华为防火墙双机热备（link-group和Eth-trunk）

2021-06-19 21:51:39 阅读：303 来源： 互联网

标签：热备 group zone image rule policy 双机 FW1 FW2

![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109568286090.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) 1.配置Trust区域及其互通 ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109580141320.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) [FW1-GigabitEthernet1/0/0]ip add 10.1.1.1 24 [FW1-GigabitEthernet1/0/0]service-manage ping permit [FW1]firewall zone trust [FW1-zone-trust]add interface g1/0/0 [FW2-GigabitEthernet1/0/0]ip add 10.1.1.2 24 [FW2-GigabitEthernet1/0/0]service-manage ping permit [FW2]firewall zone trust [FW2-zone-trust]add interface g1/0/0 2.配置untrust区域及其互通 ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109604110623.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) [FW1-GigabitEthernet1/0/1]ip add 20.1.10.1 24 [FW1-GigabitEthernet1/0/1]service-manage ping permit [FW1]firewall zone untrust [FW1-zone-untrust]add interface g1/0/1 [FW2-GigabitEthernet1/0/2]ip add 20.1.20.2 24 [FW2-GigabitEthernet1/0/2]service-manage ping permit [FW2]firewall zone untrust [FW2-zone-untrust]add interface g1/0/2 [AR1-GigabitEthernet0/0/1]ip add 20.1.10.3 24 [AR1-GigabitEthernet0/0/0]ip add 20.1.30.3 24 [AR1]ospf [AR1-ospf-1]area 0 [AR1-ospf-1-area-0.0.0.0]network 20.1.10.0 0.0.0.255 [AR1-ospf-1-area-0.0.0.0]network 20.1.30.0 0.0.0.255 [AR2-GigabitEthernet0/0/2]ip add 20.1.20.4 24 [AR2-GigabitEthernet0/0/0]ip add 20.1.30.4 24 [AR2]ospf [AR2-ospf-1]area 0 [AR2-ospf-1-area-0.0.0.0]network 20.1.20.0 0.0.0.255 [AR2-ospf-1-area-0.0.0.0]network 20.1.30.0 0.0.0.255 [AR1-GigabitEthernet0/0/0]vrrp vrid 1 virtual-ip 20.1.30.254 [AR2-GigabitEthernet0/0/0]vrrp vrid 1 virtual-ip 20.1.30.254 ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109620565604.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) 3.配置源NAT [FW1]nat address-group pool1 [FW1-address-group-pool1]section 20.1.10.100 20.1.10.200 [FW1]nat-policy [FW1-policy-nat]rule name source_nat [FW1-policy-nat-rule-source_nat]source-zone trust [FW1-policy-nat-rule-source_nat]destination-zone untrust [FW1-policy-nat-rule-source_nat]action source-nat address-group pool1 [FW2]nat address-group pool1 [FW2-address-group-pool1]section 20.1.10.100 20.1.10.200 [FW2]nat-policy [FW2-policy-nat]rule name source_nat [FW2-policy-nat-rule-source_nat]source-zone trust [FW2-policy-nat-rule-source_nat]destination-zone untrust [FW2-policy-nat-rule-source_nat]action source-nat address-group pool2 4.配置Eth-trunk和DMZ区域 [FW1]int Eth-Trunk 12 [FW1-Eth-Trunk12]ip add 12.1.1.1 24 [FW1-GigabitEthernet1/0/3]eth-trunk 12 [FW1-GigabitEthernet1/0/4]eth-trunk 12 [FW1]firewall zone dmz [FW1-zone-dmz]add interface Eth-Trunk 12 ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109640287914.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) [FW1]hrp enable HRP_S[FW1]hrp interface Eth-Trunk 12 remote 12.1.1.2 [FW2]int Eth-Trunk 21 [FW2-Eth-Trunk21]ip add 12.1.1.2 24 [FW2-GigabitEthernet1/0/3]eth-trunk 21 [FW2-GigabitEthernet1/0/4]eth-trunk 21 [FW2]firewall zone dmz [FW2-zone-dmz]add interface Eth-Trunk 21 ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109662397923.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) [FW2]hrp enable HRP_S[FW2]hrp interface Eth-Trunk 21 remote 12.1.1.1 5.配置双机热备 [FW1-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.1.1.254 active [FW1-GigabitEthernet1/0/0]vrrp virtual-mac enable ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109674181553.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) [FW2-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.1.1.254 standby [FW2-GigabitEthernet1/0/0]vrrp virtual-mac enable ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109696686833.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) 6.配置link-group [FW1-GigabitEthernet1/0/0]link-group 1 [FW1-GigabitEthernet1/0/1]link-group 1 [FW2-GigabitEthernet1/0/0]link-group 1 [FW2-GigabitEthernet1/0/2]link-group 1 7.配置安全策略 [FW1]security-policy [FW1-policy-security]rule name local_dmz [FW1-policy-security-rule-local_dmz]source-zone local [FW1-policy-security-rule-local_dmz]source-zone dmz [FW1-policy-security-rule-local_dmz]destination-zone local [FW1-policy-security-rule-local_dmz]destination-zone dmz [FW1-policy-security-rule-local_dmz]action permit [FW1-policy-security]rule name trust_untrust [FW1-policy-security-rule-trust_untrust]source-zone trust [FW1-policy-security-rule-trust_untrust]destination-zone untrust [FW1-policy-security-rule-trust_untrust]action permit [FW2]security-policy [FW2-policy-security]rule name local_dmz [FW2-policy-security-rule-local_dmz]source-zone local [FW2-policy-security-rule-local_dmz]source-zone dmz [FW2-policy-security-rule-local_dmz]destination-zone local [FW2-policy-security-rule-local_dmz]destination-zone dmz [FW2-policy-security-rule-local_dmz]action permit [FW2-policy-security]rule name trust_untrust [FW2-policy-security-rule-trust_untrust]source-zone trust [FW2-policy-security-rule-trust_untrust]destination-zone untrust [FW2-policy-security-rule-trust_untrust]action permit 8.配置出口默认路由 HRP_M[FW1]ip route-static 0.0.0.0 0.0.0.0 20.1.10.3 HRP_S[FW2]ip route-static 0.0.0.0 0.0.0.0 20.1.20.4 9.验证 PC1 可以ping通 PC2 ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109712903850.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109733887868.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) 关闭AR1的g0/0/1口后PC1也可以ping通 PC2 ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109742529786.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=) ![image.png](http://www.icode9.com/i/li/?n=2&i=images/20210619/1624109756630628.png?,size_14,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=)

标签：热备,group,zone,image,rule,policy,双机,FW1,FW2
来源： https://blog.51cto.com/u_13699905/2927834

本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享；
2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关；
3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关；
4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除；
5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。

ICode9

华为防火墙双机热备（link-group和Eth-trunk）