Network Configuration Example

Transcription

1 Network Configuration Example Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Release 11.2 Published:

2 Juniper Networks, Inc North Mathilda Avenue Sunnyvale, California USA This product includes the Envoy SNMP Engine, developed by Epilogue Technology, an Integrated Systems Company. Copyright , Epilogue Technology Corporation. All rights reserved. This program and its documentation were developed at private expense, and no part of them is in the public domain. This product includes memory allocation software developed by Mark Moraes, copyright 1988, 1989, 1993, University of Toronto. This product includes FreeBSD software developed by the University of California, Berkeley, and its contributors. All of the documentation and software included in the 4.4BSD and 4.4BSD-Lite Releases is copyrighted by the Regents of the University of California. Copyright 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, The Regents of the University of California. All rights reserved. GateD software copyright 1995, the Regents of the University. All rights reserved. Gate Daemon was originated and developed through release 3.0 by Cornell University and its collaborators. Gated is based on Kirton s EGP, UC Berkeley s routing daemon (routed), and DCN s HELLO routing protocol. Development of Gated has been supported in part by the National Science Foundation. Portions of the GateD software copyright 1988, Regents of the University of California. All rights reserved. Portions of the GateD software copyright 1991, D. L. S. Associates. This product includes software developed by Maker Communications, Inc., copyright 1996, 1997, Maker Communications, Inc. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785. Network Configuration Example Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Release 11.2 All rights reserved. Revision History April 2011 R1 Junos OS 11.2 The information in this document is current as of the date listed in the revision history. YEAR 2000 NOTICE Juniper Networks hardware and software products are Year 2000 compliant. The Junos OS has no known time-related limitations through the year However, the NTP application is known to have some difficulty in the year ii

3 END USER LICENSE AGREEMENT READ THIS END USER LICENSE AGREEMENT ( AGREEMENT ) BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE. BY DOWNLOADING, INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS CONTAINED HEREIN, YOU (AS CUSTOMER OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO BIND THE CUSTOMER) CONSENT TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED HEREIN, THEN (A) DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE, AND (B) YOU MAY CONTACT JUNIPER NETWORKS REGARDING LICENSE TERMS. 1. The Parties. The parties to this Agreement are (i) Juniper Networks, Inc. (if the Customer s principal office is located in the Americas) or Juniper Networks (Cayman) Limited (if the Customer s principal office is located outside the Americas) (such applicable entity being referred to herein as Juniper ), and (ii) the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable license(s) for use of the Software ( Customer ) (collectively, the Parties ). 2. The Software. In this Agreement, Software means the program modules and features of the Juniper or Juniper-supplied software, for which Customer has paid the applicable license or support fees to Juniper or an authorized Juniper reseller, or which was embedded by Juniper in equipment which Customer purchased from Juniper or an authorized Juniper reseller. Software also includes updates, upgrades and new releases of such software. Embedded Software means Software which Juniper has embedded in or loaded onto the Juniper equipment and any updates, upgrades, additions or replacements which are subsequently embedded in or loaded onto the equipment. 3. License Grant. Subject to payment of the applicable fees and the limitations and restrictions set forth herein, Juniper grants to Customer a non-exclusive and non-transferable license, without right to sublicense, to use the Software, in executable form only, subject to the following use restrictions: a. Customer shall use Embedded Software solely as embedded in, and for execution on, Juniper equipment originally purchased by Customer from Juniper or an authorized Juniper reseller. b. Customer shall use the Software on a single hardware chassis having a single processing unit, or as many chassis or processing units for which Customer has paid the applicable license fees; provided, however, with respect to the Steel-Belted Radius or Odyssey Access Client software only, Customer shall use such Software on a single computer containing a single physical random access memory space and containing any number of processors. Use of the Steel-Belted Radius or IMS AAA software on multiple computers or virtual machines (e.g., Solaris zones) requires multiple licenses, regardless of whether such computers or virtualizations are physically contained on a single chassis. c. Product purchase documents, paper or electronic user documentation, and/or the particular licenses purchased by Customer may specify limits to Customer s use of the Software. Such limits may restrict use to a maximum number of seats, registered endpoints, concurrent users, sessions, calls, connections, subscribers, clusters, nodes, realms, devices, links, ports or transactions, or require the purchase of separate licenses to use particular features, functionalities, services, applications, operations, or capabilities, or provide throughput, performance, configuration, bandwidth, interface, processing, temporal, or geographical limits. In addition, such limits may restrict the use of the Software to managing certain kinds of networks or require the Software to be used only in conjunction with other specific Software. Customer s use of the Software shall be subject to all such limitations and purchase of all applicable licenses. d. For any trial copy of the Software, Customer s right to use the Software expires 30 days after download, installation or use of the Software. Customer may operate the Software after the 30-day trial period only if Customer pays for a license to do so. Customer may not extend or create an additional trial period by re-installing the Software after the 30-day trial period. e. The Global Enterprise Edition of the Steel-Belted Radius software may be used by Customer only to manage access to Customer s enterprise network. Specifically, service provider customers are expressly prohibited from using the Global Enterprise Edition of the Steel-Belted Radius software to support any commercial network access services. The foregoing license is not transferable or assignable by Customer. No license is granted herein to any user who did not originally purchase the applicable license(s) for the Software from Juniper or an authorized Juniper reseller. 4. Use Prohibitions. Notwithstanding the foregoing, the license provided herein does not permit the Customer to, and Customer agrees not to and shall not: (a) modify, unbundle, reverse engineer, or create derivative works based on the Software; (b) make unauthorized copies of the Software (except as necessary for backup purposes); (c) rent, sell, transfer, or grant any rights in and to any copy of the Software, in any form, to any third party; (d) remove any proprietary notices, labels, or marks on or in any copy of the Software or any product in which the Software is embedded; (e) distribute any copy of the Software to any third party, including as may be embedded in Juniper equipment sold in the secondhand market; (f) use any locked or key-restricted feature, function, service, application, operation, or capability without first purchasing the applicable license(s) and obtaining a valid key from Juniper, even if such feature, function, service, application, operation, or capability is enabled without a key; (g) distribute any key for the Software provided by Juniper to any third party; (h) use the iii

4 Software in any manner that extends or is broader than the uses purchased by Customer from Juniper or an authorized Juniper reseller; (i) use Embedded Software on non-juniper equipment; (j) use Embedded Software (or make it available for use) on Juniper equipment that the Customer did not originally purchase from Juniper or an authorized Juniper reseller; (k) disclose the results of testing or benchmarking of the Software to any third party without the prior written consent of Juniper; or (l) use the Software in any manner other than as expressly provided herein. 5. Audit. Customer shall maintain accurate records as necessary to verify compliance with this Agreement. Upon request by Juniper, Customer shall furnish such records to Juniper and certify its compliance with this Agreement. 6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper. As such, Customer shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence, which at a minimum includes restricting access to the Software to Customer employees and contractors having a need to use the Software for Customer s internal business purposes. 7. Ownership. Juniper and Juniper s licensors, respectively, retain ownership of all right, title, and interest (including copyright) in and to the Software, associated documentation, and all copies of the Software. Nothing in this Agreement constitutes a transfer or conveyance of any right, title, or interest in the Software or associated documentation, or a sale of the Software, associated documentation, or copies of the Software. 8. Warranty, Limitation of Liability, Disclaimer of Warranty. The warranty applicable to the Software shall be as set forth in the warranty statement that accompanies the Software (the Warranty Statement ). Nothing in this Agreement shall give rise to any obligation to support the Software. Support services may be purchased separately. Any such support shall be governed by a separate, written support services agreement. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JUNIPER SHALL NOT BE LIABLE FOR ANY LOST PROFITS, LOSS OF DATA, OR COSTS OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, THE SOFTWARE, OR ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. IN NO EVENT SHALL JUNIPER BE LIABLE FOR DAMAGES ARISING FROM UNAUTHORIZED OR IMPROPER USE OF ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. EXCEPT AS EXPRESSLY PROVIDED IN THE WARRANTY STATEMENT TO THE EXTENT PERMITTED BY LAW, JUNIPER DISCLAIMS ANY AND ALL WARRANTIES IN AND TO THE SOFTWARE (WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE), INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT DOES JUNIPER WARRANT THAT THE SOFTWARE, OR ANY EQUIPMENT OR NETWORK RUNNING THE SOFTWARE, WILL OPERATE WITHOUT ERROR OR INTERRUPTION, OR WILL BE FREE OF VULNERABILITY TO INTRUSION OR ATTACK. In no event shall Juniper s or its suppliers or licensors liability to Customer, whether in contract, tort (including negligence), breach of warranty, or otherwise, exceed the price paid by Customer for the Software that gave rise to the claim, or if the Software is embedded in another Juniper product, the price paid by Customer for such other product. Customer acknowledges and agrees that Juniper has set its prices and entered into this Agreement in reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same reflect an allocation of risk between the Parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss), and that the same form an essential basis of the bargain between the Parties. 9. Termination. Any breach of this Agreement or failure by Customer to pay any applicable fees due shall result in automatic termination of the license granted herein. Upon such termination, Customer shall destroy or return to Juniper all copies of the Software and related documentation in Customer s possession or control. 10. Taxes. All license fees payable under this agreement are exclusive of tax. Customer shall be responsible for paying Taxes arising from the purchase of the license, or importation or use of the Software. If applicable, valid exemption documentation for each taxing jurisdiction shall be provided to Juniper prior to invoicing, and Customer shall promptly notify Juniper if their exemption is revoked or modified. All payments made by Customer shall be net of any applicable withholding tax. Customer will provide reasonable assistance to Juniper in connection with such withholding taxes by promptly: providing Juniper with valid tax receipts and other required documentation showing Customer s payment of any withholding taxes; completing appropriate applications that would reduce the amount of withholding tax to be paid; and notifying and assisting Juniper in any audit or tax proceeding related to transactions hereunder. Customer shall comply with all applicable tax laws and regulations, and Customer will promptly pay or reimburse Juniper for all costs and damages related to any liability incurred by Juniper as a result of Customer s non-compliance or delay with its responsibilities herein. Customer s obligations under this Section shall survive termination or expiration of this Agreement. 11. Export. Customer agrees to comply with all applicable export laws and restrictions and regulations of any United States and any applicable foreign agency or authority, and not to export or re-export the Software or any direct product thereof in violation of any such restrictions, laws or regulations, or without all necessary approvals. Customer shall be liable for any such violations. The version of the Software supplied to Customer may contain encryption or other capabilities restricting Customer s ability to export the Software without an export license. iv

