Juniper防火墙IS-IS单区域配置实例

拓扑图中的节点都在areaID为49.0001的区域中。由于IS-IS的地址都是基于ISO形式的，所以每个参与IS-IS的接口都要封装成ISO格式，一个节点的NET地址是基于环回口来分配地址的，并且从7.2版本后环回口默认是passive的，本实验是基于单区域来分析ISIS的路由学习过程的，以下是配置脚本：

olive# show logical-systems
r1 {
    interfaces {
        em1 {
            unit 12 {
                vlan-id 12;
                family inet {
                    address 10.0.4.5/30;
                }
                family iso;//每个参与IS-IS进程的接口都要封装成iso格式
            }
            unit 13 {
                vlan-id 13;
                family inet {
                    address 10.0.4.14/30;
                }
                family iso;
            }
        }
        lo0 {
            unit 1 {
                family inet {
                    address 10.0.0.1/32;
                }
                family iso {
                    address 49.0001.0000.0000.0001.00;
                }//49代表私有AFI，区域ID为0001，systemID为0000.0000.0001（同区域中的systemID必须具有惟一性），n-selector统一为00
            }
        }
    }
    protocols {
        isis {
            interface em1.12 {
                level 2 disable;//通告的借口默认都通告到level1和2网络中去，此命令是阻止该接口被通告到level2网络中去
            }
            interface em1.13 {
                level 2 disable;
            }
            interface lo0.1;//环回口默认都是passive的
        }
    }
}
r2 {
    interfaces {
        em2 {
            unit 21 {
                vlan-id 12;
                family inet {
                    address 10.0.4.6/30;
                }
                family iso;
                family mpls;
            }
            unit 23 {
                vlan-id 23;
                family inet {
                    address 10.0.4.2/30;
                }
                family iso;
            }
            unit 24 {
                vlan-id 24;
                family inet {
                    address 10.0.4.10/30;
                }
                family iso;
            }
        }
        lo0 {
            unit 2 {
                family inet {
                    address 10.0.0.2/32;
                }
                family iso {
                    address 49.0001.0000.0000.0002.00;
                }//AFI为私有的49，areaID为0001，systemID为0000.0000.0002
            }
        }
    }
    protocols {
        isis {
            interface em2.21 {
                level 2 disable;
            }
            interface em2.23 {
                level 2 disable;
            }
            interface lo0.2 {
                passive;
            }
        }
    }
}
r3 {
    interfaces {
        em3 {
            unit 31 {
                vlan-id 13;
                family inet {
                    address 10.0.4.13/30;
                }
                family iso;
            }
            unit 32 {
                vlan-id 23;
                family inet {
                    address 10.0.4.1/30;
                }
                family iso;
            }
            unit 34 {
                vlan-id 34;
                family inet {
                    address 10.0.2.5/30;
                }
                family iso;
            }
            unit 35 {
                vlan-id 35;
                family inet {
                    address 10.0.2.2/30;
                }
            }
        }
        lo0 {
            unit 3 {
                family inet {
                    address 10.0.0.3/32;
                }
                family iso {
                    address 49.0001.0000.0000.0003.00;
                }
            }
        }
    }
    protocols {
        isis {
            interface em3.31 {
                level 2 disable;
            }
            interface em3.32 {
                level 2 disable;
            }
            interface em3.34 {
                level 1 disable;
            }
            interface lo0.3 {
                passive;
            }
        }
    }
}
r4 {
    interfaces {
        em4 {
            unit 42 {
                vlan-id 24;
                family inet {
                    address 10.0.4.9/30;
                }
            }
