Juniper SRX 220

Question

我是Juniper和SRX的新手。我们刚刚设置了一个包含2台Juniper SRX 220设备的集群，我正在努力设置reth接口。杜松树必须有2条到Cicso ASA的上行链路。此时接口ge-0/0/0、ge-3/0/0和ge-0/0/1、ge-/0/01连接到ASA。我已经设置了一个VLAN‘s192，并将reth1接口添加到这个VLAN中。我可以ping通reth1接口，但不能ping通另一端的ASA接口。请告诉我哪里做错了。配置如下。

chassis {

cluster {

reth-count 2;

redundancy-group 0 {

node 0 priority 100;

node 1 priority 1;

}

redundancy-group 1 {

node 0 priority 100;

node 1 priority 1;

preempt;

interface-monitor {

ge-3/0/1 weight 255;

ge-0/0/1 weight 255;


}

}

}

}

interfaces {

interface-range interfaces-fwtransit {

member ge-0/0/0;

member ge-3/0/0;

unit 0 {

family ethernet-switching {

vlan {

members fwtransit;

}

}

}

}

ge-0/0/1 {

gigether-options {

redundant-parent reth1;

}

}

ge-0/0/3 {

unit 0 {

family inet {

address 10.100.0.252/24;

}

}

}

ge-3/0/1 {

gigether-options {

redundant-parent reth1;

}

}

fab0 {


fabric-options {

member-interfaces {

ge-0/0/5;

}

}

}

fab1 {

fabric-options {

member-interfaces {

ge-3/0/5;

}

}

}

reth0 {

vlan-tagging;

redundant-ether-options {

redundancy-group 1;

}

}

reth1 {

vlan-tagging;

redundant-ether-options {

redundancy-group 1;

}

unit 192 {

description untrust;

vlan-id 192;
family inet {

address 192.168.2.252/24;

}

}

}

vlan {

unit 0 {


family inet {

address 192.168.1.1/24;

}

}

unit 162 {

family inet {

address 172.31.254.3/24;

}

}

unit 192 {

family inet {

address 192.168.2.3/24;

}

}

}

}

routing-options {

static {

route 10.100.0.0/24 next-hop 10.100.0.1;

}

}

protocols {

stp;

}

security {

zones {

security-zone trust {

interfaces {

ge-0/0/3.0 {

host-inbound-traffic {

system-services {

ping;

https;

ssh;

}

}

}

}

}

security-zone untrust {

host-inbound-traffic {

system-services {

ping;

}

}

interfaces {

vlan.162;

vlan.192;

}

}

}

}

vlans {

fwtransit {

vlan-id 162;

l3-interface vlan.162;

}

web_dmz {
vlan-id 192;

l3-interface vlan.192;

}
}

Answer 1

我的理解是你有这样的东西:拓扑：

​

因为您已经在host-inbound-traffic下有了ICMP，所以您可以检查：

1. 作为一个初始的宕机/脏测试，是一个允许一切的安全策略。前提是：“如果流量目的地是传入接口以外的任何接口，Junos OS会检查安全策略。”

2.监控接口上的流量，确保ICMP ECHOs正在离开线路，如果没有响应，则可能是ASA上的某些东西离开了线路。

1. 您是否检查过丢弃或错误的接口统计信息？

Answer 2

请检查您是否已使用以下各项配置了正确的策略：-显示配置安全策略

您可以使用以下命令配置策略：

set security policy from-zone xxx to-zone xxx policy my-policy match source-address any destination-address any application any
set security policy from-zone xxx to-zone xxx policy my-policy then permit

并尝试通过指定源接口来ping ASA接口：- ping x.xinterface ge-0/0/0

也许您还想定义一个环回接口，并将此接口添加到您的："trust"-security-zone中