-0/0/2 {
description ha_link;
unit 0 {
family inet {
address 10.22.0.2/24;
}
}
}
ge-0/0/3 {
description trust;
unit 0 {
family inet {
address 10.3.0.2/24;
}
}
}
ge-0/0/4 {
description route2;
unit 0 {
family inet {
address 10.5.0.1/24;
}
}
}
lo0 {
description untrust;
unit 0 {
family inet {
address 10.11.0.1/32;
address 10.12.0.1/32;
}
}
}
st0 {
unit 1 {
family inet;
family inet6;
}
unit 500 {
family inet;
family inet6;
}
}
}
user@srx-01# show policy-options
policy-options {
prefix-list SRG1_PFX {
10.11.0.0/24;
}
prefix-list SRG2_PFX {
10.12.0.0/24;
}
route-filter-list srg1_rf_list {
10.11.0.0/24 orlonger;
10.1.0.0/24 orlonger;
10.6.0.0/24 orlonger;
}
route-filter-list srg2_rf_list {
10.12.0.0/24 orlonger;
10.1.1.0/24 orlonger;
10.6.255.0/24 orlonger;
}
policy-statement ipsec_pol {
term 1 {
from {
route-filter-list srg1_rf_list;
condition active_route_exists_srg1;
}
then {
metric 10;
accept;
}
}
term 2 {
from {
route-filter-list srg1_rf_list;
condition backup_route_exists_srg1;
}
then {
metric 20;
accept;
}
}
term 3 {
from {
route-filter-list srg2_rf_list;
condition active_route_exists_srg2;
}
then {
metric 10;
accept;
}
}
term 4 {
from {
route-filter-list srg2_rf_list;
condition backup_route_exists_srg2;
}
then {
metric 20;
accept;
}
}
term default {
then reject;
}
}
condition active_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.1/32;
table inet.0;
}
}
}
}
condition active_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.1/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.2/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.2/32;
table inet.0;
}
}
}
}
}
user@srx-01# show protocols
protocols {
bgp {
group 65030 {
type internal;
local-address 10.3.0.2;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.3.0.1;
}
group 65035 {
type external;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.5.0.2 {
peer-as 65035;
}
}
}
}
user@srx-01# show routing-options
routing-options {
autonomous-system 65030;
static {
route 10.6.0.1/32 next-hop st0.1;
route 10.7.0.0/16 next-hop 10.5.0.2;
route 10.112.0.0/24 next-hop 10.5.0.2;
}
}
vSRX 가상 방화벽(SRX-02)
user@srx-02# show chassis high-availability
chassis {
high-availability {
local-id {
1;
local-ip 10.22.0.1;
}
peer-id 2 {
peer-ip 10.22.0.2;
interface ge-0/0/2.0;
vpn-profile L3HA_IPSEC_VPN;
liveness-detection {
minimum-interval 200;
multiplier 3;
}
}
services-redundancy-group 1 {
deployment-type routing;
peer-id {
2;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.2.0.2;
}
}
monitor {
bfd-liveliness 10.4.0.2 {
src-ip 10.4.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.39.1.1;
}
backup-signal-route {
10.39.1.2;
}
prefix-list SRG1_PFX;
managed-services ipsec;
activeness-priority 1;
}
services-redundancy-group 2 {
peer-id {
2;
}
activeness-probe {
dest-ip {
10.111.0.1;
src-ip 10.12.0.1;
}
}
monitor {
bfd-liveliness 10.4.0.2 {
src-ip 10.4.0.1;
session-type singlehop;
interface ge-0/0/3.0;
}
interface {
ge-0/0/3;
ge-0/0/4;
}
}
active-signal-route {
10.49.1.1;
}
backup-signal-route {
10.49.1.2;
}
prefix-list SRG2_PFX;
managed-services ipsec;
activeness-priority 200;
}
}
}
user@srx-02# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
lo0.0;
ge-0/0/4.0;
}
}
security-zone vpn {
host-inbound-traffic {
system-services {
ping;
}
protocols {
bgp;
bfd;
}
}
interfaces {
st0.1;
st0.500;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/3.0;
}
}
security-zone halink {
host-inbound-traffic {
system-services {
ike;
ping;
high-availability;
ssh;
}
protocols {
bfd;
bgp;
}
}
interfaces {
ge-0/0/2.0;
}
}
user@srx-02# show interfaces
interfaces {
ge-0/0/1 {
unit 0 {
family inet;
}
}
ge-0/0/2 {
description ha_link;
unit 0 {
family inet {
address 10.22.0.1/24;
}
}
}
ge-0/0/3 {
description trust;
unit 0 {
family inet {
address 10.2.0.2/24;
}
}
}
ge-0/0/4 {
description router2;
unit 0 {
family inet {
address 10.4.0.1/24;
}
}
}
lo0 {
unit 0 {
family inet {
address 10.11.0.1/32;
address 10.12.0.1/32;
}
}
}
st0 {
unit 1 {
family inet;
family inet6;
}
unit 500 {
family inet;
family inet6;
}
}
}
user@srx-02# show policy-options
policy-options {
prefix-list SRG1_PFX {
10.11.0.0/24;
}
prefix-list SRG2_PFX {
10.12.0.0/24;
}
route-filter-list srg1_rf_list {
10.11.0.0/24 orlonger;
10.1.0.0/24 orlonger;
10.6.0.0/24 orlonger;
}
route-filter-list srg2_rf_list {
10.12.0.0/24 orlonger;
