1.連接VCP
Configure SWA-0 with the virtual management Ethernet (VME) interface for
out-of-band management of the Virtual Chassis configuration, if desired.
[edit]
user@SWA-0# set interfaces vme unit 0 family inet /ip-address/mask/
show">user@SWA-0>show virtual-chassis status
Virtual Chassis ID: 0019.e250.47a0
Mastership Neighbor List
Member ID Status Serial No Model priority Role ID Interface
0 (FPC 0) Prsnt AK0207360276 ex4200-48p 128 Master* 1 vcp-0
1 vcp-1
1 (FPC 1) Prsnt AK0207360281 ex4200-24t 128 Backup 0 vcp-0
0 vcp-1
Member ID for next new member: 2 (FPC 2)
user@SWA-0> show virtual-chassis vc-port all-members
fpc0:
--------------------------------------------------------------------------
Interface Type Status
or
PIC / Port
vcp-0 Dedicated Up
vcp-1 Dedicated Up
fpc1:
--------------------------------------------------------------------------
Interface Type Status
or
PIC / Port
vcp-0 Dedicated Up
vcp-1 Dedicated Up
Modify the mastership priority values(修改VC組成員優先級缺省是128）
[edit virtual-chassis]
user@SWA-1# set member 1 mastership-priority 255
缺省情況下EX交換機的端口都配置爲L2的方式，如果需要更改爲L3接口，需要刪除原接口2層封裝
del interfaces ge-0/0/0 unit 0 family ethernet-switching
set interfaces ge-0/0/0 unit 0 family inet address 192.168.100.2/24
創建VLAN
set vlans name vlan-id xx
配置VLAN的L3接口地址
set vlans name l3-interface vlan.xx
set interface vlan xx unit xx family inet address x.x.x.x/24
將某個交換端口添加到創建好的VLAN中
set interface ge-0/0/x unit 0 family ethernet-switching port-mode access vlan members name
配置TRUNK端口
set interface ge-0/0/23 unit 0 family ethernet-switching port-mode trunk native-vlan-id 1 vlan member xx
配置冗餘RE組
set groups re0 system host-name GZ_LAB_M10i_1_RE0
set groups re0 interfaces fxp0 unit 0 family inet address 172.27.69.34/24
set groups re0 routing-options static route 0.0.0.0/0 next-hop 172.27.69.1
set groups re1 system host-name GZ_LAB_M10i_1_RE1
set groups re1 interfaces fxp0 unit 0 family inet address 172.27.69.35/24
set groups re1 routing-options static route 0.0.0.0/0 next-hop 172.27.69.1
配置VRF並綁定3層VLAN 接口
set routing-instances vrf-1 instance-type vrf
set routing-instances vrf-1 interface vlan.10
set routing-instances vrf-1 route-distinguisher 65000:100
set routing-instances vrf-1 vrf-target target:65000:100
set routing-instances vrf-2 instance-type vrf
set routing-instances vrf-2 interface vlan.20
set routing-instances vrf-2 route-distinguisher 65000:200
set routing-instances vrf-2 vrf-target target:65000:200
show route ter 可以看到路由分類
配置各VRF到PE的路由分別以OSPF和靜態舉例：=================================================
set routing-instances vrf-1 instance-type vrf
set routing-instances vrf-1 interface vlan.10
set routing-instances vrf-1 route-distinguisher 65000:100
set routing-instances vrf-1 vrf-target target:65000:100
set routing-instances vrf-1 protocols ospf area 0.0.0.0 interface vlan.10
show ospf neighbor instance vrf-1
set routing-instances vrf-2 instance-type vrf
set routing-instances vrf-2 interface vlan.20
set routing-instances vrf-2 route-distinguisher 65000:200