5 12. Commercial Computer Software. The Software is commercial computer software and is provided with restricted rights. Use, duplication, or disclosure by the United States government is subject to restrictions set forth in this Agreement and as provided in DFARS through , FAR , FAR (b)(2), FAR , or FAR (ALT III) as applicable. 13. Interface Information. To the extent required by applicable law, and at Customer's written request, Juniper shall provide Customer with the interface information needed to achieve interoperability between the Software and another independently created program, on payment of applicable fee, if any. Customer shall observe strict obligations of confidentiality with respect to such information and shall use such information in compliance with any applicable terms and conditions upon which Juniper makes such information available. 14. Third Party Software. Any licensor of Juniper whose software is embedded in the Software and any supplier of Juniper whose products or technology are embedded in (or services are accessed by) the Software shall be a third party beneficiary with respect to this Agreement, and such licensor or vendor shall have the right to enforce this Agreement in its own name as if it were Juniper. In addition, certain third party software may be provided with the Software and is subject to the accompanying license(s), if any, of its respective owner(s). To the extent portions of the Software are distributed under and subject to open source licenses obligating Juniper to make the source code for such portions publicly available (such as the GNU General Public License ( GPL ) or the GNU Library General Public License ( LGPL )), Juniper will make such source code portions (including Juniper modifications, as appropriate) available upon request for a period of up to three years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194 N. Mathilda Ave., Sunnyvale, CA 94089, ATTN: General Counsel. You may obtain a copy of the GPL at and a copy of the LGPL at Miscellaneous. This Agreement shall be governed by the laws of the State of California without reference to its conflicts of laws principles. The provisions of the U.N. Convention for the International Sale of Goods shall not apply to this Agreement. For any disputes arising under this Agreement, the Parties hereby consent to the personal and exclusive jurisdiction of, and venue in, the state and federal courts within Santa Clara County, California. This Agreement constitutes the entire and sole agreement between Juniper and the Customer with respect to the Software, and supersedes all prior and contemporaneous agreements relating to the Software, whether oral or written (including any inconsistent terms contained in a purchase order), except that the terms of a separate written agreement executed by an authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict with terms contained herein. No modification to this Agreement nor any waiver of any rights hereunder shall be effective unless expressly assented to in writing by the party to be charged. If any portion of this Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity of the remainder of this Agreement. This Agreement and associated documentation has been written in the English language, and the Parties agree that the English version will govern. (For Canada: Les parties aux présentés confirment leur volonté que cette convention de même que tous les documents y compris tout avis qui s'y rattaché, soient redigés en langue anglaise. (Translation: The parties confirm that this Agreement and all related documentation is and will be in the English language)). v

6 vi

7 Table of Contents Introduction Requirements of a Two-Tiered Virtualized Data Center for Large Enterprise Networks Network Traffic Segmentation Flexibility Security Access and Availability Cost-Effective Incremental Scaling Orchestration and Automation Two-Tiered Virtualized Data Center Solution for Large Enterprise Networks Network Traffic Segmentation Flexibility Security Access and Availability Cost-Effective Incremental Scaling Orchestration and Automation Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks vii

8 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks viii

9 Introduction This network configuration example provides a step-by-step procedure to configure a two-tiered virtualized data center using Juniper Networks MX Series 3D Universal Edge Routers, EX Series Ethernet Switches, and SRX Series Services Gateways. 1

10 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks 2

11 Requirements of a Two-Tiered Virtualized Data Center for Large Enterprise Networks Large enterprises have certain specific needs for the hosting environment that the design of their data center must meet. This section describes the requirements of a company that operates as a service provider to its individual business units (BUs). One of the primary requirements of a virtualized data center (VDC) for a large enterprise is the ability to segment the network by business unit. This includes traffic segmentation and administrative control segmentation. Other requirements include security controls between business units, security controls between the company and the outside world, flexibility to grow and adapt the network, and a robust and cost-effective way to manage the entire network. Network Traffic Segmentation The requirement described here is for network resources to be isolated in several ways. Traffic must be segmented by business units. Traffic flows between network segments must be prohibited except where specifically allowed. Traffic isolation must be controlled at designated policy enforcement points. Network resources must be dedicated to a segment, but the network must have the flexibility to change the allocation of resources. Segmented resources must be logically grouped according to policies. For example, test traffic must be isolated from production traffic. Traffic must also be isolated according to business entities, contractual requirements, legal or regulatory requirements, risk rating, and corporate standards. The network segmentation design must not be disruptive to the business, must be integrated with the larger data center and cloud network design, must allow business units to access network resources globally, and must support new business capabilities. Flexibility The network design must be flexible enough to react to business and environment changes with minimal design and re-engineering efforts. The VDC design must be flexible in terms of isolating business unit workloads from other business units and general data center services and applications. The network solution must ensure that the business is minimally impacted when network and segmentation changes take place. The VDC must be flexible enough to be implemented: Within a single data center Within a data hall Across two or more data centers Across two or more data halls within or between data centers Between a data center and an external cloud service provider 3

