Site icon KerKer 的模組世界

[Juniper] Junos虛擬路由冗餘協定(VRRP)備援架構

&NewLine;<p class&equals;"wp-block-paragraph">邊做邊學,順便留個筆記,若有錯誤請不吝指教。 <&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph"> Junos基本操作及root密碼設定可參考我之前的文章:<a href&equals;"https&colon;&sol;&sol;kerker&period;website&sol;juniper-junos&percnt;E5&percnt;9F&percnt;BA&percnt;E6&percnt;9C&percnt;AC&percnt;E6&percnt;93&percnt;8D&percnt;E4&percnt;BD&percnt;9C&percnt;E3&percnt;80&percnt;81root&percnt;E5&percnt;AF&percnt;86&percnt;E7&percnt;A2&percnt;BC&percnt;E8&percnt;A8&percnt;AD&percnt;E5&percnt;AE&percnt;9A&sol;">Juniper Junos基本操作、root密碼設定<&sol;a><&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">所有Juniper相關文章列表:<a href&equals;"https&colon;&sol;&sol;kerker&period;website&sol;juniper-junos-&percnt;E7&percnt;B3&percnt;BB&percnt;E5&percnt;88&percnt;97-&percnt;E6&percnt;96&percnt;87&percnt;E7&percnt;AB&percnt;A0&percnt;E5&percnt;88&percnt;97&percnt;E8&percnt;A1&percnt;A8&sol;">Juniper JunOS 系列文章列表<&sol;a> <&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<&excl;--more-->&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">為了追求更高的可用性,備援機制也相對越來越重要,虛擬路由冗餘協定&lpar;VRRP&rpar;有效的提供了第一跳的備援機制,避免作為閘道&lpar;Gateway&rpar;的設備故障造成網路服務中斷。<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">由於VRRP是標準協定,所以可以在不同廠牌的設備之間建立VRRP的備援機制,以下使用一個簡單的VRRP備援架構來說明Juniper交換器設備VRRP的設定方式。<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">首先我們在兩台L3交換器上建立同樣的vlan,這裡我們使用vlan 100,並為該vlan 指定L3 介面&lpar;interface&rpar;,vlan相關的設定說明可以參考 <strong><a href&equals;"https&colon;&sol;&sol;kerker&period;website&sol;juniper-junos&percnt;E5&percnt;9F&percnt;BA&percnt;E6&percnt;9C&percnt;ACvlan&percnt;E8&percnt;A8&percnt;AD&percnt;E5&percnt;AE&percnt;9A&sol;">Juniper Junos基本vlan設定<&sol;a><&sol;strong> :<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code> KerKer&commat;sw1&num; set vlans v100 vlan-id 100&NewLine; KerKer&commat;sw1&num; set vlans v100 l3-interface irb&period;100&NewLine;&NewLine; KerKer&commat;sw2&num; set vlans v100 vlan-id 100&NewLine; KerKer&commat;sw2&num; set vlans v100 l3-interface irb&period;100<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">需要特別注意的是這兩台switch的vlan 100要接在同一個區域網路架構下&lpar;LAN&rpar;,比較簡單的方式是直接個別設定一個實體介面access vlan 100之後對接即可:<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code> KerKer&commat;sw1&num; set interfaces ge-0&sol;0&sol;0 unit 0 family ethernet-switching interface-mode access&NewLine; KerKer&commat;sw1&num; set interfaces ge-0&sol;0&sol;0 unit 0 family ethernet-switching vlan members 100&NewLine;&NewLine; KerKer&commat;sw2&num; set interfaces ge-0&sol;0&sol;0 unit 0 family ethernet-switching interface-mode access&NewLine; KerKer&commat;sw2&num; set interfaces ge-0&sol;0&sol;0 unit 0 family ethernet-switching vlan members 100<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">接下來我們要在這兩個L3介面上分別給定一個IP,並加入同一個vrrp-group,且指定同一個virtual-address來作為vlan 100的閘道:<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code> KerKer&commat;sw1&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;252&sol;24 vrrp-group 1 virtual-address 192&period;168&period;100&period;254&NewLine;&NewLine; KerKer&commat;sw2&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;253&sol;24 vrrp-group 1 virtual-address 192&period;168&period;100&period;254<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">通常來說我們會手動給定priority,並設定成preempt來保證主要的閘道及備援閘道的角色,這裡我們讓sw1作為我們的主要閘道:<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code> KerKer&commat;sw1&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;252&sol;24 vrrp-group 1 priority 254&NewLine; KerKer&commat;sw1&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;252&sol;24 vrrp-group 1 preempt&NewLine;&NewLine; KerKer&commat;sw2&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;253&sol;24 vrrp-group 1 priority 253&NewLine; KerKer&commat;sw2&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;253&sol;24 vrrp-group 1 preempt<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">另外VRRP的virtual-address預設是不接受任何除了arp以外的封包,為了方便透過icmp ping測試是否有正確連通,可以設定accept-data來允許arp以外的封包:<&sol;p>&NewLine;&NewLine;&NewLine;&NewLine;<pre class&equals;"wp-block-code"><code> KerKer&commat;sw1&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;252&sol;24 vrrp-group 1 accept-data&NewLine;&NewLine; KerKer&commat;sw2&num; set interfaces irb unit 100 family inet address 192&period;168&period;100&period;253&sol;24 vrrp-group 1 accept-data<&sol;code><&sol;pre>&NewLine;&NewLine;&NewLine;&NewLine;<p class&equals;"wp-block-paragraph">這樣一來只要將在vlan 100的設備都設定成以 virtual-address 作為閘道&lpar;Gateway&rpar;,就可以有效的避免單台設備故障造成第一跳失效的問題了。<&sol;p>&NewLine;

Exit mobile version