防火墙双出口相关技术及方式

常见的接入网络的技术

1. PPPOE

1. DHCP

1. 静态IP

可靠性技术

1. ip-link

1. nqa

1. bfd

1. 健康检测

1. multi-link(全局选路策略)

负载均衡模式

①链路质量

②链路权重

③链路带宽

④优先级主备方式（vrrp）

一、实验基本配置情况

IP划分表：

Cloud1：连接外网

ISP1

<Huawei>system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]sysname ISP1

[ISP1]interface g0/0/0

[ISP1-GigabitEthernet0/0/0]ip address dhcp-alloc

[ISP1-GigabitEthernet0/0/0]quit

[ISP1]acl 2000

[ISP1-acl-basic-2000]rule permit

[ISP1-acl-basic-2000]interface g0/0/0

[ISP1-GigabitEthernet0/0/0]nat outbound 2000

[ISP1-GigabitEthernet0/0/0]quit

ISP2

<Huawei>system-view

[Huawei]sysname ISP2

[ISP2]dhcp enable

[ISP2]interface g0/0/0

[ISP2-GigabitEthernet0/0/0]ip address dhcp-alloc

[ISP2-GigabitEthernet0/0/0]quit

[ISP2]acl 2000

[ISP2-acl-basic-2000]rule permit

[ISP2-acl-basic-2000]quit

[ISP2]interface g0/0/0

[ISP2-GigabitEthernet0/0/0]nat outbound 2000

[ISP2-GigabitEthernet0/0/0]quit

FW

<USG6000V1>system-view

[USG6000V1]sysname FW

[FW]dhcp enable

[FW]interface g1/0/1

[FW-GigabitEthernet1/0/1]ip address 192.168.1.1 24

[FW-GigabitEthernet1/0/1]dhcp select interface

[FW-GigabitEthernet1/0/1]dhcp server dns-list 114.114.114.114

[FW-GigabitEthernet1/0/1]quit

[FW]interface g1/0/2

[FW-GigabitEthernet1/0/2]ip address 192.168.2.1 24

[FW-GigabitEthernet1/0/2]dhcp select interface

[FW-GigabitEthernet1/0/2]dhcp server dns-list 114.114.114.114

[FW-GigabitEthernet1/0/2]quit

[FW]dns proxy enable

二、外网接入技术

1. • PPPOE（拨号）

ISP1（SERVER）

[ISP1]dhcp enable

[ISP1]ip pool pppoe

[ISP1-ip-pool-pppoe]network 172.16.1.1 mask 30

[ISP1-ip-pool-pppoe]gateway 172.16.1.1

[ISP1-ip-pool-pppoe]dns-list 114.114.114.114

[ISP1-ip-pool-pppoe]quit

[ISP1]aaa

[ISP1-aaa]local-user isp1 password cipher 12345678

[ISP1-aaa]local-user isp1 service-type ppp

[ISP1-aaa]quit

[ISP1]interface Virtual-Template 1

[ISP1-Virtual-Template1]ppp authen

[ISP1-Virtual-Template1]ppp authentication-mode pap

[ISP1-Virtual-Template1]ip address 172.16.1.1 30

[ISP1-Virtual-Template1]remote address pool pppoe

[ISP1-Virtual-Template1]ppp ipcp dns admit-any

[ISP1-Virtual-Template1]ppp ipcp default-route

[ISP1-Virtual-Template1]quit

[ISP1]interface g0/0/1

[ISP1-GigabitEthernet0/0/1]pppoe-server bind Virtual-Template 1

[ISP1-GigabitEthernet0/0/1]quit

FW（CLIENT）

[FW]dialer-rule 1 ip permit

[FW]interface dialer 1

[FW-Dialer1]dialer user isp1

[FW-Dialer1]dialer bundle 1

[FW-Dialer1]dialer-group 1

[FW-Dialer1]ip address ppp-negotiate

[FW-Dialer1]mtu 1450

[FW-Dialer1]ppp pap local-user isp1 password cipher 12345678

[FW-Dialer1]ppp chap user isp1

