Juniper_SRX3600_产品配置维护培训

Copyright©2005JuniperNetworks,Inc.ProprietaryandConfidential产品配置维护培训©2009JuniperNetworks,Inc.Allrightsreserved.2目录一、SRX3600产品介绍二、JUNOS基本命令介绍三、SRX3600配置介绍四、SRX3600日常维护©2009JuniperNetworks,Inc.Allrightsreserved.3目录一、SRX3600产品介绍二、JUNOS基本命令介绍三、SRX3600配置介绍四、SRX3600日常维护©2009JuniperNetworks,Inc.Allrightsreserved.4SRX3600机箱式设计(5U)–12个插槽(前6后6)–最大7块IOC;7块SPC;3块NPC固定接口(SCB)–8-10/100/1000+4-SFP模块化接口–16-10/100/1000;16-SFP;2-XFP多核架构4电源冗余(N+1)性能–防火墙吞吐率(大包)–10/20/30Gbps–并发连接数–2MModelDescriptionSRX3600BASE-ACSRX3600Chassis,Midplane,Fan,RE,SFB-12GE,2xACPEM-nopowercords-noSPC-noNPCSRX3600BASE-DCSRX3600Chassis,Midplane,Fan,RE,SFB-12GE,2xDCPEM-noSPC-noNPC*最少需配1SPC,1N©2009JuniperNetworks,Inc.Allrightsreserved.5SRX3400机箱式设计(3U)–7个插槽(前4后3)–最大4块IOC;4块SPC;2块NPC固定接口(SCB)–8-10/100/1000+4-SFP模块化接口（IOC）–16-10/100/1000;16-SFP;2-XFP多核架构2电源冗余(N+1)性能–防火墙吞吐率(大包)–10/20Gbps–并发连接数–1MModelDescriptionSRX3400BASE-ACSRX3400Chassis,Midplane,Fan,RE,SFB-12GE,ACPEM-nopowercord-noSPC-noNPCSRX3400BASE-DCSRX3400Chassis,Midplane,Fan,RE,SFB-12GE,DCPEM-noSPC-noNPC*最少需配1SPC,1NPC©2009JuniperNetworks,Inc.Allrightsreserved.7IOC2x10GESwitchFabricBoard(SFB)RoutingEngine(RE)FantraydoorAirIntakeServicesProcessingCard(SPC)IOC16xCopperIOC16xSFPFrontSlotguideRearSlotguideServicesProcessingCards(SPC)NetworkProcessingCards(NPC)[orSPCs]Dual-heightSFBoptioncover(SRX3600only)ComponentReview©2009JuniperNetworks,Inc.Allrightsreserved.9SRX3x00SFB–SwitchFabricBoardVirtualIOCControlPanelHA-controlPort0Note^:BITSclocksupportwillrequiredaughter-cardHA-controlPort1BITSclock^SingleStolichipprovides1610Gbpsfull-duplex,non-blockingendpoints(320Gbps).©2009JuniperNetworks,Inc.Allrightsreserved.10SRX3x00SFB-ControlPanelYellowAlarmLEDRedAlarmLEDNote^:OnlyREinslot0supportedatFRS.Forfutureuse.PowerButtonRE0ConsoleRE1^ConsoleAggregatedCFMstatusLEDsHAstatusLEDSFBstatusLEDMasterRE^AUX/USBRE0EthernetRE1^Ethernet©2009JuniperNetworks,Inc.Allrightsreserved.11SRX3x00SFB–VirtualIOCNote:these“built-in”portswillnotworkunlessanNPCandanSPCareinstalledinthesystem.Port0/0/6Port0/0/7Port0/0/1Port0/0/8Port0/0/11Port0/0/0©2009JuniperNetworks,Inc.Allrightsreserved.12SRX系列参数汇总FEATURESSRX3400SRX3600SRX5600SRX5800Interfaces8GE+4SFP8GE+4SFP//Slots712814IOC16SFP,16GE,2XFP16SFP,16GE,2XFP40SFP，4XFP40SFP，4XFPMaximumIOC47611MaximumSPC47611MaximumNPC23//MaximumSCB/Redundant1/No2/Yes2/Yes3/YesMaximumRE/Redundant1/No1/No1/No1/NoFirewallperformance(LargePackets)10/20Gbps10/2030Gbps60Gbps120GbpsFirewallperformance(IMIX)8Gbps