Сравнение версий

Старая версия 7

changes.mady.by.user Оксененко Сергей Яковлевич

Сохранено

по сравнению с

Новая версия 8

changes.mady.by.user Оксененко Сергей Яковлевич

Сохранено

Ключ

  • Эта строка добавлена.
  • Эта строка удалена.
  • Изменено форматирование.

...

Схема реализации HA Cluster из 2-х юнитов

Image Added

Схема реализации HA Cluster из 3-х юнитов

Примечание

В примере настройки кластера будет рассмотрен HA Cluster из 2-х юнитов. 

Для настройки более чем 2-х юнитов в кластере необходимо дополнить конфигурацию юнитизированными командами по аналогии с указанным примером.

Scroll Pagebreak

Первичная настройка кластера 

...

Блок кода
titleESR-1
esr# configure 
esr(config)# hostname ESR-1 unit 1
esr(config)# hostname ESR-2 unit 2
Примечание

В конфигурации может одновременно находиться hostname с unit и hostname без unit.

Более приоритетным является является hostname, указанный с привязкой к unit.

...

Так как кластер выполняет синхронизацию состояний между устройствами, необходимо создать зону безопасности SYNC (synchronization) и разрешить прохождение трафика протокола VRRP:

Блок кода
titleESR-1
ESR-1(config)# security zone SYNC
ESR-1(config-security-zone)# exit
ESR-1(config)# security zone-pair SYNC self
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol vrrp
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

Далее перейдите к настройкам кластерного интерфейса:

...

Примечание

Для работы кластерного интерфейса поддерживается только IPv4-адресация.

На cluster-интерфейсе необходима настройка адресов с привязкой к unit. Количество настраиваемых адресов зависит от количества настраиваемых участников кластера.

Настройте идентификатор VRRP, принадлежность VRRP-маршрутизатора к группе, IP-адрес VRRP:

...

Примечание

Адрес VRRP должен быть из той же подсети, что и адреса на интерфейсе.

Примечание

Также на VRRP интерфейсе можно назначить разные приоритеты для разных юнитов для 

Включите протокол VRRP и bridge:

...

Первое устройство полностью настроено и готово к работе.
Аналогичные настройки необходимо произвести на втором устройстве, предварительно сменив у него unit юнит на требуемый. Также возможна настройка второго устройства средствами ZTP.

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit
 
hostname ESR-1 unit 1
hostname ESR-2 unit 2
 
security zone SYNC
exit
 
bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit
 
interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
 
security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exitexit
Решение:

Перейдем в режим конфигурирования устройства:

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit
 
hostname ESR-1 unit 1
hostname ESR-2 unit 2
 
security zone SYNC
exit
 
bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit
 
interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
 
security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit

Создадим для каждого юнита собственный агрегированный интерфейс:

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2.3
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 128.66.0.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/2.4
  security-zone WAN
  ip address 128.66.0.10/30
  vrrp 4
    ip address 128.66.0.14/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2.3
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 128.66.0.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/2.4
  security-zone WAN
  ip address 128.66.0.9/30
  vrrp 4
    ip address 128.66.0.14/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

...

Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone WAN
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authenticationenable
 key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
   exit
  enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.2/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.1/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone WAN
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN WAN
  rule 1
    action permit
    enable
  exit
exit

ip route 0.0.0.0/0 203.0.113.1

...

Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

ip vrf PAIR_ONE
exit
ip vrf PAIR_TWO
exit

security zone SYNC
exit
security zone LAN_ONE
  ip vrf forwarding PAIR_ONE
exit
security zone LAN_TWO
  ip vrf forwarding PAIR_TWO
exit
security zone WAN_ONE
  ip vrf forwarding PAIR_ONE
exit
security zone WAN_TWO
  ip vrf forwarding PAIR_TWO
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
exit
interface gigabitethernet 1/0/2.2
  ip vrf forwarding PAIR_ONE
  security-zone LAN_ONE
  ip address 203.0.113.18/30
  vrrp 4
    ip address 192.0.2.1/24
    priority 120
    group 2
    enable
  exit
exit 
interface gigabitethernet 1/0/2.3
  ip vrf forwarding PAIR_TWO
  security-zone LAN_TWO
  ip address 203.0.113.22/30
  vrrp 5
    ip address 128.66.0.1/24
    priority 110
    group 3
    enable
  exit
exit 
interface gigabitethernet 1/0/3.2
  ip vrf forwarding PAIR_ONE
  security-zone WAN_ONE
  ip address 203.0.113.10/30
  vrrp 2
    ip address 203.0.113.2/30
    group 2
    enable
  exit
exit 
interface gigabitethernet 1/0/3.3
  ip vrf forwarding PAIR_TWO
  security-zone WAN_TWO
  ip address 203.0.113.14/30
  vrrp 3
    ip address 203.0.113.6/30
    group 3
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
exit
interface gigabitethernet 2/0/2.2
  ip vrf forwarding PAIR_ONE
  security-zone LAN_ONE
  ip address 203.0.113.17/30
  vrrp 4
    ip address 192.0.2.1/24
    priority 110
    group 2
    enable
  exit
exit
interface gigabitethernet 2/0/2.3
  ip vrf forwarding PAIR_TWO
  security-zone LAN_TWO
  ip address 203.0.113.21/30
  vrrp 5
    ip address 128.66.0.1/24
    priority 120
    group 3
    enable
  exit
exit 
interface gigabitethernet 2/0/3.2
  ip vrf forwarding PAIR_ONE
  security-zone WAN_ONE
  ip address 203.0.113.9/30
  vrrp 2
    ip address 203.0.113.2/30
    group 2
    enable
  exit
exit
interface gigabitethernet 2/0/3.3
  ip vrf forwarding PAIR_TWO
  security-zone WAN_TWO
  ip address 203.0.113.13/30
  vrrp 3
    ip address 203.0.113.6/30
    group 3
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
exit
security zone-pair LAN_ONE self
  rule 21
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN_TWO self
  rule 31
    action permit
    match protocol ahvrrp
    enable
  exit
exit
security zone-pair LANWAN_ONE self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LANWAN_TWO self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN_ONE WAN_ONE self
  rule 1
    action permit
    matchenable
 protocol vrrp
    enable
  exit
exit
exit
security zone-pair WAN_TWO self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN_ONE WAN_ONE
  rule 1
    action permit
    enable
  exit
exit
security zone-pair LAN_TWO WAN_TWO
  rule 1
    action permit
    enable
  exit
exit

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service DHCP_SERVER
  port-range 67
exit
object-group service DHCP_CLIENT
  port-range 68
exit

security zone SYNC
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit

ip dhcp-server
ip dhcp-server pool TRUSTED
  network 192.0.2.0/24
  address-range 192.0.2.10-192.0.2.100
  default-router 192.0.2.1
exit

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service DHCP_SERVER
  port-range 67
exit
object-group service DHCP_CLIENT
  port-range 68
exit

ip vrf LAN_ONE
exit
ip vrf LAN_TWO
exit

security zone SYNC
exit
security zone LAN_ONE
  ip vrf forwarding LAN_ONE
exit
security zone LAN_TWO
  ip vrf forwarding LAN_TWO
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
exit
interface gigabitethernet 1/0/2.2
  ip vrf forwarding LAN_ONE
  security-zone LAN_ONE
  ip address 192.0.2.254/24
  vrrp 4
    ip address 192.0.2.1/24
    priority 120
    group 2
    enable
  exit
exit
interface gigabitethernet 1/0/2.3
  ip vrf forwarding LAN_TWO
  security-zone LAN_TWO
  ip address 128.66.0.254/24
  vrrp 5
    ip address 128.66.0.1/24
    priority 110
    group 3
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
exit
interface gigabitethernet 2/0/2.2
  ip vrf forwarding LAN_ONE
  security-zone LAN_ONE
  ip address 192.0.2.253/24
  vrrp 4
    ip address 192.0.2.1/24
    priority 110
    group 2
    enable
  exit
exit
interface gigabitethernet 2/0/2.3
  ip vrf forwarding LAN_TWO
  security-zone LAN_TWO
  ip address 128.66.0.253/24
  vrrp 5
    ip address 128.66.0.1/24
    priority 120
    group 3
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
exit
security zone-pair LAN_ONE self
  rule 21
    action permit
    match protocol vrrp
    enable
  exit
  rule 32
    action permit
    match protocol ahudp
    enable
match  exit
exit
security zone-pair LAN_ONE self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match sourcesource-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit
security zone-pair LAN_TWO self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit

ip dhcp-server vrf LAN_ONE
ip dhcp-server pool LAN_ONE vrf LAN_ONE
  network 192.0.2.0/24
  address-range 192.0.2.10-192.0.2.253
  default-router 192.0.2.1
exit
ip dhcp-server vrf LAN_TWO
ip dhcp-server pool LAN_TWO vrf LAN_TWO
  network 128.66.0.0/24
  address-range 128.66.0.10-128.66.0.253
  default-router 128.66.0.1
exit

...

Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone MGMT
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone MGMT
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone MGMT
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair MGMT self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

...

Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN WAN
  rule 1
    action permit
    enable
  exit
exit

...

Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exitpair SYNC self
  rule 31
    action permit
    match protocol ahicmp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone WAN
  ip address 128.66.0.2/30
  vrrp 3
    ip address 203.0.113.1/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/3
  security-zone WAN
  ip address 128.66.0.1/30
  vrrp 3
    ip address 203.0.113.1/30
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

interface gigabitethernet 1/0/3
  security-zone WAN
  ip address 203.0.113.1/30
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

interface gigabitethernet 2/0/3
  security-zone WAN
  ip address 203.0.113.5/30
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

...

Блок кода
titleHUB-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:a0:00
  exit
  unit 2
    mac-address a2:00:00:10:b0:00
  exit
  enable
exit
 
hostname HUB-1 unit 1
hostname HUB-2 unit 2
 
security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit
 
ip access-list extended LOCAL_1
  rule 1
    action permit
    match source-address 198.51.100.2 255.255.255.255
    enable
  exit
exit
ip access-list extended LOCAL_2
  rule 1
    action permit
    match source-address 198.51.100.6 255.255.255.255
    enable
  exit
exit
 
route-map PBR_LOCAL
  rule 1
    match ip access-group LOCAL_1
    action set ip next-hop verify-availability 198.51.100.1 1
  exit
  rule 2
    match ip access-group LOCAL_2
    action set ip next-hop verify-availability 198.51.100.5 1
  exit
exit
route-map DMVPN_BGP_OUT_CLOUD_TWO
  rule 1
    match ip address 0.0.0.0/0
    action set metric bgp 2000
  exit
exit
route-map DMVPN_BGP_OUT_CLOUD_ONE
  rule 1
    match ip address 0.0.0.0/0
    action set metric bgp 1000
  exit
exit
 
ip local policy route-map PBR_LOCAL
 
bridge 1
  vlan 1
  security-zone SYNC
  ip address 192.0.2.5/29 unit 1
  ip address 192.0.2.6/29 unit 2 
  vrrp 1
    ip address 192.0.2.1/29
    group 1
    enable
  exit
  enable
exit
 
interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2.100
  security-zone WAN
  ip address 192.0.2.9/29
  vrrp 2
    ip address 198.51.100.2/30
    group 1
    enable
  exit
  wan load-balance nexthop 198.51.100.1
  wan load-balance enable
exit
interface gigabitethernet 1/0/2.200
  security-zone WAN
  ip address 192.0.2.17/29
  vrrp 3
    ip address 198.51.100.6/30
    group 1
    enable
  exit 
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/24
  vrrp 4
    ip address 128.66.0.1/24
    group 1
    enable
  exit 
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2.100
  security-zone WAN
  ip address 192.0.2.10/29
  vrrp 2
    ip address 198.51.100.2/30
    group 1
    enable
  exit
  wan load-balance nexthop 198.51.100.1
  wan load-balance enable
exit
interface gigabitethernet 2/0/2.200
  security-zone WAN
  ip address 192.0.2.18/29
  vrrp 3
    ip address 198.51.100.6/30
    group 1
    enable
  exit 
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.3/24
  vrrp 4
    ip address 128.66.0.1/24
    group 1
    enable
  exit 
exit
 
security zone-pair SYNC self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
  rule 3
    action permit
    match protocol icmp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
 
ip route 0.0.0.0/0 wan load-balance rule 1
 
wan load-balance rule 1
  outbound interface gigabitethernet 1/0/2.100
  outbound interface gigabitethernet 1/0/2.200
  outbound interface gigabitethernet 2/0/2.200
  outbound interface gigabitethernet 2/0/2.100
  enable
exit

...