第一台Netscreen防火墙
set hostname fw-1定义主机名
set interface "ethernet1" zone "Trust"
set interface "ethernet2" zone "DMZ"
set interface "ethernet3" zone "Untrust"
set interface "ethernet4" zone "HA"Eth4口用于HA互连,用于同步配置文件、会话信息和跟踪设备状态信息
unset interface vlan1 ip
set interface ethernet1 ip 192.168.1.254/24端口配置IP
set interface ethernet1 route配置接口路由模式
set interface ethernet3 ip 192.168.2.254/24端口配置IP
set interface ethernet3 route配置接口路由模式
set interface ethernet1 ip manageable设置能够IP管理
set interface ethernet3 ip manageable设置能够IP管理
set nsrp cluster>
set nsrp vsd-group>
set nsrp monitor interface ethernet1配置NSRP监控端口,非抢占模式
set nsrp monitor interface ethernet3配置NSRP监控端口,非抢占模式
exit
set policy>
set policy>
第二台Netscreen防火墙
set hostname fw-2定义主机名
set interface "ethernet1" zone "Trust"
set interface "ethernet2" zone "DMZ"
set interface "ethernet3" zone "Untrust"
set interface "ethernet4" zone "HA"Eth4口用于HA互连,用于同步配置文件、会话信息和跟踪设备状态信息
unset interface vlan1 ip
set interface ethernet1 ip 192.168.1.254/24端口配置IP
set interface ethernet1 route配置接口路由模式
set interface ethernet3 ip 192.168.2.254/24端口配置IP
set interface ethernet3 route配置接口路由模式
set interface ethernet1 ip manageable设置能够IP管理
set interface ethernet3 ip manageable设置能够IP管理
set nsrp cluster>
set nsrp vsd-group>
set nsrp monitor interface ethernet1配置NSRP监控端口,非抢占模式
set nsrp monitor interface ethernet3配置NSRP监控端口,非抢占模式
set policy>
set policy>
测试
将fw-1的eth3线路拔掉时
fw-1(I)->get nsrp
nsrp version: 2.0
cluster info:
cluster>
local unit>
active units discovered:
index: 0, unit>
total number of units: 2
VSD group info:
init hold time: 5
heartbeat lost threshold: 3
heartbeat interval: 1000(ms)
master always exist: disabled
group priority preempt holddown inelig master PB other members
0 50 no 3 no 4220080 none myself(inoperable)
total number of vsd groups: 1
Total iteration=3164,time=41762278,max=71948,min=5015,average=13199
RTO mirror info:
run time object sync:disabled
ping session sync: enabled
coldstart sync done
nsrp link info:
control channel: ethernet4 (ifnum: 7) mac: 0019e24067d7 state: up
ha data link not available
ha secondary path link not available
NSRP encryption: disabled
NSRP authentication: disabled
device based nsrp monitoring threshold: 255, weighted sum: 255, failed
device based nsrp monitor interface: ethernet1(weight 255, UP) ethernet3(weight 255, DOWN)
device based nsrp monitor zone:
device based nsrp track ip: (weight: 255, disabled)
number of gratuitous arps: 4 (default)
config sync: enabled