12 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Security The network design must allow business units to be isolated within the hosting environment. In the event of a network security incident, business units must be isolated from the hosting environment and other business units. Traffic flow between business unit segments must be denied by default and must be explicitly permitted only at policy enforcement points owned and controlled by the data center service provider. The policy enforcement point must include access control capabilities and might include threat protection capabilities. Access and Availability The VDC must provide access to common data center services such as computation, storage, security, traffic management, operations, and applications. The network must operate across multiple global service providers and must deliver optimal, predictable, and consistent performance across the network. The VDC must be implemented across data center business units. The network solution must meet business unit availability requirements as defined in service-level agreements. Cost-Effective Incremental Scaling The VDC design must be cost effective for the business to run and must enable new business capabilities. It must be possible to implement the network solution in an incremental manner with minimal impact to the business. Orchestration and Automation The VDC design must include a management system that supports automation for provisioning, availability and workload monitoring, and reporting. Workload and availability reports must be available by business unit. Related Documentation Two-Tiered Virtualized Data Center Solution for Large Enterprise Networks on page 5 Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks on page 7 4

13 Two-Tiered Virtualized Data Center Solution for Large Enterprise Networks The following describes a Juniper Networks two-tiered, high-speed, multiservice virtualized data center (VDC). A two-tiered architecture meets the low latency requirements of a virtualized server environment and supports the overlying security mandate to maintain controlled segmentation between various business units. Network Traffic Segmentation Juniper Networks VDC design uses virtualization technologies such as virtual LANs (VLANs), virtual routers, virtual route forwarders, inter-virtual route forwarding, and logical systems to provide flexible traffic isolation. A fully redundant two-tiered data center design consists of Juniper Networks EX Series Ethernet Switches at the access layer for server connectivity, MX Series 3D Universal Edge Routers as a collapsed LAN aggregation/core layer, and clustered SRX Series Services Gateways to provide firewall security services across the data center trust boundaries. Flexibility The Juniper Networks VDC design uses 802.1Q VLANs, MPLS, BGP, Virtual Router Redundancy Protocol (VRRP), Traffic Engineering, and Fast Reroute to provide design flexibility while maintaining a standards-based approach. The design can also support a virtual private LAN service (VPLS). Security The Juniper Networks VDC design uses security zones to implement the policy enforcement points. The SRX cluster is responsible for all stateful packet inspection for traffic that crosses business unit trust boundaries as well as all ingress and egress traffic for the data center. The Juniper Networks Junos operating system is configured with different administrator accounts for each logical system that supports confined access to network resources and can be customized for individual business units. Access and Availability In the Juniper Networks VDC design, described in Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks on page 7, top-of-rack (TOR) EX Series switches provide access to the servers and provide redundancy. All uplinks from the TOR switches are 802.1Q trunk links that are terminated directly into each of the MX Series devices that make up the Point of Delivery (POD) at the aggregation/core layer. A VRRP instance is defined on each VLAN within the MX Series device to act as the default router for all server hosts in a given VLAN. To allow for VRRP to work properly, each bridge domain is extended between each MX Series device through an interconnection link. The MX Series device uses an integrated routing and bridging (IRB) interface as the Layer 3 interface for each bridge domain, with VRRP configured for redundancy. 5

14 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks A pair of 802.3ad aggregated Ethernet bundles are used between the MX Series devices. Each MX Series device is divided into a number of Logical Systems. Logical systems in the MX Series device are used to define logical trust boundaries within the data center itself and between respective business units. A clustered pair of SRX Series devices acting as firewalls provide security services across the data center trust boundaries. Virtual routers on the SRX Series devices act as customer edge (CE) routers for each business unit. A single redundancy group for the data plane is defined on the SRX Series Services Gateways with two redundant Ethernet interfaces as member interfaces. This redundancy group handles the data plane failover of the SRX Series firewall and is configured such that any loss of either northbound or southbound SRX Series interfaces forces a full failover to the secondary node. This failover is essentially a Layer 1 failover, which means that it occurs quickly and does not disrupt the routing topology above it. Cost-Effective Incremental Scaling The Juniper Networks VDC design supports incremental scaling of the network. This allows the VDC to be created with minimum cost to meet the current need. The access layer can be expanded by adding EX Series switches at the top of rack. The aggregation/core layer can be expanded by adding additional MX Series devices within a given POD. The security services can be expanded by adding 4-port 10-Gigabit Ethernet I/O cards (IOCs) and services processing cards (SPCs) in the SRX Series devices. The addition of IOCs increases the 10-Gigabit Ethernet port density. The addition of each SPC card to the chassis adds another 10 Gbps (5 Gbps Internet mix (IMIX)), 2 million sessions, and 100,000 connections per second (CPS) up to a maximum rated capacity for the platform of 150 Gbps (47.5 Gbps IMIX), 10 million sessions, and 350,000 CPS (as measured in Junos OS Release 10.2). Orchestration and Automation The Juniper Networks VDC design uses the Juniper Networks Junos Space management platform. Junos Space includes a portfolio of applications for scaling services, simplifying network operations, and automating support for complex network environments. In addition, the network devices are configured to support background Secure Copy Protocol (SCP) file transfers, commit scripts, and a file archive site. Related Documentation Requirements of a Two-Tiered Virtualized Data Center for Large Enterprise Networks on page 3 Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks on page 7 6

