VRRP on two SSG5 devices



  • Hey everybody!

    I’m running into an issue here with VRRP.

    I have two SSG5 devices and I want to set it up so that if one device fails, the other takes over.  The problem is, I searched online for a guide with how to do this, but nothing really gives me a solid answer.

    The things I need to know are-  Which cables should I physically connect to which ethernet ports?  I have ethernet0/0 as the untrust, and ports 0/2-0/5 need to be connected to redundant Network Interface Cards on our servers, so that leaves ports 0/1 and 0/6 available.

    As far as the configuration, I am able to do:

    set interface ethernet0/0 protocol vrrp
    set interface ethernet0/0 protocol vrrp enable

    …but it throws up the unknown command error in the cli when I try to

    set interface ethernet0/1:6 protocol vrrp preempt
    set interface ethernet0/1:6 protocol vrrp priority 50

    Is there a guide out there somewhere for total newbies, or perhaps some sort of example configuration so that I can work my limited knowledge off of?

    You guys have no idea how much pointing me in the right direction would mean to me.

    Either way, thank you for taking the time to read this.

    -David



  • Whoops, just realized I mean to type:

    set interface ethernet0/0 protocol vrrp preempt
    set interface ethernet0/0 protocol vrrp priority 50

    above.

    Anyway, here is the current setup:

    And here is the current configuration (edited for security reasons):