            unit 43 {
                vlan-id 34;
                family inet {
                    address 10.0.2.6/30;
                }
                family iso;
            }
            unit 45 {
                vlan-id 45;
                family inet {
                    address 10.0.2.10/30;
                }
                family iso;
            }
        }
        lo0 {
            unit 4 {
                family inet {
                    address 10.0.0.4/32;
                }
                family iso {
                    address 49.0001.0000.0000.0004.00;
                }
            }
        }
    }
    protocols {
        isis {
            interface em4.43 {
                level 1 disable;
            }
            interface em4.45 {
                level 1 disable;
            }
            interface lo0.4 {
                passive;
            }
        }
    }
}
r5 {
    interfaces {
        em5 {
            unit 53 {
                vlan-id 35;
                family inet {
                    address 10.0.2.1/30;
                }
            }
            unit 54 {
                vlan-id 45;
                family inet {
                    address 10.0.2.9/30;
                }
                family iso;
            }
            unit 56 {
                vlan-id 56;
                family inet {
                    address 10.0.8.6/30;
                }
                family iso;
            }
            unit 57 {
                vlan-id 57;
                family inet {
                    address 10.0.8.9/30;
                }
                family iso;
            }
        }
        lo0 {
            unit 5 {
                family inet {
                    address 10.0.0.5/32;
                }
                family iso {
                    address 49.0001.0000.0000.0005.00;
                }
            }
        }
    }
    protocols {
        isis {
            interface em5.54 {
                level 1 disable;
            }
            interface em5.56 {
                level 2 disable;
            }
            interface em5.57 {
                level 2 disable;
            }
            interface lo0.5 {
                passive;
            }
        }
    }
}
r6 {
    interfaces {
        em6 {
            unit 65 {
                vlan-id 56;
                family inet {
                    address 10.0.8.5/30;
                }
                family iso;
            }
            unit 67 {
                vlan-id 67;
                family inet {
                    address 10.0.8.1/30;
                }
                family iso;
            }
        }
        lo0 {
            unit 6 {
                family inet {
                    address 10.0.0.6/32;
                }
                family iso {
                    address 49.0001.0000.0000.0006.00;
                }
            }
        }
    }
    protocols {
        isis {
            interface em6.65 {
                level 2 disable;
            }
            interface em6.67 {
                level 2 disable;
            }
            interface lo0.6 {
                passive;
            }
        }
    }
}
r7 {
    interfaces {
        em7 {
            unit 75 {
                vlan-id 57;
                family inet {
                    address 10.0.8.10/30;
                }
                family iso;
            }
            unit 76 {
                vlan-id 67;
                family inet {
                    address 10.0.8.2/30;
                }
                family iso;
            }
        }
        lo0 {
            unit 7 {
                family inet {
                    address 10.0.0.7/32;
                }
                family iso {
                    address 49.0001.0000.0000.0007.00;
                }
            }
        }
    }
    protocols {
        isis {
            interface em7.75 {
                level 2 disable;
            }
            interface em7.76 {
                level 2 disable;