15 Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks This example provides a step-by-step procedure for configuring a two-tiered virtualized data center for large enterprise networks. Requirements on page 7 Configuring a Two-Tiered Virtualized Data Center Overview on page 7 Configuring the Access Layer on page 10 Configuring the Aggregation Layer in the Trusted Logical Systems on page 14 Configuring the Core Layer in the Untrusted Logical Systems on page 22 Configuring the Security Device on page 27 Requirements This example uses the following hardware and software components: Two MX Series 3D Universal Edge Routers running Junos OS Release 10.2 or later Six EX Series Ethernet Switches running Junos OS Release 10.2 or later Two SRX Series Services Gateways running Junos OS Release 10.4 or later Configuring a Two-Tiered Virtualized Data Center Overview This example provides a step-by-step procedure for configuring a two-tiered virtualized data center for large enterprises. The steps in the example follow the data path from an interface connected to a server in BU2 using VLAN 17, to Logical System Trust1, through Virtual Router MX-VR2, through Virtual Router SRX-VR2, through VRF2 in the Logical System Untrust, and out to the core network. The core network in this example simultaneously supports IP-based routing and MPLS-based label switching. The virtual routers on the SRX Series device perform the functions of customer edge (CE) routers. The VPN routing and forwarding (VRF) routing instances on the MX Series devices perform the functions of service provider edge (PE) routers. The OSPF protocol serves as the interior gateway protocol to carry routes to the PE router loopback addresses that are used as the BGP next-hop address for the IP-based and MPLS-based networks supported by this example. NOTE: The steps in this example are representative of the entire network configuration. The example does not show every step for every virtual device. The physical connections used in this example are shown in Figure 1 on page 8. 7

16 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Figure 1: Virtualized Data Center Physical Topology Core xe-1/3/0 xe-2/3/0 xe-2/3/0 xe-1/3/0 reth2 xe-2/2/0 xe-0/3/0 xe-1/2/0 xe-2/2/0 reth2 xe-2/0/0 xe-15/0/0 SRX 0 MX 0 MX 1 SRX 1 xe-1/0/0 xe-14/0/0 reth1 reth1 xe-1/1/0 xe-0/1/0 xe-2/1/0 xe-1/1/0 xe-1/0/0 xe-1/0/0 xe-0/0/0 xe-2/0/0 xe-2/0/1 xe-15/0/1 fab0 fab1 xe-1/0/1 xe-14/0/1 xe-0/1/2 xe-0/1/0 xe-0/1/1 xe-0/1/0 EX EX EX EX EX EX Rack 1 Rack 2 Rack 3 g The logical connections used in this example are shown in Figure 2 on page 9. 8

17 Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Figure 2: Virtualized Data Center Logical Topology OSPF/eBGP VRRP ibgp Core Untrusted Security Zones SRX 0 Untrust 1 Untrust 2 Untrust 3 Untrust n MX 0 LS Untrust LS Untrust MX 1 SRX 1 (passive) Untrusted Security Zones Untrust 1 Untrust 2 Untrust 3 Untrust n VRF 1 VRF 2 VRF 3 VRF n VRF 1 VRF 2 VRF 3 VRF n SRX VR 1 SRX VR 2 SRX VR 3 SRX VR n LS Trust 1 LS LS Trust 2 Trust n LS Trust 1 LS LS Trust 2 Trust n SRX VR 1 SRX VR 2 SRX VR 3 SRX VR n Trust 1 Trust 2 Trust 3 Trust n Trusted Security Zones MX VR 2 MX VR 3 MX VR n MX VR 2 MX VR 3 MX VR n Trust 1 Trust 2 Trust 3 Trust n Trusted Security Zones VLANs 11, 12, 13 BU1 VLANs 16, 17, 18, 1002 BU2 VLANs 21, 22, 23, 1003 BU3 VLANs 26, 27, 28, 1004 BU4 Server Rack 1 VLANs 11, 12, 13 BU1 VLANs 16, 17, 18, 1002 BU2 VLANs 21, 22, 23, 1003 BU3 VLANs 26, 27, 28, 1004 BU4 Server Rack 2 VLANs 11, 12, 13 BU1 VLANs 16, 17, 18, 1002 BU2 VLANs 21, 22, 23, 1003 BU3 VLANs 26, 27, 28, 1004 BU4 Server Rack n g In the logical topology illustration: Users access the data center across the enterprise core network shown at the top. Virtual routers configured in Logical System Untrust on the MX Series devices forward the traffic to separate virtual routers configured in the Untrusted security zone on the SRX Series devices. These virtual routers act as edge routers for the various business units. Virtual routers configured on the active SRX Series device forward the traffic to the Trusted security zones. Virtual routers configured in separate logical systems on the MX Series devices forward the traffic to a bridge domain of VLANs configured on the EX Series devices. Business unit 1 requires additional separation. In this case, the virtual router (VR) configured on the SRX Series device forwards the traffic directly to the bridge domain on the EX Series devices. The EX Series devices switch the traffic to the data center server. 9

