H3C 防火墙RBM透明双主部署典型配置
组网说明：FW1和FW2的上、下行二层接口分别连接SW，其接口分别加入不同的VLAN。SW通过路由配置，实现内外网流量在两台FW所在路径上进行负载分担( 以 OSPF为例)。HA工作在双主模式，保证正常情况下两台FW同时处理业务。
组网说明：FW1和FW2的上、下行二层接口分别连接SW，其接口分别加入不同的VLAN。SW通过路由配置，实现内外网流量在两台FW所在路径上进行负载分担( 以 OSPF为例)。HA工作在双主模式，保证正常情况下两台FW同时处理业务。
配置步骤
SW配置：
|
SW1 |
SW2 |
|
|
接口配置 |
vlan 101 # vlan 102 # interface Bridge-Aggregation16 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 101 link-aggregation mode dynamic # interface Bridge-Aggregation26 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 102 link-aggregation mode dynamic # interface Vlan-interface101 ip address 10.101.68.1 255.255.255.0 ospf network-type p2p # interface Vlan-interface102 ip address 10.102.68.1 255.255.255.0 ospf network-type p2p # |
vlan 101 # vlan 102 # interface Bridge-Aggregation16 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 101 link-aggregation mode dynamic # interface Bridge-Aggregation26 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 102 link-aggregation mode dynamic # interface Vlan-interface101 ip address 10.101.68.2 255.255.255.0 ospf network-type p2p # interface Vlan-interface102 ip address 10.102.68.2 255.255.255.0 ospf network-type p2p # |
|
ospf |
# interface LoopBack0 ip address 68.1.1.1 255.255.255.255 # ospf 1 router-id 68.1.1.1 area 0.0.0.0 network 10.101.68.0 0.0.0.255 network 10.102.68.0 0.0.0.255 network 68.1.1.1 0.0.0.0 # |
# interface LoopBack0 ip address 68.1.1.2 255.255.255.255 # ospf 1 router-id 68.1.1.2 area 0.0.0.0 network 10.101.68.0 0.0.0.255 network 10.102.68.0 0.0.0.255 network 68.1.1.2 0.0.0.0 # |
FW配置：
|
FW1 |
FW2 |
|
|
接口、安全域、安全策略配置 |
# interface Route-Aggregation64 ip address 192.60.12.1 255.255.255.252 # interface Bridge-Aggregation1 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 101 link-aggregation mode dynamic # interface Bridge-Aggregation2 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 101 link-aggregation mode dynamic # security-zone name Trust import interface Bridge-Aggregation1 vlan 101 to 102 import interface Bridge-Aggregation2 vlan 101 to 102 # security-policy ip rule 0 name any action pass |
# interface Route-Aggregation64 ip address 192.60.12.1 255.255.255.252 # interface Bridge-Aggregation1 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 102 link-aggregation mode dynamic # interface Bridge-Aggregation2 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 102 link-aggregation mode dynamic # security-zone name Trust import interface Bridge-Aggregation1 vlan 101 to 102 import interface Bridge-Aggregation2 vlan 101 to 102 # security-policy ip rule 0 name any action pass |
|
RBM部分 |
# remote-backup group backup-mode dual-active data-channel interface Route-Aggregation64 configuration sync-check interval 1 delay-time 5 track interface GigabitEthernet1/0/2 track interface GigabitEthernet1/0/4 local-ip 192.60.12.1 remote-ip 192.60.12.2 device-role primary # undo bridge fast-forwarding check-vlan-id |
# remote-backup group backup-mode dual-active data-channel interface Route-Aggregation64 configuration sync-check interval 1 delay-time 5 track interface GigabitEthernet1/0/2 track interface GigabitEthernet1/0/4 local-ip 192.60.12.2 remote-ip 192.60.12.1 device-role secondary # undo bridge fast-forwarding check-vlan-id |
配置关键点
1. FW注意放通对应的动态路由协议相关的安全策略，如何细化可以参考典配。
2. FW配置track interface监控上下行接口状态，实现接口状态的联动。保证当其中一台FW或其链路故障时，上、下行流量能统一切换到对端。注意不是track vlan。
3. 需要配置Bridge转发时对VLAN ID字段的检查功能，对应命令：undo bridge fast-forwarding check-vlan-id
腾讯云面向开发者汇聚海量精品云计算使用和开发经验，营造开放的云计算技术生态圈。
更多推荐
10
0- 0
已为社区贡献19条内容
所有评论(0)