            }
            interface lo0.7 {
                passive;
            }
        }
    }
}
查看IS-IS接口状态
olive# run show isis interface logical-system all
logical-system: r1
IS-IS interface database:
Interface             L CirID Level 1 DR        Level 2 DR        L1/L2 Metric
em1.12                1   0x1 -r1.00            Disabled// 在这个接  10/10             口中level2被disable掉了，所以该接口不再参与level2进程
em1.13                1   0x1 -r3.02            Disabled               10/10
lo0.1                 0   0x1 Passive           Passive//环回口默认passive                 0/0
-----
logical-system: r2
em2.21                1   0x2 -r2.00            Disabled               10/10
em2.23                1   0x1 -r3.03            Disabled               10/10
lo0.2                 0   0x1 Passive           Passive                 0/0
-----
logical-system: r5
em5.54                2   0x2 Disabled          -r5.02                 10/10
em5.56                1   0x1 -r6.02            Disabled               10/10
em5.57                1   0x1 -r7.03            Disabled               10/10
lo0.5                 0   0x1 Passive           Passive                 0/0
-----
logical-system: r4
em4.43                2   0x2 Disabled          -r4.02                 10/10
em4.45                2   0x1 Disabled          -r5.02                 10/10
lo0.4                 0   0x1 Passive           Passive                 0/0
-----
logical-system: r3
em3.31                1   0x2 -r3.02            Disabled               10/10
em3.32                1   0x3 -r3.03            Disabled               10/10
em3.34                2   0x1 Disabled          -r4.02                 10/10
lo0.3                 0   0x1 Passive           Passive                 0/0
-----
logical-system: r7
em7.75                1   0x3 -r7.03            Disabled               10/10
em7.76                1   0x2 -r7.02            Disabled               10/10
lo0.7                 0   0x1 Passive           Passive                 0/0
-----
logical-system: r6
em6.65                1   0x2 -r6.02            Disabled               10/10
em6.67                1   0x1 -r7.02            Disabled               10/10
lo0.6                 0   0x1 Passive           Passive                 0/0
查看isis adjacency状态
olive> show isis adjacency logical-system all
logical-system: r1
Interface             System         L State        Hold (secs) SNPA
em1.12                -r2            1  Up                    6  0:c:29:ef:61:93
em1.13                -r3            1  Up                    6  0:c:29:ef:61:9d
-----
logical-system: r2
em2.21                -r1            1  Up                   23  0:c:29:ef:61:89
em2.23                -r3            1  Up                    6  0:c:29:ef:61:9d
-----
logical-system: r5
em5.54                -r4            2  Up                   21  0:c:29:ef:61:a7
em5.56                -r6            1  Up                    8  0:c:29:ef:61:bb
em5.57                -r7            1  Up                    6  0:c:29:ef:61:c5
-----
logical-system: r4
em4.43                -r3            2  Up                   20  0:c:29:ef:61:9d
em4.45                -r5            2  Up                    7  0:c:29:ef:61:b1
-----
logical-system: r3
em3.31                -r1            1  Up                   26  0:c:29:ef:61:89
em3.32                -r2            1  Up                   20  0:c:29:ef:61:93
em3.34                -r4            2  Up                    7  0:c:29:ef:61:a7
-----
logical-system: r7
em7.75                -r5            1  Up                   22  0:c:29:ef:61:b1
em7.76                -r6            1  Up                   23  0:c:29:ef:61:bb
-----
logical-system: r6
em6.65                -r5            1  Up                   21  0:c:29:ef:61:b1
em6.67                -r7            1  Up                    6  0:c:29:ef:61:c5
查看IS-IS路由信息
olive> show route protocol isis logical-system all
logical-system: r1
inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both   