18 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks The SRX Series devices apply security policy to all traffic traversing the untrust to trust boundary and all traffic forwarded between logical systems. The SRX Series devices are configured in an active/passive cluster so that only one node in the cluster is active on the data forwarding plane at a time. The SRX Series devices are configured with a single redundancy group for the data plane. The redundancy group uses two Ethernet interfaces (reth1 and reth2 in Figure 1 on page 8) as member interfaces. Configuring the Access Layer Configure the access layer by doing the following: Configuring Interfaces on page 10 Configuring VLANs in the Access Layer on page 11 Configuring a Redundant Trunk Group and Disabling the Spanning Tree Protocol for the Trunk Interfaces on page 12 Configuring Management Automation on page 13 Configuring Interfaces Step-by-Step Procedure This procedure explains how to configure the physical, logical, and network management interfaces for the access layer devices. This procedure shows a representative sample of the configuration. The example does not show the configuration for every interface. 1. Configure the access layer server-facing 10-Gigabit Ethernet interfaces. This example configures the ge-0/0/17 interface with VLAN ID 17. Include the member statement and specify VLAN ID 17 at the [edit interfaces ge-0/0/17 unit 0 family ethernet-switching vlan] hierarchy level. [edit interfaces ge-0/0/17 unit 0] user@ex# set family ethernet-switching vlan members 17 Repeat this step for every server-facing interface by using the appropriate interface name and VLAN number. 2. Configure the 10-Gigabit Ethernet trunk interfaces from the EX Series device to the two MX Series devices. This example configures the xe-0/1/2 and xe-0/1/0 interfaces. Include the port-mode statement and specify the trunk option at the [edit interfaces xe-0/1/2 unit 0 family ethernet-switching] and [edit interfaces xe-0/1/0 unit 0 family ethernet-switching] hierarchy levels. Include the members statement and specify the all option at the [edit interfaces xe-0/1/2 unit 0 family ethernet-switching vlan] and [edit interfaces xe-0/1/0 unit 0 family ethernet-switching] hierarchy levels. [edit interfaces xe-0/1/2 unit 0] user@ex# set family ethernet-switching port-mode trunk user@ex# set family ethernet-switching vlan members all [edit interfaces xe-0/1/0 unit 0] 10

19 Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks user@ex# set family ethernet-switching port-mode trunk user@ex# set family ethernet-switching vlan members all Repeat this step for every 10-Gigabit Ethernet trunk interface by using the appropriate interface name. 3. Enable the IPv4 address family for the loopback logical interface. Include the family statement and specify the inet option to enable IPv4 at the [edit interfaces lo0 unit 0] hierarchy level. [edit interfaces lo0 unit 0] user@ex# set family inet Repeat this step for every EX Series device by using the appropriate address for that device. 4. Configure the EX Series device management Ethernet interface. This example configures the unit 0 logical interface. Include the family statement and specify the inet option at the [edit me0 unit 0] hierarchy level. Include the address statement and specify /24 as the IPv4 address at the [edit interfaces me0 unit 0 family inet] hierarchy level. [edit interfaces me0 unit 0] user@ex# set family inet address /24 Repeat this step for every EX Series device by using the appropriate management interface address for that device. Configuring VLANs in the Access Layer Step-by-Step Procedure This procedure explains how to configure the VLAN names and tag IDs and associate trunk interfaces with one of the access layer devices. This procedure shows a representative sample of the configuration. The example does not show the configuration for every VLAN. 1. Configure the VLAN name and tag ID (number) for each VLAN on the EX Series device. This example configures a VLAN with the name vlan17 and tag ID 17. Include the vlan-id statement and specify 17 as the VLAN tag ID at the [edit vlans vlan17] hierarchy level. [edit vlans vlan17] user@ex# set vlan-id 17 Repeat this step for every VLAN on each EX Series device by using the appropriate VLAN names and tag IDs. 2. Associate the logical trunk interfaces with each VLAN on the EX Series device. This example associates logical interfaces xe-0/1/0.0 and xe-0/1/2.0 with vlan17. Include the interface statement and specify xe-0/1/0.0 at the [edit vlans vlan17] hierarchy level. 11