set routing-instances vrf-2 vrf-target target:65000:200
set routing-instances vrf-2 routing-options static route 0.0.0.0/0 next-hop 192.168.20.2
配置EX交換機上行TRUNK端口的冗餘，假設該EX有兩個GE上行到兩臺匯聚層或核心層交換機，===========================
這兩個端口都配置爲TRUNK 並作爲redundant trunk group 時將不再考慮STP的問題
[edit]
set ethernet-switching-options redundant-trunk-group group-name group1
set ethernet-switching-options redundant-trunk-group group-name group1 interface ge-0/0/9.0 primary
set ethernet-switching-options redundant-trunk-group group-name group1 interface ge-0/0/10.0
配置完成後檢查：
user@switch> show redundant-trunk-group group1
EX 3200 系列交換機還提供完整的端口安全特性，包括DHCP
Snooping（動態主機配置協議偵聽）、DAI（動態ARP檢測）和MAC
限制來抵禦內外部偵聽、中間人***和拒絕服務(DoS)***。
安全性
● MAC 地址限制
● 允許的MAC 地址數——可逐端口配置
● 動態 ARP 檢測（DAI）
● 本地代理ARP
● 靜態ARP 支持
● DHCP 偵聽
訪問控制表（ACL）（JUNOSTM 防火牆過濾器）
● 基於端口的ACL（PACL）——入口
● 基於VLAN 的ACL（VACL）——入口和出口
● 基於路由器的 ACL（RACL）——入口和出口
● 每個系統在硬件中支持的ACL 條目（ACE）：7,000
● 用於計算被拒絕的數據包的ACL 計算器
● 用於計算獲准數據包的ACL 計算器
● 能夠在列表中間添加/ 刪除/ 更改ACL 條目（ACL 編輯）
● L2-L4 ACL
● 基於802.1X 端口
● 802.1X 多個請求方
● 採用VLAN 分配機制的802.1X
● 採用驗證旁路接入機制的802.1X（基於主機MAC 地址）
● 支持VoIP VLAN 的802.1X
● 基於RADIUS 屬性的802.1X 動態ACL
● 802.1X 支持的EAP 類型：MD5，TLS，TTLS，PEAP
● MAC 驗證（本地）
● 控制平面DoS 防禦
配置EX交換機的port-securit 及DHCP Snooping 端口的MAC限制綁定MAC地址：==================================
DAI保護EX系列交換機不被 ARP欺騙，同時保護在局域網中DHCP偵聽數據庫的 ARP緩存不 被***。
[edit ethernet-switching-options secure-access-port]
端口的MAC地址數限制
set interface ge-0/0/1 mac-limit 4 action drop
端口的MAC地址綁定
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:80
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:81
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:83
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:85
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:88
set interface ge-0/0/2 mac-limit 4 action drop
配置到DHCP服務器連接端口的信任
set interface ge-0/0/8 dhcp-trusted
配置在需要做端口安全的VLAN加入防止DHCP欺騙參數及在該VLAN中MAC移動的限制：
set vlan employee–vlan arp-inspection DAI的配置
set vlan employee-vlan examine-dhcp
set vlan employee-vlan mac-move-limit 5 action drop
配置完成檢查：
user@switch> show dhcp snooping binding
user@switch> show arp inspection statistics 檢查交換機上DAI 的工作情況
user@switch> show ethernet-switching table
配置EX交換機的RSTP功能 ：===========================================
Step-by-Step Procedure
To configure interfaces and RSTP on Switch 1:
Configure the VLANs voice-vlan, employee-vlan, guest-vlan, and camera-vlan:
[edit vlans]
user@switch1# set voice-vlan description “Voice VLAN”
user@switch1# set voice-vlan vlan-id 10
user@switch1# set employee-vlan description “Employee VLAN”
user@switch1# set employee-vlan vlan-id 20
user@switch1# set guest-vlan description “Guest VLAN”
user@switch1# set guest-vlan vlan-id 30
user@switch1# set camera-vlan description “Camera VLAN”
user@switch1# set guest-vlan vlan-id 40
Configure the VLANs on the interfaces, including support for the Ethernet Switching protocol:
[edit interfaces]
user@switch1# set ge-0/0/13 unit 0 family ethernet-switching vlan members [10 20 30 40]
