Juniper vSRX HA配置

一、实验环境介绍
1)vsrx 12.1X47-D20.7

二、实验拓扑
vSRXA1与vSRXA2之间配置Chassis Cluster
ge-0/0/0为带外管理接口(系统默认，不可改)
ge-0/0/1为control-link(系统配置，不可改)
ge-0/0/2为data-link(手工配置，可改)
control-link与data-link采用背靠背的连接方式。

在低端的SRX防火墙带外管理接口、控制接口、数据接口都是业务接口。
在高端的SRX防火墙管理接口、控制接口即为专用接口，只有数据接口为业务接口。

在HA中node1的接口序号将发生变化，在vSRX虚拟器上转为为一个7槽的设备(即slot 0、1、2、3、4、5、6)
node0的接口序号为ge-0/0/0、ge-1/0/0....ge-6/0/0
node1的接口序号为ge-7/0/0、ge-8/0/0...ge-13/0/0

三、SRX 从单机模式到HA模式，需要重启防火墙
1、分别删除两台SRX的配置，分别在两台SRX上设置root认证密码
vSRXA1:
root# delete     #注意12.1X47-D20.7版本必需要先删除默认配置
root# set system root-authentication plain-text-password
New password:
Retype new password:
root# commit
vSRXA2:
root# delete
root# set system root-authentication plain-text-password
New password:
Retype new password:
root# commit
2、转换SRX到HA模式
vSRXA1:
root> set chassis cluster cluster-id 1 node 0 reboot
vSRXA2:
root> set chassis cluster cluster-id 1 node 1 reboot
3、vSRX重启后自动加入HA模式
root> show chassis cluster status
Cluster ID: 1
Node Priority Status Preempt Manual Monitor-failures

Redundancy group: 0 , Failover count: 1
node0 1 primary no no None
node1 1 secondary no no None

{primary:node0}

注： 低端的SRX防火墙中，control-link是预置的，只要防火墙工作于HA模式，ge-0/0/1就为control-link。但是在高端SRX防火墙中有专门的control-link需要手工配置，特别是在SRX5K中。如果不配置control-link防火墙将不能正常启动，SRX5K配置control-link Port命令如下:
set chassis cluster control-ports fpc 2 port 0
set chassis cluster control-ports fpc 5 port 0

四、SRX防火墙HA的配置顺序如下(在master防火墙操作即可)
1)配置管理接口(node0/1的管理地址及backup-router配置)
2)配置HA防火墙data-link接口(ge-0/0/1)
3)配置HA的Redundancy groups(默认0为控制平面，其它为数据平面)
4)配置HA中的业务接口RETH
5)配置HA的切换参数
6)根据以上配置顺序操作，便于异常的反推排查

五、SRX防火墙HA的配置步骤(在master防火墙操作即可)
1、配置管理接口及backup-router路由
root# show configuration | display set
set groups node0 system host-name vSRXA1
set groups node0 system backup-router 10.1.1.254
set groups node0 system backup-router destination 10.1.1.0/24
set groups node0 interfaces fxp0 unit 0 family inet address 10.1.1.2/24
set groups node0 interfaces fxp0 unit 0 family inet address 10.1.1.1/24 master-only
set groups node1 system host-name vSRXA2
set groups node1 system backup-router 10.1.1.254
set groups node1 system backup-router destination 10.1.1.0/24
set groups node1 interfaces fxp0 unit 0 family inet address 10.1.1.3/24
set groups node1 interfaces fxp0 unit 0 family inet address 10.1.1.1/24 master-only
root# set apply-groups "${node}"        #调用前面配置的groups，node0，node1
root# commit       #提交配置并保存
node0:
configuration check succeeds
node1:
commit complete
node0:
commit complete
{primary:node0}[edit]

2、查看node0和node1的带外管理接口状态
root@vSRXA1# run show interfaces terse | match fxp0
root@vSRXA2> show interfaces terse | match fxp0

3、配置HA的data-link，配置的关键字为fab
root@vSRXA1# show interfaces | match fab | display set
set interfaces fab0 fabric-options member-interfaces ge-0/0/2
set interfaces fab1 fabric-options member-interfaces ge-7/0/2
查看fab接口状态信息：
root@vSRXA1# run show chassis cluster interfaces
root@vSRXA2> show interfaces terse | match fab

4、配置HA的Redundancy groups(默认只有group 0 优先级为1，可以手工配置)
root@vSRXA1# show chassis cluster reth-count | display set
set chassis cluster reth-count 8   #定义集群最多支持多少个冗余组(redundancy-group)，默认为0
root@vSRXA1# show chassis cluster | display set | match priority
set chassis cluster redundancy-group 0 node 0 priority 200
set chassis cluster redundancy-group 0 node 1 priority 100
set chassis cluster redundancy-group 1 node 0 priority 200
set chassis cluster redundancy-group 1 node 1 priority 100
查看redundant group的状态：
root@vSRXA1# run show chassis cluster status