10.0.0.2/32        *[IS-IS/15] 00:01:48, metric 10
                    > to 10.0.4.6 via em1.12
10.0.0.3/32        *[IS-IS/15] 00:01:23, metric 10
                    > to 10.0.4.13 via em1.13
10.0.4.0/30        *[IS-IS/15] 00:01:23, metric 20
                    > to 10.0.4.6 via em1.12
                      to 10.0.4.13 via em1.13
iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
-----
logical-system: r2
inet.0: 10 destinations, 10 routes (10 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both   

10.0.0.1/32        *[IS-IS/15] 00:01:48, metric 10
                    > to 10.0.4.5 via em2.21
10.0.0.3/32        *[IS-IS/15] 00:00:58, metric 10
                    > to 10.0.4.1 via em2.23
10.0.4.12/30       *[IS-IS/15] 00:00:58, metric 20
                    > to 10.0.4.5 via em2.21
                      to 10.0.4.1 via em2.23   

iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
-----
logical-system: r5
inet.0: 20 destinations, 20 routes (20 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both   

10.0.0.1/32        *[IS-IS/18] 00:01:22, metric 30
                    > to 10.0.2.10 via em5.54
10.0.0.2/32        *[IS-IS/18] 00:00:58, metric 30
                    > to 10.0.2.10 via em5.54
10.0.0.3/32        *[IS-IS/18] 00:01:22, metric 20
                    > to 10.0.2.10 via em5.54
10.0.0.4/32        *[IS-IS/18] 00:01:46, metric 10
                    > to 10.0.2.10 via em5.54
10.0.0.6/32        *[IS-IS/15] 00:01:45, metric 10
                    > to 10.0.8.5 via em5.56
10.0.0.7/32        *[IS-IS/15] 00:00:56, metric 10
                    > to 10.0.8.10 via em5.57
10.0.2.4/30        *[IS-IS/18] 00:01:46, metric 20
                    > to 10.0.2.10 via em5.54
10.0.4.0/30        *[IS-IS/18] 00:01:22, metric 30
                    > to 10.0.2.10 via em5.54
10.0.4.4/30        *[IS-IS/18] 00:01:22, metric 40
                    > to 10.0.2.10 via em5.54
10.0.4.12/30       *[IS-IS/18] 00:01:22, metric 30
                    > to 10.0.2.10 via em5.54
10.0.8.0/30        *[IS-IS/15] 00:00:56, metric 20
                    > to 10.0.8.5 via em5.56
                      to 10.0.8.10 via em5.57
iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
-----
logical-system: r4
inet.0: 19 destinations, 19 routes (19 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both   

10.0.0.1/32        *[IS-IS/18] 00:01:22, metric 20
                    > to 10.0.2.5 via em4.43
10.0.0.2/32        *[IS-IS/18] 00:00:58, metric 20
                    > to 10.0.2.5 via em4.43
10.0.0.3/32        *[IS-IS/18] 00:01:22, metric 10
                    > to 10.0.2.5 via em4.43
10.0.0.5/32        *[IS-IS/18] 00:01:46, metric 10
                    > to 10.0.2.9 via em4.45
10.0.0.6/32        *[IS-IS/18] 00:01:44, metric 20
                    > to 10.0.2.9 via em4.45
10.0.0.7/32        *[IS-IS/18] 00:00:56, metric 20
                    > to 10.0.2.9 via em4.45
10.0.4.0/30        *[IS-IS/18] 00:01:22, metric 20
                    > to 10.0.2.5 via em4.43
10.0.4.4/30        *[IS-IS/18] 00:01:22, metric 30
                    > to 10.0.2.5 via em4.43
10.0.4.12/30       *[IS-IS/18] 00:01:22, metric 20
                    > to 10.0.2.5 via em4.43
10.0.8.0/30        *[IS-IS/18] 00:01:44, metric 30
                    > to 10.0.2.9 via em4.45
10.0.8.4/30        *[IS-IS/18] 00:01:46, metric 20
                    > to 10.0.2.9 via em4.45
10.0.8.8/30        *[IS-IS/18] 00:01:46, metric 20
                    > to 10.0.2.9 via em4.45
iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
----
logical-system: r3
inet.0: 20 destinations, 20 routes (20 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both   

10.0.0.1/32        *[IS-IS/15] 00:01:23, metric 10
                    > to 10.0.4.14 via em3.31
10.0.0.2/32        *[IS-IS/15] 00:00:58, metric 10
                    > to 10.0.4.2 via em3.32
10.0.0.4/32        *[IS-IS/18] 00:01:22, metric 10
                    > to 10.0.2.6 via em3.34
10.0.0.5/32        *[IS-IS/18] 00:01:08, metric 20
                    > to 10.0.2.6 via em3.34
10.0.0.6/32        *[IS-IS/18] 00:01:08, metric 30
                    > to 10.0.2.6 via em3.34
10.0.0.7/32        *[IS-IS/18] 00:00:56, metric 30
                    > to 10.0.2.6 via em3.34
10.0.2.8/30        *[IS-IS/18] 00:01:22, metric 20
                    > to 10.0.2.6 via em3.34
10.0.4.4/30        *[IS-IS/15] 00:00:58, metric 20
                    > to 10.0.4.14 via em3.31
                      to 10.0.4.2 via em3.32
10.0.8.0/30        *[IS-IS/18] 00:01:08, metric 40
                    > to 10.0.2.6 via em3.34
10.0.8.4/30        *[IS-IS/18] 00:01:08, metric 30
                    > to 10.0.2.6 via em3.34
10.0.8.8/30        *[IS-IS/18] 00:01:08, metric 30
                    > to 10.0.2.6 via em3.34
iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
-----
logical-system: r7
inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both   