20 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Include the interface statement and specify xe-0/1/2.0 at the [edit vlans vlan17] hierarchy level. [edit vlans vlan17] user@ex# set interface xe-0/1/0.0 user@ex# set interface xe-0/1/2.0 Repeat this step for every VLAN on each EX Series device by using the appropriate trunk interface names. Configuring a Redundant Trunk Group and Disabling the Spanning Tree Protocol for the Trunk Interfaces Step-by-Step Procedure This procedure explains how to configure a redundant trunk group and disable the Rapid Spanning Tree Protocol (RSTP) on the trunk interfaces. 1. Configure the trunk interfaces as a redundant trunk group. This example configures the xe-0/1/0.0 and xe-0/1/2.0 trunk interfaces in a redundant trunk group named rtgroup1. Include the interface statement at the [edit ethernet-switching-options redundant-trunk-group group rtgroup1] hierarchy level and specify each trunk interface name. Include the primary statement at the [edit ethernet-switching-options redundant-trunk-group group rtgroup1 xe-0/1/2.0] hierarchy level. [edit ethernet-switching-options redundant-trunk-group group rtgroup1] user@ex# set interface xe-0/1/0.0 user@ex# set interface xe-0/1/2.0 primary Repeat this step for every redundant trunk group by using the appropriate interface names. 2. Disable RSTP on the trunk interfaces. On an EX Series device, RSTP is enabled by default. RSTP cannot be enabled on the same interface as routing. This example disables RSTP on the xe-0/1/0.0 and xe-0/1/2.0 trunk interfaces. Include the disable statement at the [edit protocols rstp interface xe-0/1/0.0] and [edit protocols rstp interface xe-0/1/2.0] hierarchy levels. [edit protocols rstp] user@ex# set interface xe-0/1/0.0 disable user@ex# set interface xe-0/1/2.0 disable Repeat this step for every core-facing trunk interface by using the appropriate interface name. 12

21 Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Configuring Management Automation Step-by-Step Procedure This procedure explains how to configure static routes to the management network, a known host to support background Secure Copy Protocol (SCP) file transfers, a commit script, and an event archive site. 1. Configure static routes so the Ethernet management interface can reach the management network. Include the route statement, and specify /16 as the IPv4 subnet address of the management network at the [edit routing-options static] hierarchy level. Include the next-hop statement, and specify the IPv4 host address of the next-hop router at the [edit routing-options static route /16] hierarchy level. [edit routing-options static] user@ex# set route /16 next-hop Repeat this step for every Ethernet management interface on the EX Series devices. 2. Configure an SSH known host. Include the host statement, and specify the IPv4 address and RSA host key options for trusted servers at the [edit security ssh-known-hosts] hierarchy level. In this example, the RSA host key is truncated to make it easier to read. [edit security ssh-known-hosts] user@ex# set host rsa-key AAAAB3NzaC1yc2 Repeat this step for every EX Series device. 3. Configure outbound SSH to support Juniper Message Bundle (JMB) transfers to Juniper Support Systems (JSS). In this example, the client ID is configured as 00187D0B670D. Include the client statement, specify 00187D0B670D as the client ID, and specify as the IPv4 address at the [edit system services outbound-ssh] hierarchy level. Include the port statement and specify 7804 as the TCP port at the [edit system services outbound-ssh client 00187D0B670D ] hierarchy level. Include the device-id statement and specify FA022D as the device ID at the [edit system services outbound-ssh client 00187D0B670D] hierarchy level. Include the secret statement at the [edit system services outbound-ssh client 00187D0B670D ] hierarchy level. Include the services statement and specify netconf as the available service at the [edit system services outbound-ssh client 00187D0B670D ] hierarchy level. [edit system services outbound-ssh client 00187D0B670D] user@ex# set port 7804 user@ex# set device-id FA022D user@ex# set secret "$9$-9w4aik.QznDj9A0BEhrlKMxN" user@ex# set services netconf Repeat this step for every EX Series device. 13

22 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks 4. Configure a commit script. In this example the script file name is jais-activate-scripts.slax. Include the allow-transients statement at the [edit system scripts commit] hierarchy level. Include the optional statement at the [edit system scripts commit file jais-activate-scripts.slax] hierarchy level. [edit system scripts commit] user@ex# set allow-transients user@ex# set file jais-activate-scripts.slax optional Repeat this step for every EX Series devices. 5. Configure an event archive site. In this example, the archive URL is the local /var/tmp/ directory, and the name given to the destination is juniper-aim. Include the archive-sites statement and specify the archive URL at the [edit event-options destinations juniper-aim] hierarchy level. [edit event-options destinations juniper-aim] user@ex# set archive-sites "scp://admin@ ://var/tmp" password Repeat this step for every EX Series device. Configuring the Aggregation Layer in the Trusted Logical Systems Configure the aggregation layer by doing the following: Configuring Interfaces in the Trusted Logical Systems on page 14 Configuring VLANs in the Aggregation Layer on page 17 Configuring the Virtual Router Routing Instance on page 18 Configuring Management Interfaces on page 19 Configuring Logical System Administrator Accounts on page 20 Configuring Management Automation on page 21 Configuring Interfaces in the Trusted Logical Systems Step-by-Step Procedure This procedure explains how to configure the physical, logical, and Layer 3 routing interfaces for the logical system in the trusted security zone of the aggregation layer. This procedure shows a representative sample of the configuration. The example does not show the configuration for every interface. 1. Enable flexible VLAN tagging on the physical interfaces. This example configures physical interface xe-1/0/0. Include the encapsulation statement and specify the flexible-ethernet-services option at the [edit interfaces xe-1/0/0] hierarchy level. Include the flexible-vlan-tagging statement at the [edit interfaces xe-1/0/0] hierarchy level. 14