5、配置HA环境中的业务接口reth(将物理接口加入到reth组中)
root@vSRXA1# show interfaces | match reth | display set
set interfaces ge-0/0/3 gigether-options redundant-parent reth0
set interfaces ge-0/0/4 gigether-options redundant-parent reth1
set interfaces ge-7/0/3 gigether-options redundant-parent reth0
set interfaces ge-7/0/4 gigether-options redundant-parent reth1

6、将业务接口加到redundancy-group中
set interfaces reth0 redundant-ether-options redundancy-group 1
set interfaces reth1 redundant-ether-options redundancy-group 1
查看reth接口的状态：
root@vSRXA1# run show interfaces terse | match reth
root@vSRXA1# run show chassis cluster interfaces | no-more

7、node0/1之间的切换(手工切换)
root@vSRXA1> request chassis cluster failover redundancy-group 0 node 1
root@vSRXA1> request chassis cluster failover redundancy-group 1 node 1
root@vSRXA1> request chassis cluster failover redundancy-group 1 node 1 force
手工切换后的优先级会达到255，需要手工恢复。
request chassis cluster failover reset redundancy-group 1

8、示例配置，包括cluster、端口映射(23)、nat配置(以下示例配置只需要在主设备上配)
root@SRX1> show configuration | display set

set version 12.1X47-D20.7
set groups node0 system host-name SRX1
set groups node0 system time-zone Asia/Shanghai
set groups node0 system name-server 114.114.114.114
set groups node0 system services web-management http interface fxp0.0
set groups node0 system syslog file traffic-log any any
set groups node0 system syslog file traffic-log match RT_FLOW_SESSION
set groups node0 interfaces fxp0 unit 0 family inet address 10.1.1.1/24
set groups node1 system host-name SRX2
set groups node1 system time-zone Asia/Shanghai
set groups node1 system name-server 114.114.114.114
set groups node1 system services web-management http interface fxp0.0
set groups node1 system syslog file traffic-log any any
set groups node1 system syslog file traffic-log match RT_FLOW_SESSION
set groups node1 interfaces fxp0 unit 0 family inet address 10.1.1.2/24
set apply-groups "${node}"
set system root-authentication plain-text-password   #交互式设置root密码
set chassis cluster reth-count 3
set chassis cluster redundancy-group 0 node 0 priority 200
set chassis cluster redundancy-group 0 node 1 priority 100
set chassis cluster redundancy-group 1 node 0 priority 200
set chassis cluster redundancy-group 1 node 1 priority 100
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/3 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/4 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-0/0/5 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-7/0/3 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-7/0/4 weight 255
set chassis cluster redundancy-group 1 interface-monitor ge-7/0/5 weight 255
set chassis cluster redundancy-group 1 ip-monitoring global-threshold 2
set chassis cluster redundancy-group 1 ip-monitoring retry-interval 3
set chassis cluster redundancy-group 1 ip-monitoring retry-count 5
set chassis cluster redundancy-group 1 ip-monitoring family inet 1.1.12.1 weight 255
set chassis cluster redundancy-group 1 ip-monitoring family inet 1.1.12.1 interface reth0.0 secondary-ip-address 1.1.12.2
set interfaces ge-0/0/3 gigether-options redundant-parent reth0
set interfaces ge-0/0/4 gigether-options redundant-parent reth1
set interfaces ge-0/0/5 gigether-options redundant-parent reth2
set interfaces ge-7/0/3 gigether-options redundant-parent reth0
set interfaces ge-7/0/4 gigether-options redundant-parent reth1
set interfaces ge-7/0/5 gigether-options redundant-parent reth2
set interfaces fab0 fabric-options member-interfaces ge-0/0/2
set interfaces fab1 fabric-options member-interfaces ge-7/0/2
set interfaces reth0 redundant-ether-options redundancy-group 1
set interfaces reth0 unit 0 family inet address 1.1.12.2/24
set interfaces reth1 redundant-ether-options redundancy-group 1
set interfaces reth1 unit 0 family inet address 192.168.1.1/24
set interfaces reth2 redundant-ether-options redundancy-group 1
set interfaces reth2 unit 0 family inet address 172.16.1.1/24
set routing-options static route 0.0.0.0/0 next-hop 1.1.12.1
set security nat source rule-set dmz-to-untrust from zone DMZ
set security nat source rule-set dmz-to-untrust to zone untrust
set security nat source rule-set dmz-to-untrust rule dmz-to-untrust match source-address 172.16.1.0/24
set security nat source rule-set dmz-to-untrust rule dmz-to-untrust match destination-address 0.0.0.0/0
set security nat source rule-set dmz-to-untrust rule dmz-to-untrust then source-nat interface
set security nat source rule-set trust-to-untrust from zone trust
set security nat source rule-set trust-to-untrust to zone untrust
set security nat source rule-set trust-to-untrust rule trust-to-untrust match source-address 192.168.1.0/24
set security nat source rule-set trust-to-untrust rule trust-to-untrust match destination-address 0.0.0.0/0
set security nat source rule-set trust-to-untrust rule trust-to-untrust then source-nat interface
set security nat destination pool dmz-telnet address 172.16.1.2/32
set security nat destination pool dmz-telnet address port 23
set security nat destination pool trust-telnet address 192.168.1.2/32
set security nat destination pool trust-telnet address port 23
set security nat destination rule-set untrust-nat from zone untrust
set security nat destination rule-set untrust-nat rule untrust-to-dmz-telnet match destination-address 1.1.12.2/32
set security nat destination rule-set untrust-nat rule untrust-to-dmz-telnet match destination-port 23
set security nat destination rule-set untrust-nat rule untrust-to-dmz-telnet then destination-nat pool dmz-telnet
set security nat destination rule-set untrust-nat rule untrust-to-trust-telnet match destination-address 1.1.12.2/32
