0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

Oracle Cloud:Juniper vSRXをFirewallにしたTransit Routing で Hub and Spoke構成してみてみた

Last updated at Posted at 2019-07-15

#■目的
Oracle Cloud Infrastructure(OCI)のVCN Transit Routing はFastConnectまたはIPSec VPN経由でHub & Spokeによる複数VCN間の通信を可能にします。
そして、Hub内のインスタンスにFirewall、侵入検知システム(IDS)を設定することで、オンプレミスネットワークとSpoke VCN間のトラフィックをフィルタリング、検査することができます。
ということで、Firewallで有名なJuniper vSRXをGatewayとするHub and Spokeしてみてみます。

#■構成
構成2.png

#■手順
ここでは、Transit Routingに必要な図にあるRote Tableの設定をおこないます。
図面構成は次の記事を参考に構築します。
Juniper vSRX Virtual FirewallをOracle Cloudにインストールしてみてみた
Juniper vSRXでOracle CloudへIPsec VPN接続してみてみた
Oracle Cloud: VCNとVCNをLocal Peering してみた

このRoute Tableの設定でvSRX のPrivate IPをTarget Gateway に組み込むことでTransit Routingできます。
あと、Security List設定を忘れずに行っておいてください。

#■Route設定
以下経路になるように Route Table と Security Listを構成図のように設定

  1. On-Premises Network から Spoke VCN Instance への経路

    ・onp-inst01:172.24.0.0/24
    -> On-Premises IPSec VPN Router
    -> Internet GW : 0.0.0.0
    -> vSRX: Ge-0/0/0.0 -> Ge-0/0/1.0
    -> LPG-H-1:10.100.0.0/16
    -> spoke100-Inst:10.100.0.2

  2. Spoke VCN から On-Premises Network Instance への経路

    ・spoke100-Inst:10.100.0.2
    -> 172.24.0.0/16:LPG-Spke1
    -> LPG-Hub1 : 10.0.10.254
    -> vSRX:Ge-0/0/1.0 -> Ge-0/0/0.0
    -> Internet GW : 0.0.0.0
    -> On-Premises IPSec VPN Router
    -> onp-inst01:172.24.0.0/24

##●Route Table 設定例
①Route Table: Hub-Frontend
①Hub-RT-Public-Subnet02.png

②Route Table: Hub-Backend
②Hub-RT-Private-Subnet01.png

③Route Table: LPG-Hub1
③Hub-RT-LPG-10.100.0.0_01.png

④Route Table: LPG-Hub2
④Hub-RT-LPG-10.200.0.0_01.png

⑤Route Table: Spoke1 Subnet
⑤RT-VCN-10.100.0.0_01.png

⑥Route Table: Spoke2 Subnet
⑥RT-VCN-10.200.0.0_01.png

#■疎通確認
##●onp-inst01 -> toronto-spoke100-inst

・ping確認

[user@onp-inst01 ~]$ ping 10.100.0.2 -c 3
    PING 10.100.0.2 (10.100.0.2) 56(84) bytes of data.
    64 bytes from 10.100.0.2: icmp_seq=1 ttl=62 time=63.9 ms
    64 bytes from 10.100.0.2: icmp_seq=2 ttl=62 time=63.7 ms
    64 bytes from 10.100.0.2: icmp_seq=3 ttl=62 time=63.7 ms

    --- 10.100.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2002ms
    rtt min/avg/max/mdev = 63.757/63.820/63.909/0.064 ms

・ssh確認

[user@onp-inst01 ~]$ ssh -i id_rsa opc@10.100.0.2 hostname
    toronto-spoke100-inst01

##●onp-inst01 -> toronto-spoke200-inst
・ping確認

[user@onp-inst01 ~]$ ping 10.200.0.2 -c 3
    PING 10.200.0.2 (10.200.0.2) 56(84) bytes of data.
    64 bytes from 10.200.0.2: icmp_seq=1 ttl=62 time=57.0 ms
    64 bytes from 10.200.0.2: icmp_seq=2 ttl=62 time=56.9 ms
    64 bytes from 10.200.0.2: icmp_seq=3 ttl=62 time=56.8 ms

    --- 10.200.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2001ms
    rtt min/avg/max/mdev = 56.879/56.937/57.022/0.061 ms

・ssh確認

[user@onp-inst01 ~]$ ssh -i id_rsa opc@10.200.0.2 hostname
    toronto-spoke200-inst01

##●toronto-spoke100-inst -> onp-inst01

・ping確認

[opc@toronto-spoke100-inst01 ~]$ ping 172.24.0.2 -c 3
PING 172.24.0.2 (172.24.0.2) 56(84) bytes of data.
64 bytes from 172.24.0.2: icmp_seq=1 ttl=62 time=56.8 ms
64 bytes from 172.24.0.2: icmp_seq=2 ttl=62 time=56.9 ms
64 bytes from 172.24.0.2: icmp_seq=3 ttl=62 time=56.8 ms

--- 172.24.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 56.807/56.860/56.904/0.198 ms
``

・ssh確認

```shell-session
[opc@toronto-spoke100-inst01 ~]$ ssh -i id_rsa opc@172.24.1.2 hostname
    onp-inst01

##●toronto-spoke200-inst -> onp-inst01
・ping確認

[opc@toronto-spoke200-inst01 ~]$ ping 172.24.0.2 -c 3
    PING 172.24.0.2 (172.24.0.2) 56(84) bytes of data.
    64 bytes from 172.24.0.2: icmp_seq=1 ttl=62 time=56.8 ms
    64 bytes from 172.24.0.2: icmp_seq=2 ttl=62 time=56.8 ms
    64 bytes from 172.24.0.2: icmp_seq=3 ttl=62 time=56.9 ms

    --- 172.24.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2003ms
    rtt min/avg/max/mdev = 56.821/56.866/56.923/0.199 ms

・ssh確認

[opc@toronto-spoke200-inst01 ~]$ ssh -i id_rsa opc@172.24.1.2 hostname
    onp-inst01

#■参考
Advanced Scenario: Transit Routing

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?