10.0.0.5/32        *[IS-IS/15] 00:00:56, metric 10
                    > to 10.0.8.9 via em7.75
10.0.0.6/32        *[IS-IS/15] 00:01:19, metric 10
                    > to 10.0.8.1 via em7.76
10.0.8.4/30        *[IS-IS/15] 00:00:56, metric 20
                    > to 10.0.8.9 via em7.75
                      to 10.0.8.1 via em7.76
iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
-----
logical-system: r6
inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both   

10.0.0.5/32        *[IS-IS/15] 00:01:45, metric 10
                    > to 10.0.8.6 via em6.65
10.0.0.7/32        *[IS-IS/15] 00:01:19, metric 10
                    > to 10.0.8.2 via em6.67
10.0.8.8/30        *[IS-IS/15] 00:01:19, metric 20
                      to 10.0.8.6 via em6.65
                    > to 10.0.8.2 via em6.67   

iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden) 默认

由于juniper路由器默认不会从level2向level1通告学习到的路由，所以在这里我们可以向level1路由器r1,r2,r6,r7注入一条默认路由

r3中的配置：set rouing-options static route 0/0 discard                edit  policy-options policy-statement export-default

set temr 1 from router-filter 0/0 exact

set term 1 then accept

edit protocol isis export export-default//将策略注入到isis中

r5的配置同上，此时我们可以看到r1,r2,r6,r7就会存在一条默认路由了

本文出自 “Rista” 博客，请务必保留此出处http://rista.blog.51cto.com/2526140/961204

以上是小编为您精心准备的的内容，在的博客、问答、公众号、人物、课程等栏目也有的相关内容，欢迎继续使用右上角搜索按钮进行搜索interface
， 10
， em
， 10 1 arcpy
， address
， is
， V7.75
， v4.45
is()
juniper防火墙配置、juniper防火墙nat配置、juniper防火墙web配置、juniper防火墙vpn配置、juniper防火墙ha配置，以便于您获取更多的相关知识。

时间： 2024-11-03 20:01:16

Juniper防火墙IS-IS单区域配置实例的相关文章

Juniper防火墙L2TP over IPSEC配置图解

在前面我发了一篇文章<juniper防火墙之图解l2tp vpn配置>,我们从那篇文章中了解了如何配置.但是我们知道,L2TP VPN只是与我们的L2TP VPN服务器连接起来了,但并没有对我们的数据进行加密,我们也知道IPSEC它的数据是经过加密了的,如果对IPSEC不清楚的朋友可以看看我以前发的<ipsec vpn概念(一) >与<ipsec vpn概念(二) >进行了解.好了那我们的IPSEC是需要经过加密,而我们的L2TP提供我们与服务器的连接,那么我们如何不把

Cisco防火墙pix515配置实例

一.引言 硬件防火墙的应用,现在是越来越多,产品也很丰富.一般国产的防火墙多带有中文的说明和一些相应的配置实例,但国外的产品几乎都没有中文的说明书. 二.物理连接 Pix515的外观:是一种标准的机架式设备,高度为2U,电源开关和接线在背后.正面有一些指示灯,如电源.工作是否正常的表示等:背面板 有一些接口和扩展口,我们这次要用到的接口有三个:两个以太(RJ-45网卡)和一个配置口,其英文分别是:ETHERNET0.ETHERNET1和CONSOLE. 先将防火墙固定在机架上,接好电源:用随机带