    unset key protection enable
    set clock ntp
    set clock timezone -8
    set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00
    set vrouter trust-vr sharable
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    unset auto-route-export
    exit
    set alg appleichat enable
    unset alg appleichat re-assembly enable
    set alg sctp enable
    set auth-server “Local” id 0
    set auth-server “Local” server-name "Local"
    set auth default auth server "Local"
    set auth radius accounting port 1646
    set admin name "username"
    set admin password "password"
    set admin http redirect
    set admin auth web timeout 10
    set admin auth dial-in timeout 3
    set admin auth server "Local"
    set admin format dos
    set zone “Trust” vrouter "trust-vr"
    set zone “Untrust” vrouter "trust-vr"
    set zone “DMZ” vrouter "trust-vr"
    set zone “VLAN” vrouter "trust-vr"
    set zone id 100 "VPN1"
    set zone id 101 "VPN2"
    set zone “Untrust-Tun” vrouter "trust-vr"
    set zone “Trust” tcp-rst
    set zone “Untrust” block
    unset zone “Untrust” tcp-rst
    set zone “MGT” block
    unset zone “V1-Trust” tcp-rst
    unset zone “V1-Untrust” tcp-rst
    set zone “DMZ” tcp-rst
    unset zone “V1-DMZ” tcp-rst
    unset zone “VLAN” tcp-rst
    unset zone “VPN1” tcp-rst
    unset zone “VPN2” tcp-rst
    set zone “Untrust” screen tear-drop
    set zone “Untrust” screen syn-flood
    set zone “Untrust” screen ping-death
    set zone “Untrust” screen ip-filter-src
    set zone “Untrust” screen land
    set zone “V1-Untrust” screen tear-drop
    set zone “V1-Untrust” screen syn-flood
    set zone “V1-Untrust” screen ping-death
    set zone “V1-Untrust” screen ip-filter-src
    set zone “V1-Untrust” screen land
    set interface ethernet0/2 phy full 100mb
    set interface ethernet0/3 phy full 100mb
    set interface ethernet0/4 phy full 100mb
    set interface ethernet0/5 phy full 100mb
    set interface ethernet0/6 phy full 100mb
    set interface “ethernet0/0” zone "Untrust"
    set interface “ethernet0/1” zone "Null"
    set interface “bgroup0” zone "Trust"
    set interface “tunnel.1” zone "VPN1"
    set interface “tunnel.2” zone "VPN2"
    set interface bgroup0 port ethernet0/2
    set interface bgroup0 port ethernet0/3
    set interface bgroup0 port ethernet0/4
    set interface bgroup0 port ethernet0/5
    set interface bgroup0 port ethernet0/6
    unset interface vlan1 ip
    set interface ethernet0/0 ip 10.10.10.1/24
    set interface ethernet0/0 route
    set interface bgroup0 ip 192.168.1.1/24
    set interface bgroup0 route
    set interface tunnel.1 ip unnumbered interface ethernet0/0
    set interface tunnel.2 ip unnumbered interface ethernet0/0
    unset interface vlan1 bypass-others-ipsec
    unset interface vlan1 bypass-non-ip
    set interface ethernet0/0 ip manageable
    set interface bgroup0 ip manageable
    set interface ethernet0/0 manage ssl
    set interface ethernet0/0 manage web
    set interface bgroup0 dhcp server service
    set interface bgroup0 dhcp server auto
    set interface bgroup0 dhcp server option gateway 192.168.1.1
    set interface bgroup0 dhcp server option netmask 255.255.255.0
    set interface bgroup0 dhcp server option dns1 10.10.10.89
    set interface bgroup0 dhcp server option dns2 10.10.10.90
    set interface bgroup0 dhcp server ip 192.168.1.100 to 192.168.1.200
    unset interface bgroup0 dhcp server config next-server-ip
    unset interface bgroup0 dhcp server config updatable
    set interface “serial0/0” modem settings “USR” init "AT&F"
    set interface “serial0/0” modem settings “USR” active
    set interface “serial0/0” modem speed 115200
    set interface “serial0/0” modem retry 3
    set interface “serial0/0” modem interval 10
    set interface “serial0/0” modem idle-time 10
    set interface “ethernet0/0” webauth
    set flow tcp-mss
    unset flow no-tcp-seq-check
    unset flow tcp-syn-check
    unset flow tcp-syn-bit-check
    set flow reverse-route clear-text prefer
    set flow reverse-route tunnel always
    set hostname topaz
    set pki authority default scep mode "auto"
    set pki x509 default cert-path partial
    set dns host dns1 0.0.0.0
    set dns host dns2 0.0.0.0
    set dns host dns3 0.0.0.0
    set address “Trust” “192.168.1.1” 192.168.1.1 255.255.255.0
    set address “VPN1” “192.168.2.0/24” 192.168.2.0 255.255.255.0
    set address “VPN2” “192.168.3.0/24” 192.168.3.0 255.255.255.0
    set crypto-policy
    exit
    set ike gateway “VPN1” address VPN1.website.com Main outgoing-interface “ethernet0/0” preshare “presharedkey” proposal "pre-g2-aes128-sha"
    set ike gateway “VPN2” address 0.0.0.0 id “other VPN” Aggr outgoing-interface “ethernet0/0” preshare “presharedkey” proposal "pre-g2-aes128-sha"
    unset ike gateway “VPN2” nat-traversal
    set ike respond-bad-spi 1
    set ike ikev2 ike-sa-soft-lifetime 60
    unset ike ikeid-enumeration
    unset ike dos-protection
    unset ipsec access-session enable
    set ipsec access-session maximum 5000
    set ipsec access-session upper-threshold 0
    set ipsec access-session lower-threshold 0
    set ipsec access-session dead-p2-sa-timeout 0
    unset ipsec access-session log-error
    unset ipsec access-session info-exch-connected
    unset ipsec access-session use-error-log
    set vpn “VPN1” gateway “VPN1” replay tunnel idletime 0 proposal "nopfs-esp-aes128-md5"
    set vpn “VPN1” monitor optimized rekey
    set vpn “VPN1” id 0x1 bind interface tunnel.1
    set vpn “VPN2” gateway “VPN2” replay tunnel idletime 0 proposal "nopfs-esp-aes128-md5"
    set vpn “VPN2” monitor optimized rekey
    set vpn “VPN2” id 0x2 bind interface tunnel.2
    unset interface tunnel.1 acvpn-dynamic-routing
    unset interface tunnel.2 acvpn-dynamic-routing
    set url protocol websense
    exit
    set vpn “VPN1” proxy-id local-addr “Trust” “192.168.1.1/24” remote-addr “VPN1” “192.168.2.0/24” "ANY"
    set vpn “VPN2” proxy-id check
    set vpn “VPN2” proxy-id local-addr “Trust” “192.168.1.1/24” remote-addr “VPN2” “192.168.3.0/24” "ANY"
    set policy id 1 from “Trust” to “Untrust”  “Any” “Any” “ANY” nat src permit log
    set policy id 1
    set log session-init
    exit
    set policy id 2 from “VPN1” to “Trust”  “192.168.2.0/24” “192.168.1.1/24” “ANY” permit log
    set policy id 2
    exit
    set policy id 3 from “VPN2” to “Trust”  “192.168.3.0/24” “192.168.1.1/24” “ANY” permit
    set policy id 3
    exit
    set nsmgmt bulkcli reboot-timeout 60
    set ssh version v2
    set config lock timeout 5
    unset license-key auto-update
    set telnet client enable
    set ntp server "198.123.30.132"
    set snmp port listen 161
    set snmp port trap 162
    set snmpv3 local-engine id "0162102008002403"
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    unset add-default-route
    set route 0.0.0.0/0 interface ethernet0/0 gateway 10.10.10.1
    set route 192.168.2.0/24 interface tunnel.1 preference 20
    set route 192.168.3.0/24 interface tunnel.2 preference 20
    exit
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    exit


 

33
Online

38.4k
Users

12.7k
Topics

44.5k
Posts