user@switch1# set ge-0/0/9 unit 0 family ethernet-switching vlan members [10 20 30 40]
user@switch1# set ge-0/0/11 unit 0 family ethernet-switching vlan members [10 20 30 40]
Configure the port mode for the interfaces:
[edit interfaces]
user@switch1# set ge-0/0/13 unit 0 family ethernet-switching port-mode trunk
user@switch1# set ge-0/0/9 unit 0 family ethernet-switching port-mode trunk
user@switch1# set ge-0/0/11 unit 0 family ethernet-switching port-mode trunk
Configure RSTP on the switch:
[edit protocols]
user@switch1# rstp bridge-priority 16k
user@switch1# rstp interface ge-0/0/13.0 cost 1000 （配置相同的接口COST和RSTP模式，只參考優先級）
user@switch1# rstp interface ge-0/0/13.0 mode point-to-point
user@switch1# rstp interface ge-0/0/9.0 cost 1000
user@switch1# rstp interface ge-0/0/9.0 mode point-to-point
user@switch1# rstp interface ge-0/0/11.0 cost 1000
user@switch1# rstp interface ge-0/0/11.0 mode point-to-point
配置完成後檢查 ：
user@switch1> show spanning-tree interface
配置EX交換機的MSTP功能：==============================================
Step-by-Step Procedure
To configure interfaces and MSTP on Switch 1:
Configure the VLANs voice-vlan, employee-vlan, guest-vlan, and camera-vlan:
[edit vlans]
user@switch1# set voice-vlan description “Voice VLAN”
user@switch1# set voice-vlan vlan-id 10
user@switch1# set employee-vlan description “Employee VLAN”
user@switch1# set employee-vlan vlan-id 20
user@switch1# set guest-vlan description “Guest VLAN”
user@switch1# set guest-vlan vlan-id 30
user@switch1# set camera-vlan description “Camera VLAN”
user@switch1# set guest-vlan vlan-id 40
Configure the VLANs on the interfaces, including support for the Ethernet Switching protocol:
[edit interfaces]
user@switch1# set ge–0/0/13 unit 0 family ethernet-switching vlan members [10 20 30 40]
user@switch1# set ge-0/0/9 unit 0 family ethernet-switching vlan members [10 20 30 40]
user@switch1# set ge-0/0/11 unit 0 family ethernet-switching vlan members [10 20 30 40]
Configure the port mode for the interfaces:
[edit interfaces]
user@switch1# set ge–0/0/13 unit 0 family ethernet-switching port-mode trunk
user@switch1# set ge-0/0/9 unit 0 family ethernet-switching port-mode trunk
user@switch1# set ge-0/0/11 unit 0 family ethernet-switching port-mode trunk
Configure MSTP on the switch, including the two MSTIs:
[edit protocols]
user@switch1# mstp configuration-name region1
user@switch1# mstp bridge-priority 16k
user@switch1# mstp interface ge-0/0/13.0 cost 1000
user@switch1# mstp interface ge-0/0/13.0 mode point-to-point
user@switch1# mstp interface ge-0/0/9.0 cost 1000
user@switch1# mstp interface ge-0/0/9.0 mode point-to-point
user@switch1# mstp interface ge-0/0/11.0 cost 4000
user@switch1# mstp interface ge-0/0/11.0 mode point-to-point
user@switch1# mstp msti 1 bridge-priority 16k
user@switch1# mstp msti 1 vlan [10 20]
user@switch1# mstp msti 1 interface ge-0/0/11.0 cost 4000
user@switch1# mstp msti 2 bridge-priority 8k
user@switch1# mstp msti 2 vlan [30 40]
配置完成後檢查：
user@switch1> show spanning-tree interface
user@switch1> show spanning-tree bridge