10.1.1.0/24 orlonger;
10.6.255.0/24 orlonger;
}
policy-statement ipsec_pol {
term 1 {
from {
route-filter-list srg1_rf_list;
condition active_route_exists_srg1;
}
then {
metric 10;
accept;
}
}
term 2 {
from {
route-filter-list srg1_rf_list;
condition backup_route_exists_srg1;
}
then {
metric 20;
accept;
}
}
term 3 {
from {
route-filter-list srg2_rf_list;
condition active_route_exists_srg2;
}
then {
metric 10;
accept;
}
}
term 4 {
from {
route-filter-list srg2_rf_list;
condition backup_route_exists_srg2;
}
then {
metric 20;
accept;
}
}
term default {
then reject;
}
}
condition active_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.1/32;
table inet.0;
}
}
}
}
condition active_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.1/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg1 {
if-route-exists {
address-family {
inet {
10.39.1.2/32;
table inet.0;
}
}
}
}
condition backup_route_exists_srg2 {
if-route-exists {
address-family {
inet {
10.49.1.2/32;
table inet.0;
}
}
}
}
}
user@srx-02# show protocols
protocols {
bgp {
group 65030 {
type internal;
local-address 10.2.0.2;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.2.0.1;
}
group 65035 {
type external;
export ipsec_pol;
bfd-liveness-detection {
minimum-interval 500;
minimum-receive-interval 500;
multiplier 3;
}
neighbor 10.4.0.2 {
peer-as 65035;
}
}
}
}
user@srx-02# show routing-options
routing-options {
autonomous-system 65030;
static {
route 10.6.0.1/32 next-hop st0.1;
route 10.7.0.0/24 next-hop 10.4.0.2;
route 10.112.0.0/24 next-hop 10.4.0.2;
}
}
vSRX 가상 방화벽(SRX-03)
user@srx-03# show security ike
ike {
proposal SRG1_IKE_PROP {
authentication-method pre-shared-keys;
dh-group group14;
authentication-algorithm sha-256;
encryption-algorithm aes-256-cbc;
lifetime-seconds 3600;
}
proposal SRG2_IKE_PROP {
authentication-method pre-shared-keys;
dh-group group14;
authentication-algorithm sha-256;
encryption-algorithm aes-256-cbc;
lifetime-seconds 3600;
}
policy SRG1_IKE_POL1 {
proposals SRG1_IKE_PROP;
pre-shared-key ascii-text "$abc123"; ## SECRET-DATA
}
policy SRG2_IKE_POL500 {
proposals SRG2_IKE_PROP;
pre-shared-key ascii-text "$abc123"; ## SECRET-DATA
}
gateway SRG1_IKE_GW1 {
ike-policy SRG1_IKE_POL1;
address 10.11.0.1;
external-interface lo0;
local-address 10.112.0.1;
version v2-only;
}
gateway SRG2_IKE_GW500 {
ike-policy SRG2_IKE_POL500;
address 10.12.0.1;
external-interface lo0;
local-address 10.112.0.5;
version v2-only;
}
}
user@srx-03# show security ipsec
ipsec {
proposal SRG1_IPSEC_PROP {
protocol esp;
authentication-algorithm hmac-sha-256-128;
encryption-algorithm aes-256-cbc;
lifetime-seconds 1800;
}
proposal SRG2_IPSEC_PROP {
protocol esp;
authentication-algorithm hmac-sha-256-128;
encryption-algorithm aes-256-cbc;
lifetime-seconds 1800;
}
policy SRG1_IPSEC_POL1 {
proposals SRG1_IPSEC_PROP;
}
policy SRG2_IPSEC_POL500 {
proposals SRG2_IPSEC_PROP;
}
vpn SRG1_IPSEC_VPN1 {
bind-interface st0.1;
ike {
gateway SRG1_IKE_GW1;
ipsec-policy SRG1_IPSEC_POL1;
}
establish-tunnels immediately;
}
vpn SRG2_IPSEC_VPN500 {
bind-interface st0.500;
ike {
gateway SRG2_IKE_GW500;
ipsec-policy SRG2_IPSEC_POL500;
}
traffic-selector ts500 {
local-ip 10.6.255.1/32;
remote-ip 10.1.1.1/32;
}
establish-tunnels immediately;
}
}
user@srx-03# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/0.0;
lo0.0;
}
}
security-zone trust {
host-inbound-traffic {
system-services {
ike;
ping;
ssh;
}
protocols {
bgp;
bfd;
}
}
interfaces {
ge-0/0/1.0;
}
}
security-zone vpn {
host-inbound-traffic {
system-services {
ping;
}
protocols {
bgp;
bfd;
}
}
interfaces {
st0.1;
st0.500;
}
}
user@srx-03# show interfaces
interfaces {
ge-0/0/0 {
description untrust;
unit 0 {
family inet {
address 10.7.0.1/24;
}
}
}
ge-0/0/1 {
description trust;
unit 0 {
family inet {
address 10.6.0.2/24;
}
}
}
lo0 {
unit 0 {
family inet {
address 10.112.0.1/32;
address 10.112.0.5/32;
}
}
}
st0 {
unit 1 {
family inet;
}
unit 500 {
family inet;
}
}
}
user@srx-03# show routing-options
routing-options {
autonomous-system 100;
static {
route 10.1.0.1/32 next-hop st0.1;
route 10.4.0.0/24 next-hop 10.7.0.2;
route 10.5.0.0/24 next-hop 10.7.0.2;
route 10.6.255.0/24 next-hop 10.6.0.1;
route 10.11.0.0/24 next-hop 10.7.0.2;
route 10.12.0.0/24 next-hop 10.7.0.2;
route 10.111.0.1/32 next-hop 10.7.0.2;
route 10.111.0.2/32 next-hop 10.7.0.2;
}
}