История страницы

...

Блок кода

title	ESR-1

cluster
  cluster-interface bridge 1
  unit 1
    mac-address cca2:9d00:a200:7110:83c0:7800
  exit
  unit 2
    mac-address cca2:9d00:a200:7110:82d0:3800
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
  enable
exit

interface gigabitethernet 1/0/1.1001
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WANLAN
  ip address 192.0.2.9254/2924
  vrrp id 2
  vrrp ip 198192.510.1002.21/3024
  vrrp group 1
  vrrp
  wan load-balance nexthop 198.51.100.1
  wan load-balance enable
exit
interface gigabitethernet 1/0/1.2003
  security-zone WAN
  ip address 192203.0.2113.17/29
  vrrp id 3
  vrrp ip 198.51.100.6/30
  vrrp group 1
  vrrp
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
1/30
exit
interface gigabitethernet 12/0/21
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 12/0/32
  security-zone LAN
  ip address 128.66192.0.2.253/24
  vrrp id 42
  vrrp ip 128192.660.02.1/24
  vrrp group 1
  vrrp
exit
interface gigabitethernet 2/0/1.1003
  security-zone WAN
  ip address 192203.0.2113.10/29
  vrrp id 25/30
exit

security zone-pair SYNC self
  rule 1
  vrrp  ip 198.51.100.2/30action permit
  vrrp group 1
match protocol vrrpicmp
   wan load-balanceenable
 nexthop 198.51.100.1 exit
  wan load-balance enable
exit
interface gigabitethernet 2/0/1.200rule 2
  security-zone WAN
  ip address 192.0.2.18/29action permit
  vrrp id 3
match protocol vrrp ip 198.51.100.6/30
  vrrp group 1enable
  vrrp
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
exit
interface gigabitethernet 2/0/2
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/ rule 3
  security-zone LAN
  ip address 128.66.0.3/24action permit
  vrrp id 4
match  vrrp ip 128.66.0.1/24protocol ah
  vrrp group 1enable
  vrrpexit
exit

security zone-pair SYNCLAN self
  rule 1
    action permit
    match protocol icmpvrrp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit

Решение:

Сконфигурируем необходимые сетевые интерфейсы:

Блок кода

ESR-1(config)# interface gigabitethernet 1/0/1
ESR-1(config-if-gi)# ip address 203.0.113.1/30
ESR-1(config-if-gi)# exit
ESR-1(config)# interface gigabitethernet 2/0/1
ESR-1(config-if-gi)# ip address 203.0.113.5/30
ESR-1(config-if-gi)# exit

Сконфигурируем зону безопасности WAN, настроем firewall для приема маршрутизатором BGP-трафика из зоны безопасности WAN, а также разрешим прохождение трафика из зоны LAN в зону WAN:

Блок кода

ESR-1(config)# object-group service og_bgp
ESR-1(config-object-group-service)# port-range 179
ESR-1(config-object-group-service)# exit
ESR-1(config)# security zone WAN
ESR-1(config-security-zone)# exit
ESR-1(config)# security zone-pair WAN self 
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol icmp
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# rule 2
ESR-1(config-security-zone-pair-rule)#    match protocol tcp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group og_bgp 
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# enable ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

Решение:

Настроем firewall для приема маршрутизатором BGP-трафика из зоны безопасности WAN:

Блок кода

ESR-1(config)# object-group service og_bgp
ESR-1(config-securityobject-zonegroup-pair-ruleservice)# port-range exit179
ESR-1(config-securityobject-zonegroup-pairservice)# exit
ESR-1(config)# security zone-pair LANWAN WANself 
ESR-1(config-security-zone-pair)# rule 12
ESR-1(config-security-zone-pair-rule)# match actionprotocol permittcp
ESR-1(config-security-zone-pair-rule)# enable match destination-port object-group og_bgp 
ESR-1(config-security-zone-pair-rule)# action permit exit
ESR-1(config-security-zone-pair)# exit

И укажем принадлежность интерфейсов к зоне безопасности:

Блок кода

ESR-1(config-rule)# interface gigabitethernet 1/0/1enable 
ESR-1(config-if-gi)# security-zone WAN 
ESR-1(config-if-gi-pair-rule)# exit
ESR-1(config)# interface gigabitethernet 2/0/1
ESR-1(config-if-gi)# security-zone WAN 
ESR-1(config-if-gi-pair)# exit

...

Создадим track для последующего управления анонсами маршрутов в кластере.

...

Дерево страниц

Сравнение версий

Старая версия 103

Новая версия 104

Ключ

Решение:

Решение: