...
Создадим профиль адреса сервера из WAN-сети, с которого будем принимать:
...
| Блок кода | ||
|---|---|---|
| ||
cluster
cluster-interface bridge 1
unit 1
mac-address a2:00:00:10:c0:00
exit
unit 2
mac-address a2:00:00:10:d0:00
exit
enable
exit
hostname ESR-1 unit 1
hostname ESR-2 unit 2
security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit
bridge 1
vlan 1
security-zone SYNC
ip address 198.51.100.254/24 unit 1
ip address 198.51.100.253/24 unit 2
vrrp 1
ip address 198.51.100.1/24
priority 254 unit 1
priority 253 unit 2
group 1
enable
exit
enable
exit
interface gigabitethernet 1/0/1
mode switchport
spanning-tree disable
exit
interface gigabitethernet 1/0/2
security-zone LAN
ip address 192.0.2.254/24
vrrp 2
ip address 192.0.2.1/24
group 1
enable
exit
exit
interface gigabitethernet 1/0/3
security-zone WAN
ip address 128.66.0.2/30
vrrp 3
ip address 203.0.113.1/30
group 1
enable
exit
exit
interface gigabitethernet 2/0/1
mode switchport
spanning-tree disable
exit
interface gigabitethernet 2/0/2
security-zone LAN
ip address 192.0.2.253/24
vrrp 2
ip address 192.0.2.1/24
group 1
enable
exit
exit
interface gigabitethernet 2/0/3
security-zone WAN
ip address 128.66.0.1/30
vrrp 3
ip address 203.0.113.1/30
group 1
enable
exit
exit
security zone-pair SYNC self
rule 1
action permit
match protocol icmp
enable
exit
exit
security zone-pair LAN self
rule 1
action permit
match protocol vrrp
enable
exit
rule 2
action permit
match protocol ah
enable
exit
exit
security zone-pair WAN self
rule 1
action permit
match protocol vrrp
enable
exit
exit |
| Scroll Pagebreak |
|---|
Решение:
Настроем firewall для приема маршрутизатором BGP-трафика из зоны безопасности WAN:
...