set security nat destination rule-set untrust-nat rule untrust-to-trust-telnet match destination-port 2323
set security nat destination rule-set untrust-nat rule untrust-to-trust-telnet then destination-nat pool trust-telnet
set security policies from-zone untrust to-zone DMZ policy untrust-to-dmz-telnet match source-address any-ipv4
set security policies from-zone untrust to-zone DMZ policy untrust-to-dmz-telnet match destination-address dmz-telnet-server
set security policies from-zone untrust to-zone DMZ policy untrust-to-dmz-telnet match application junos-telnet
set security policies from-zone untrust to-zone DMZ policy untrust-to-dmz-telnet match source-identity any
set security policies from-zone untrust to-zone DMZ policy untrust-to-dmz-telnet then permit
set security policies from-zone untrust to-zone DMZ policy untrust-to-dmz-telnet then log session-init
set security policies from-zone untrust to-zone DMZ policy untrust-to-dmz-telnet then log session-close
set security policies from-zone untrust to-zone trust policy untrust-to-trust-telnet match source-address any-ipv4
set security policies from-zone untrust to-zone trust policy untrust-to-trust-telnet match destination-address trust-telnet-server
set security policies from-zone untrust to-zone trust policy untrust-to-trust-telnet match application junos-telnet
set security policies from-zone untrust to-zone trust policy untrust-to-trust-telnet match source-identity any
set security policies from-zone untrust to-zone trust policy untrust-to-trust-telnet then permit
set security policies from-zone untrust to-zone trust policy untrust-to-trust-telnet then log session-init
set security policies from-zone untrust to-zone trust policy untrust-to-trust-telnet then log session-close
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-ping match source-address dmz-172.16.1.0/24
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-ping match destination-address any-ipv4
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-ping match application junos-icmp-ping
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-ping match source-identity any
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-ping then permit
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-telnet match source-address dmz-172.16.1.0/24
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-telnet match destination-address untrust-server_1.1.1.1/32
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-telnet match application junos-telnet
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-telnet match source-identity any
set security policies from-zone DMZ to-zone untrust policy dmz-to-untrust-telnet then permit
set security policies from-zone trust to-zone untrust policy trust-to-untrust-ping match source-address trust_192.168.1.0/24
set security policies from-zone trust to-zone untrust policy trust-to-untrust-ping match destination-address any-ipv4
set security policies from-zone trust to-zone untrust policy trust-to-untrust-ping match application junos-icmp-ping
set security policies from-zone trust to-zone untrust policy trust-to-untrust-ping match source-identity any
set security policies from-zone trust to-zone untrust policy trust-to-untrust-ping then permit
set security policies from-zone trust to-zone untrust policy trust-to-untrust-telnet match source-address trust_192.168.1.0/24
set security policies from-zone trust to-zone untrust policy trust-to-untrust-telnet match destination-address untrust-server_1.1.1.1/32
set security policies from-zone trust to-zone untrust policy trust-to-untrust-telnet match application junos-telnet
set security policies from-zone trust to-zone untrust policy trust-to-untrust-telnet match source-identity any
set security policies from-zone trust to-zone untrust policy trust-to-untrust-telnet then permit
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-ping match source-address trust_192.168.1.0/24
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-ping match destination-address dmz-172.16.1.0/24
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-ping match application junos-icmp-ping
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-ping match source-identity any
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-ping then permit
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-telnet match source-address trust_192.168.1.0/24
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-telnet match destination-address dmz-telnet-server
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-telnet match application junos-telnet
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-telnet match source-identity any
set security policies from-zone trust to-zone DMZ policy trust-to-dmz-telnet then permit
set security zones security-zone untrust address-book address untrust-server_1.1.1.1/32 1.1.1.1/32
set security zones security-zone untrust interfaces reth0.0 host-inbound-traffic system-services ping
set security zones security-zone trust address-book address trust-telnet-server 192.168.1.2/32
set security zones security-zone trust address-book address trust_192.168.1.0/24 192.168.1.0/24
set security zones security-zone trust interfaces reth1.0 host-inbound-traffic system-services ping
set security zones security-zone DMZ address-book address dmz-telnet-server 172.16.1.2/32
set security zones security-zone DMZ address-book address dmz-172.16.1.0/24 172.16.1.0/24
set security zones security-zone DMZ interfaces reth2.0 host-inbound-traffic system-services ping

参考链接：
      https://blog.51cto.com/ciscosyh/2460653
      https://blog.51cto.com/wanghaiyisu/1584747