在Netscreen上实现高可用性(非全互联主主冗余).pdfVIP

在Netscreen 上实现高可用性（非全互联主主冗余） Written by Zhongjie Fan 在防火墙上实现非全互联主主冗余的主要目的有两个: 一是实现高可用性, 二是分摊 局域网中的流量。能够实现这种效果的防火墙需要SSG 550、NS 204 或以上型号。实验 中使用的是ISG 1000, 版本为5.3.0r6.0。 拓扑图如下: 连接所有的网线，除了两根HA 线以外 1 Juniper ISG1000_A 的配置 1. 主机名 Network DNS Host: Enter the following, then click Apply: Host Name: ISG1000_A 2. VSD 0 接口地址 Network Interfaces Edit (for ethernet1/1): Enter the following, then click OK: Zone Name: Trust Static IP: (选择) IP Address/Netmask: /24 Manage-IP: 选择Interface Mode: Route Network Interfaces Edit (for ethernet1/2): Enter the following, then click OK: Zone Name: Untrust Static IP: (选择) IP Address/Netmask: /24 选择Interface Mode: Route 3. HA 接口 Network Interfaces Edit (for ethernet1/3): Enter the following, then click Apply: Zone Name: HA Network Interfaces Edit (for ethernet1/4): Enter the following, then click Apply: Zone Name: HA 4. NSRP Cluster and VSD Groups Network NSRP Cluster: Enter the following, then click Apply: 选择Cluster ID , 键入 1 选择NSRP Authentication Password, 键入 juniper 选择NSRP Encryption Password, 键入 juniper Network NSRP VSD Group: Enter the following, then click Apply: Network NSRP VSD Group Edit (for Group ID 0): Enter the following, then click OK: Priority: 50 Enable Preempt: (选择) Preempt Hold-Down Time (sec): 3 2 Network NSRP VSD Group New: Enter the following, then click OK: Group ID: 1 Priority: 100 Enable Preempt: (清除) Preempt Hold-Down Time (s): 3 5. 端口监视 Network NSRP Monitor Interface VSD ID: Device Edit Interface: Enter the following, then click OK: Interface Name: ethernet1/1 (选择) Weight: 255 Interface Name: ethernet1/2 (选择) Weight: 255 6. 同步 Network NSRP Link: Enter the following, then click Apply: Enable HA Link Probe (选择) Network NSRP Synchronization: Enter the following, then