18Gbps20Gbps45GbpsFirewallperformance(Firewall+RoutingPPS64byte)3Mpps6Mpps7Mpps15MppsVPNPerformance—AES256+SHA-16Gbps10Gbps15Gbps30GbpsIntrusionPreventionSystem6Gbps10Gbps15Gbps30GbpsConnectionsPerSecond(CPS)175K175K350K350KMaximumConcurrentSessions1M2M8M8MHighAvailabilityA/PA/PA/PA/P©2009JuniperNetworks,Inc.Allrightsreserved.13目录一、SRX3600产品介绍二、JUNOS基本命令介绍三、SRX3600配置介绍四、SRX3600组网讨论©2009JuniperNetworks,Inc.Allrightsreserved.14内容JUNOS基础知识基本命令介绍基本配置注意：本章节是针对SRX系列的JUNOS介绍，与路由器的JUNOS会有少量的不一致。©2009JuniperNetworks,Inc.Allrightsreserved.15设备端口fxp0•带外网管接口，该接口为RE路由转发引擎上的带外以太网管接口。fxp1•该接口为做HA时，用作“HAcontrollink”，该端口必须为SPC的Port0端口互联lo0•Loopback0•你可以配置一个物理loopback端口lo0,可以在这个端口上配置一个或者多个IP地址©2009JuniperNetworks,Inc.Allrightsreserved.16端口命名type-fpc/pic/port.logical•Type–端口名字，定义了端口的物理类型•FPC-FPC所在的槽•PIC-PIC在FPC里面的槽位号（即NPC）•端口号•逻辑端口号0-16384(可选)©2009JuniperNetworks,Inc.Allrightsreserved.17端口命名物理端口都有标准的端口名称•Type类型•FPCslotFPC槽位•PICslotPIC槽位•Portnumber端口号ge-0/0/3©2009JuniperNetworks,Inc.Allrightsreserved.18JUNOS配置Console第一次配置只能通过consoletelnetroot用户不能telnet，必须用其他用户登陆ssh1/ssh2•默认情况下不允许远程访问路由器，你需要配置用户名和密码并且打开telnet或者ssh服务才能远程访问路由器认证可以采用TACACS+或者RADIUS每个用户单独的login,authentication,permissions可以在本地控制©2009JuniperNetworks,Inc.Allrightsreserved.19JUNOS结构结构层次化clearconfiguremonitorsetshowbriefexactprotocoltabletersebgpchassisinterfacesisisospfrouteversionLessSpecificMoreSpecific©2009JuniperNetworks,Inc.Allrightsreserved.20JUNOS结构-配置文件格式结构化格式：showconfiguration##Lastchanged:2007-07-1003:02:03UTCversion8.3R1.5;system{login{userlab{uid2000;classsuper-user;authentication{encrypted-password$1$YMSYkh5o$XTF7tb5yomh9wyLQ4teXe/;##SECRET-DATA}}}services{ftp;telnet;}}interfaces{ge-0/0/0{vlan-tagging;link-modefull-duplex;gigether-options{no-auto-negotiation;}}}routing-options{static{route10.111.0.7/32next-hop10.111.0.22;}}protocols{ospf{export[static_ChinaMobile_TDCS_SG];area0.0.0.0{interfacege-0/0/0.201{interface-typep2p;hello-interval1;dead-interval4;}interfacege-0/2/0.1001{passive;}}}}policy-options{policy-statementstatic_ChinaMobile_TDCS_SG{fromprotocolstatic;thenaccept;}}©2009JuniperNetworks,Inc.Allrightsreserved.21JUNOS结构-配置文件格式命令行格式：showconfiguration|displaysetsetversion8.2R1.7setsystemhost-nameR2setsystemroot-authenticationencrypted-password$1$gxRqk0EX$rlIPzJ.v.lH3lqrGeNF0V0setsystemloginuserlabuid2000setsystemloginuserlabclasssuper-usersetsystemloginuserlabauthenticationencrypted-password$1$Oy.LG59E$osnIHkektw7Ar0V7Y2KCg0setsystemservicesftpsetsystemservicestelnetsetsystem