[FW-Dialer1]ppp chap password cipher 12345678

[FW-Dialer1]quit

[FW-Dialer1]interface g1/0/3

[FW-GigabitEthernet1/0/3]pppoe-client dial-bundle-number 1

[FW-GigabitEthernet1/0/3]quit

1. • DHCP（动态IP）

ISP2

[ISP2]interface g0/0/1

[ISP2-GigabitEthernet0/0/1]ip address 172.16.2.1 30

[ISP2-GigabitEthernet0/0/1]dhcp select interface

[ISP2-GigabitEthernet0/0/1]dhcp server dns-list 223.5.5.5

[ISP2-GigabitEthernet0/0/1]quit

FW

[FW]interface g1/0/4

[FW-GigabitEthernet1/0/4]ip address dhcp-alloc

[FW-GigabitEthernet1/0/4]quit

三、安全策略放行和nat策略

[FW]firewall zone trust

[FW-zone-trust]add interface g1/0/1

[FW-zone-trust]add interface g1/0/2

[FW-zone-trust]quit

[FW]firewall zone untrust

[FW-zone-untrust]add interface g1/0/3

[FW-zone-untrust]add interface g1/0/4

[FW-zone-untrust]add interface dialer 1

[FW-zone-untrust]quit

[FW]security-policy

[FW-policy-security]rule name all

[FW-policy-security-rule-all]action permit

[FW-policy-security-rule-all]quit

[FW-policy-security]quit

[FW]ip route-static 0.0.0.0 0 Dialer 1

[FW]ip route-static 0.0.0.0 0 172.16.2.1

[FW]nat-policy

[FW-policy-nat]rule name trusttountrust

[FW-policy-nat-rule-trusttountrust]source-zone trust local

[FW-policy-nat-rule-trusttountrust]destination-zone untrust

[FW-policy-nat-rule-trusttountrust]action source-nat easy-ip

[FW-policy-nat-rule-trusttountrust]quit

[FW-policy-nat]quit

四、可靠性相关技术

1. • ip-link

[FW]ip-link check enable

[FW]ip-link name isp1

[FW-iplink-isp1]destination 8.8.8.8 interface Dialer1 mode icmp next-hop dialer

[FW-iplink-isp1]times 2

[FW-iplink-isp1]quit

[FW]ip route-static 0.0.0.0 0 Dialer 1 track ip-link isp1

1. • nqa

①nqa icmp探测

[FW-nqa-admin-isp1]quit

[FW]undo nqa test-instance admin isp1

[FW]nqa test-instance admin isp1

[FW-nqa-admin-isp1]test-type icmp

[FW-nqa-admin-isp1]destination-address ipv4 8.8.8.8

[FW-nqa-admin-isp1]frequency 10

[FW-nqa-admin-isp1]probe-count 2

[FW-nqa-admin-isp1]source-interface Dialer1

[FW-nqa-admin-isp1]start now

[FW-nqa-admin-isp1]quit

②nqa dns方式探测

[FW]nqa test-inst

[FW]nqa test-instance admin isp2

[FW-nqa-admin-isp2]test-type dns

[FW-nqa-admin-isp2]destination-address url www.baidu.com

[FW-nqa-admin-isp2]dns-server ipv4 114.114.114.114

[FW-nqa-admin-isp2]frequency 3

[FW-nqa-admin-isp2]start now

[FW-nqa-admin-isp2]quit

③调用方式（静态路由）

[FW]ip route-static 0.0.0.0 0 Dialer 1 track track nqa admin isp1

1. • healthcheck

[FW]healthcheck enable

[FW]healthcheck domain-name www.baidu.com

[FW]healthcheck name isp2

[FW-healthcheck-isp2]destination 114.114.114.114 interface GigabitEthernet1/0/4 next-hop 172.16.2.1 protocol dns