juniper防火墙l2tp vpn配置图解教程

L2TP隧道(L2TP Tunnel)是指在第二层隧道协议(L2TP)端点之间的逻辑链接:LAC(L2TP接入聚合器)和LNS(L2TP网络服务器).当LNS是服务器时,LAC是隧道的发起人,它等待新的隧道.一旦一个隧道被确立,在这个点之间的新通信将是双向的.为了对网络有用,高层协议例如点对点协议(PPP)然后通过L2TP隧道. 今天刚好在学Juniper防火墙的时候,刚好学到L2TP VPN的配置,那么今天我们来看看使用Juniper防火墙来做L2TP VPN. 第一步:点击:Objects>

juniper防火墙上做vrrp配置实例

在一台运行freebsd的和junos的PC上实验,拓扑如上图: Virtual IP (VIP) addresses = 10.0.5.253 and 10.0.6.253 r1 is master of VLAN 520 AND R2 IS BACK r2 is master of VLAN 530 AND R1 IS BACK MD5 authentication is enabled. For VLAN 520, the key is "vrrp520" .for VLAN 5

Juniper防火墙配置备份的方法

为防止Juniper防火墙设备故障情况下造成网络中断,保障用户业务不间断运行,现针对Juniper防火墙故障情况下的快速恢复做具体描述. Juniper防火墙配置备份之一.设备重启动:Juniper防火墙在工作期间出现运行异常时,如需进行系统复位,可通过console线缆使用reset命令对防火墙进行重启,重启动期间可以在操作终端上查看防火墙相关启动信息. Juniper防火墙配置备份之二.操作系统备份:日常维护期间可将防火墙操作系统ScreenOS备份到本地设备,操作方式为:启动tftp 服务

Juniper防火墙的一些概念

安全区(Security Zone):Juniper 防火墙增加了全新的安全区域(Security Zone)的概念,安全区域是一个逻辑的结构,是多个处于相同属性区域的物理接口的集合.当不同安全区域之间相互通讯时,必须通过事先定义的策略检查才能通过:当在同一个安全区域进行通讯时,默认状态下允许不通过策略检查,经过配置后也可以强制进行策略检查以提高安全性. 安全区域概念的出现,使防火墙的配置能更灵活同现有的网络结构相结合.以下图为例,通过实施安全区域的配置,内网的不同部门之间的通讯也必须通过策略的

juniper防火墙利用policy-options(策略)来重分布static到ospf中

Juniper中要实现像cisco那样的重分布功能就要通过policy来实现,下面就是我的一个实例:其功能就是把static路由重分布到ospf中,下面是拓扑图 把R1的默认路由重分布到OSPF中 配置如下: ## ## Last changed: 2012-07-18 06:03:09 CST version 12.1R1.9; logical-systems { r1 { interfaces { em1 { unit 12 { vlan-id 12; family inet { addre

juniper防火墙如何恢复出厂默认设置

呵呵!总算到公司上班了.我以前都是学的cisco的路由交换,但是我们公司要求要会使用juniper的防火墙,没有办法我又只好自学了!不过还好的是公司提供了两台juniper的防火墙.那么我们今天就来看看我们Juniper防火墙我们密码忘了如何解决? 用过Juniper产品的人都应该知道一点,Juniper产品密码忘了的话是一件很痛苦的事,为什么这么说呢?下来就来听我给大家讲讲嘛! 密码丢失是无法恢复的,那么我们就只有通过恢复出厂默认设置的方法来重新获得管理权限 (原来配置的参数.证书等都将被删除

H3C交换机的配置实例

本实例包括设置安全策略版,通过源IP地址对WEB登录用户进行控制. 托管在IDC机房的网络设备,用于组建服务器集群,构建电子商务系统架构. 网络硬件设备少不了的一种就是交换机.目前用于运行级别的都是网管型交换机.至于牌子方面,主流目前流行的为思科.华为.H3C这几款.相对价格而言,H3C的中型设备性价比普遍高. IDC机房二层交换机常见的有: 思科2960 系列. 思科2950 系列. H3C 3100系列. 常规IDC服务器托管的接入拓扑图: 网络服务商->IDC托管服务商路由设备.三层交换机