23 Example: Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks [edit interfaces xe-1/0/0] user@mx# set encapsulation flexible-ethernet-services user@mx# set flexible-vlan-tagging Repeat this step for every physical interface connected to the EX series, SRX Series, and MX Series devices using the appropriate interface name. 2. Configure the 10-Gigabit Ethernet interfaces connected to the EX Series access layer device. This example configures logical interface 17on the xe-1/0/0 interface under the logical system named Trust1. Include the encapsulation statement and specify the vlan-bridge option at the [edit logical-systems Trust1 interfaces xe-1/0/0 unit 17] hierarchy level. Include the vlan-id statement and specify 17 as the VLAN ID at the [edit logical-systems Trust1 interfaces xe-1/0/0 unit 17] hierarchy level. [edit logical-systems Trust1 interfaces xe-1/0/0 unit 17] user@mx# set encapsulation vlan-bridge user@mx# set vlan-id 17 Repeat this step for every interface connected to the access layer devices by using the appropriate interface name, logical interface number, VLAN ID, and logical system name. 3. Configure the 10-Gigabit Ethernet interfaces connected to the other MX Series device shown in Figure 1 on page 8. This example configures logical interface 17 on the xe-0/1/0 interface. Include the encapsulation statement and specify the vlan-bridge option at the [edit logical-systems Trust1 interfaces xe-0/1/0 unit 17] hierarchy level. Include the vlan-id statement and specify 17 as the VLAN tag ID at the [edit logical-systems Trust1 interfaces xe-0/1/0 unit 17] hierarchy level. [edit logical-systems Trust1 interfaces xe-0/1/0 unit 17] user@mx# set encapsulation vlan-bridge user@mx# set vlan-id 17 Repeat this step for every interface connected to the other MX Series device shown in Figure 1 on page 8 by using the appropriate interface name, logical interface number, VLAN ID, and logical system name. 4. Configure the 10-Gigabit Ethernet interface connected to the SRX Series device. This example configures logical interface 15 on the xe-1/1/0 interface. Include the encapsulation statement and specify the vlan-bridge option at the [edit logical-systems Trust1 interfaces xe-1/1/0 unit 15] hierarchy level. Include the vlan-id statement and specify 15 as the VLAN tag ID at the [edit logical-systems Trust1 interfaces xe-1/1/0 unit 15] hierarchy level. [edit logical-systems Trust1 interfaces xe-1/1/0 unit 15] user@mx# set encapsulation vlan-bridge user@mx# set vlan-id 15 15

24 Configuring a Two-Tiered Virtualized Data Center for Large Enterprise Networks Repeat this step for every interface connected to the SRX Series device by using the appropriate interface name, logical interface number, VLAN ID, and logical system name. 5. Configure the Layer 3 integrated routing and bridging (IRB) interface address. This example configures the unit 17 logical interface with /24 as the IPv4 address under the logical system named Trust1. Include the address statement and specify /24 as the IPv4 address at the [edit logical-systems Trust1 interfaces irb unit 17 family inet] hierarchy level. [edit logical-systems Trust1 interfaces irb unit 17 family inet] user@mx# set address /24 Repeat this step for every Layer 3 IBR by using the appropriate logical interface name and IPv4 address. 6. Configure the IRB interface to participate in Virtual Router Redundancy Protocol (VRRP). This example configures the unit 17 logical interface with 17 as the VRRP group name. Include the virtual-address statement and specify as the IPv4 address of the virtual router at the [edit logical-systems Trust1 interfaces irb unit 17 family inet address /24 vrrp-group 17] hierarchy level. Include the accept-data statement at the [edit logical-systems Trust1 interfaces irb unit 17 family inet address /24 vrrp-group 17] hierarchy level so the interface will accept packets destined for the virtual IP address. Include the priority statement and specify 200 as the router s priority at the [edit logical-systems Trust1 interfaces irb unit 17 family inet address /24 vrrp-group 17] hierarchy level. Include the fast-interval statement and specify 200 as the interval between VRRP advertisements at the [edit logical-systems Trust1 interfaces irb unit 17 family inet address /24 vrrp-group 17] hierarchy level. Include the preempt statement at the [edit logical-systems Trust1 interfaces irb unit 17 family inet address /24 vrrp-group 17] hierarchy level. [edit logical-systems Trust1 interfaces irb unit 17 family inet address /24 vrrp-group 17] user@mx# set virtual-address user@mx# set accept-data user@mx# set priority 200 user@mx# set fast-interval 200 user@mx# set preempt Repeat this step for every Layer 3 IBR interface by using the appropriate logical interface name, IPv4 address, VRRP group name, and priority. 16