Juniper设备配置-路由模式

Copyright©2008JuniperNetworks,Inc.‹#›路由模式2Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›Layer3操作模式ExternalZonePrivateZone1.1.70.2501.1.70.0/2410.1.10.510.1.20.0/24B10.1.10.0/24PublicZone10.1.20.5.254200.5.5.5ABCD10.1.1.0/2410.1.2.0/24.1.254.1.2541.1.7.0/241.1.8.0/24.254.1InterfaceAddressE110.1.1.1E210.1.2.1E71.1.7.1E81.1.8.13Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›静态路由ExternalZonePrivateZone1.1.70.2501.1.70.0/2410.1.10.510.1.20.0/24B10.1.10.0/24PublicZone10.1.20.5.254200.5.5.5ABCD10.1.1.0/2410.1.2.0/24.1.254.1.2541.1.7.0/241.1.8.0/24.254.1NetworkInterfaceNextHop10.1.1.0/24E1-10.1.2.0/24E2-1.1.7.0/24E7-1.1.8.0/24E8-10.1.10.0/24E110.1.1.2544Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›默认网关ExternalZonePrivateZone1.1.70.2501.1.70.0/2410.1.10.510.1.20.0/24B10.1.10.0/24PublicZone10.1.20.5.254200.5.5.5ABCD10.1.1.0/2410.1.2.0/24.1.254.1.2541.1.7.0/241.1.8.0/24.254.1NetworkInterfaceNextHop10.1.1.0/24E1-10.1.2.0/24E2-1.1.7.0/24E7-1.1.8.0/24E8-10.1.10.0/24E110.1.1.2540.0.0.0/0E81.1.8.2545Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›Zones和Interfaces的复习和回顾严格的等级管理接口必须属于一个zone，然后才能为其分配IP地址Int.ZoneZoneIPInt.6Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›配置第三层的步骤1.建立zones(如果没有使用默认的zone)2.分配接口给zone3.分配IP地址给接口4.配置静态路由7Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›Step1:建立ZonessetzonenamenameExample:ns208-setzonenamePrivateNetworkZones8Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›Step2:分配接口给ZonesNetworkInterfaces(Edit)setinterfaceint-namezonezone-namens208-setinterfacee8zoneuntrust9Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›Step3:分配地址给接口setinterfacenameipX.X.X.X/maskns208-setinterfacee8ip1.1.8.1/24NetworkInterfaces(Edit)10Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›Step4:配置静态路由setroutenetwork/maskinterfaceout_intgatewaynhrExample:ns208-setroute10.1.10.0/24interfacee1gateway10.1.1.254NetworkRoutingDestinationEdit11Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›验证接口的配置NetworkInterfacesns208-getinterfaceA-Active,I-Inactive,U-Up,D-Down,R-ReadyInterfacesinvsysRoot:NameIPAddressZoneMACVLANStateVSDeth110.1.1.1/24Private0010.db1d.1be0-U-eth20.0.0.0/0V1-DMZ0010.db1d.1be4-D-eth30.0.0.0/0V1-Untrust0010.db1d.1be5-D-eth40.0.0.0/0Private0010.db1d.1be6-D-eth50.0.0.0/0Untrust0010.db1d.1be7-D-eth60.0.0.0/0Null0010.db1d.1be8-D-eth71.1.7.1/24Public0010.db1d.1be9-U-eth81.1.8.1/24External0010.db1d.1bea-U-vlan10.0.0.0/0VLAN0010.db1d.1bef1D-12Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›验证静态路由–WebUINetworkRoutingDestination13Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›验证静态路由-CLIns208-getrouteuntrust-vr(0entries)-------------------------------------------------------------------------------C-Connected,S-Static,A-Auto-Exported,I-Imported,R-RIPiB-IBGP,eB-EBGP,O-OSPF,E1-OSPFexternaltype1E2-OSPFexternaltype2trust-vr(9entries)-------------------------------------------------------------------------------IDIP-PrefixInterfaceGatewayPPrefMtrVsys-------------------------------------------------------------------------------*70.0.0.0/0eth81.1.8.254S201Root*810.1.1.0/24eth11.1.1.10S201Root910.2.1.0/24eth21.1.2.10S201Root*61.1.8.0/24eth80.0.0.0C00Root1110.3.1.0/24eth31.1.3.10S201Root*51.1.7.0/24eth70.0.0.0C00Root41.1.3.0/24eth30.0.0.0C00Root31.1.2.0/24eth20.0.0.0C00Root*21.1.1.0/24eth10.0.0.0C00Root14Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›验证路由getrouteipaddressns208-getrouteip10.1.10.5DestinationRoutesfor10.1.10.5---------------------trust-vr:=10.1.10.0/24(id=6)via10.1.1.254(vr:trust-vr)Interfaceethernet1,metric115Copyright©2004JuniperNetworks,Inc.ProprietaryandConfidential©2008JuniperNetworks,Inc.‹#›验证路由ns208-ping10.1.10.5TypeescapesequencetoabortSending5,100-byteICMPEchosto10.1.10.5,timeoutis2seconds!!!!!SuccessRateis100percent(5/5),round-triptimemin/avg/max=2/3/9msns208-pingTargetIPaddress:10.1.10.5Repeatcount[5]:Datagramsize[100]:Timeoutinseconds[2]:Sourceinterface:TypeescapesequencetoabortSending5,100-byteIC