配置SRX100 b雙機熱備HA心得：廠商指定F0/0/7-控制接口，F(xiàn)0/0/6-設(shè)備管理接口
1、配置 Cluster id 和 Node id
set chassis cluster cluster-id 1 node 0 reboot
set chassis cluster cluster-id 1 node 1 reboot
注：node越小，級別越高，為主設(shè)備。另外，需要先把接口刪除，否則重啟后不能進入configure模式。
2、配置控制接口和數(shù)據(jù)接口，數(shù)據(jù)這里接口我這里自己指定為F0/0/2
控制接口系統(tǒng)默認指定F0/0/7，不需要配置，直接2臺設(shè)備F0/0/7互聯(lián)就行。
set interfaces fab0 fabric-options member-interfaces fe-0/0/2
set interfaces fab1 fabric-options member-interfaces fe-1/0/2
注：數(shù)據(jù)接口不用配置ip
3、每個機箱的個性化配置 ：
set groups node0 system host-name SRX-A
set groups node0 interfaces fxp0 unit 0 family inet address 192.168.100.100/24 #####主設(shè)備的管理ip
set groups node1 system host-name SRX-B
set groups node1 interfaces fxp0 unit 0 family inet address 192.168.100.101/24#####備設(shè)備的管理ip
set apply-groups "${node}"
注：2臺設(shè)備的管理ip都是fxp0，另外配置完成記得set apply-groups "${node}"，否則出現(xiàn)問題。
4、配置 Redundancy Group ：RG0為引擎切換。RG1為數(shù)據(jù)層面切換，記得此處有開啟preemt搶占。
set chassis cluster reth-count 8
set chassis cluster redundancy-group 0 node 0 priority 200
set chassis cluster redundancy-group 0 node 1 priority 100
set chassis cluster redundancy-group 1 node 0 priority 200
set chassis cluster redundancy-group 1 node 1 priority 100
set chassis cluster redundancy-group 1 preempt
set chassis cluster redundancy-group 1 interface-monitor fe-0/0/0 weight 255########配置接口interface-monitor
set chassis cluster redundancy-group 1 interface-monitor fe-0/0/1 weight 255########配置接口interface-monitor
set chassis cluster redundancy-group 1 interface-monitor fe-1/0/0 weight 255########配置接口interface-monitor
set chassis cluster redundancy-group 1 interface-monitor fe-1/0/1 weight 255########配置接口interface-monitor
5、將interface-monitor加入到冗余接口reth0 reth2，并把冗余接口加入到RG1
set interfaces fe-0/0/0 fastether-options redundant-parent reth0
set interfaces fe-0/0/0 unit 0
set interfaces fe-0/0/1 fastether-options redundant-parent reth2
set interfaces fe-0/0/1 unit 0
set interfaces fe-1/0/0 fastether-options redundant-parent reth0
set interfaces fe-1/0/0 unit 0
set interfaces fe-1/0/1 fastether-options redundant-parent reth2
set interfaces fe-1/0/1 unit 0
set interfaces reth0 redundant-ether-options redundancy-group 1
set interfaces reth2 redundant-ether-options redundancy-group 1
6、給冗余接口reth0 reth2配置ip，劃入對應的區(qū)域，及策略放通。
set interfaces reth0 unit 0 family inet address 202.100.1.10/24
set interfaces reth2 unit 0 family inet address 192.168.10.10/24
set security zones security-zone untrust interfaces reth0.0 host-inbound-traffic system-services all
set security zones security-zone untrust interfaces reth0.0 host-inbound-traffic protocols all
set security zones security-zone trust interfaces reth2.0 host-inbound-traffic system-services all
set security zones security-zone trust interfaces reth2.0 host-inbound-traffic protocols all
set security policies from-zone untrust to-zone trust policy untrust-to-trust match source-address any
set security policies from-zone untrust to-zone trust policy untrust-to-trust match destination-address any
set security policies from-zone untrust to-zone trust policy untrust-to-trust match application any
set security policies from-zone untrust to-zone trust policy untrust-to-trust then permit
set security policies from-zone trust to-zone trust policy trust-to-trust match source-address any
set security policies from-zone trust to-zone trust policy trust-to-trust match destination-address any
set security policies from-zone trust to-zone trust policy trust-to-trust match application any
set security policies from-zone trust to-zone trust policy trust-to-trust then permit
另外有需要云服務器可以了解下創(chuàng)新互聯(lián)scvps.cn，海內(nèi)外云服務器15元起步，三天無理由+7*72小時售后在線，公司持有idc許可證，提供“云服務器、裸金屬服務器、高防服務器、香港服務器、美國服務器、虛擬主機、免備案服務器”等云主機租用服務以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡單易用、服務可用性高、性價比高”等特點與優(yōu)勢，專為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應用場景需求。
重慶分公司
重慶分公司