[FW-healthcheck-isp2]quit[FW]interface g1/0/4

[FW-GigabitEthernet1/0/4]healthcheck isp2

[FW-GigabitEthernet1/0/4]quit

1. • bfd

①bfd单跳/多跳探测

设备1：

[isp1]bfd

[isp1-bfd]quit

[isp1]bfd isp2 bind peer-ip 172.16.1.1 interface g0/0/0 source-ip 172.16.1.2

[isp1-bfd-session-isp2]discriminator local 10

[isp1-bfd-session-isp2]discriminator remote 20

[isp1-bfd-session-isp2]commit

[isp1-bfd-session-isp2]quit

设备2：

[isp2]bfd

[isp2-bfd]quit

[isp2]bfd isp1 bind peer-ip 172.16.1.2 interface g0/0/0 source-ip 172.16.1.1

[isp2-bfd-session-isp1]discriminator local 20

[isp2-bfd-session-isp1]discriminator remote 10

[isp2-bfd-session-isp1]commit

[isp2-bfd-session-isp1]quit

②bfd单臂回声探测

[isp1]bfd

[isp1-bfd]quit

[isp1]bfd isp2 bind peer-ip 172.16.1.1 interface g0/0/0 one-arm-echo

[isp1-bfd-session-isp2]discriminator local 10

[isp1-bfd-session-isp2]commit

[isp1-bfd-session-isp2]quit

③调用方式（静态路由）

[isp1]ip route-static 0.0.0.0 0 172.16.1.1 track bfd-session isp2

1. • multil-linkif(全局选路策略)

[FW]link-interface name isp1

[FW-linkif-0]interface dialer 1

[FW-linkif-0]quit

[FW]link-interface name isp2

[FW-linkif-1]interface g1/0/4

[FW-linkif-1]quit

[FW]interface Dialer 1

[FW-Dialer1]bandwidth ingress 1000000 threshold 90

[FW-Dialer1]bandwidth egress 1000000 threshold 90

[FW-Dialer1]healthcheck isp1

[FW-Dialer1]quit

[FW]interface g1/0/4

[FW-GigabitEthernet1/0/4]bandwidth ingress 1000000 threshold 90

[FW-GigabitEthernet1/0/4]bandwidth egress 1000000 threshold 90

[FW-GigabitEthernet1/0/4]healthcheck isp2

[FW-GigabitEthernet1/0/4]quit

①链路带宽

[FW]multi-linkif

[FW-multi-linkif]add linkif isp1

[FW-multi-linkif]add linkif isp2

[FW-multi-linkif]mode proportion-of-bandwidth

[FW-multi-linkif]quit

②链路质量

[FW]multi-linkif

[FW-multi-linkif]add linkif isp1

[FW-multi-linkif]add linkif isp2

[FW-multi-linkif]mode priority-of-link-quality

[FW-multi-linkif]priority-of-link-quality parameter delay jitter loss

[FW-multi-linkif]priority-of-link-quality protocol tcp-simple

[FW-multi-linkif]quit

③链路权重

[FW]multi-linkif

[FW-multi-linkif]add linkif isp1 weight 5

[FW-multi-linkif]add linkif isp2 weight 5

[FW-multi-linkif]proportion-of-weight

[FW-multi-linkif]quit

五、策略路由（pbr）

[FW]policy-based-route

[FW-policy-pbr]rule name isp1

[FW-policy-pbr-rule-isp1]source-zone trust

[FW-policy-pbr-rule-isp1]source-address 192.168.1.0 mask 255.255.255.0

[FW-policy-pbr-rule-isp1]action pbr egress-interface Dialer1

[FW-policy-pbr-rule-isp1]quit

[FW-policy-pbr]rule name isp2

[FW-policy-pbr-rule-isp2]source-zone trust

[FW-policy-pbr-rule-isp2]source-address 192.168.2.0 mask 255.255.255.0

[FW-policy-pbr-rule-isp2]action pbr egress-interface GigabitEthernet1/0/4 next-hop 172.16.2.1

[FW-policy-pbr-rule-isp2]quit

[FW-policy-pbr]quit