juniper 防火墙配置HA（高可用）

需求：srx340防火墙配置HA（高可用）双机热备

配置HA前提条件：

2台设备的硬件型号、 硬件配置、 板卡槽位完全一样， 即2台配置一模一样的硬件设备

2台设备的操作系统软件版本一致
直连线缆按照各个设备指定模式连接

在每台 SRX340 上都要使用 3 个口用做 HA， 其中 GE-0/0/1 直连另一台的 GE-0/0/1 用于
CONTROL LINK（不可自定义）； GE-0/0/7 直连另一台的 GE-0/0/7 用于 FABRIC LINK（可
以随意指定其他可用接口）； MGMT 用于 FXP0 带外管理口（ 不可自定义指定）。

配置如下

在SRX340-A上的操作模式下执行：
set chassis cluster cluster-id 1 node 0 reboot
在SRX340-B上的操作模式下执行
set chassis cluster cluster-id 1 node 1 reboot

在 SRX340-A 上执行下面命令：
set groups node0 system host-name srx340-A
set groups node0 interfaces fxp0 unit 0 family inet address 192.168.101.1/24
set groups node1 system host-name srx340-B
set groups node1 interfaces fxp0 unit 0 family inet address 192.168.101.2/24
set apply-groups "${node}"
set chassis cluster reth-count 2
set chassis cluster redundancy-group 0 node 0 priority 200
set chassis cluster redundancy-group 0 node 1 priority 100
set chassis cluster redundancy-group 1 node 0 priority 200
set chassis cluster redundancy-group 1 node 1 priority 100
set interfaces fab0 fabric-options member-interfaces ge-0/0/7
set interfaces fab1 fabric-options member-interfaces ge-5/0/7
set interfaces ge-0/0/0 gigether-options redundant-parent reth0
set interfaces ge-5/0/0 gigether-options redundant-parent reth0
set interfaces ge-0/0/2 gigether-options redundant-parent reth1
set interfaces ge-5/0/2 gigether-options redundant-parent reth1
set interfaces reth0 redundant-ether-options redundancy-group 1
set interfaces reth1 redundant-ether-options redundancy-group 1
set security zones security-zone Trusted
set security zones security-zone Untrusted
set security zones security-zone Trusted host-inbound-traffic system-services all
set interfaces reth0 unit 0 family inet address 172.16.1.1/24
set security zones security-zone Trusted interfaces reth0.0
set interfaces reth1 unit 0 family inet address 192.168.1.238/24
set security zones security-zone Untrusted interfaces reth1.0

#配置监控接口，当接口 DOWN 时切换设备
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/0 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-5/0/0 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/2 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-5/0/2 weight 255

验证HA状态