俩台防火墙堆叠 双外线 ,一台上面一条,怎么做配置,上行 下行,有什么注意的 求个案例 |
您所在的位置:网站首页 › h3c s10506x做堆叠怎么做 › 俩台防火墙堆叠 双外线 ,一台上面一条,怎么做配置,上行 下行,有什么注意的 求个案例 |
2 配置步骤2.1 核心交换机配置 #创建三层聚合接口并设置IP地址。 system [H3C]interface Route-Aggregation 1 [H3C-Route-Aggregation1]ip address 192.168.1.1 255.255.255.0 [H3C-Route-Aggregation1]link-aggregation selected-port maximum 1 [H3C-Route-Aggregation1]quit #将1/0/1接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 1/0/1 [H3C-GigabitEthernet1/0/1]link-aggregation port-priority 10 [H3C-GigabitEthernet1/0/1]port link-aggregation group 1 [H3C-GigabitEthernet1/0/1]quit #将1/0/2接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 1/0/2 [H3C-GigabitEthernet1/0/2]link-aggregation port-priority 100 [H3C-GigabitEthernet1/0/2]port link-aggregation group 1 [H3C-GigabitEthernet1/0/2]quit 2.2 防火墙配置2.2.1 FWA与FWB建立堆叠并配置BFD MAD检测具体配置可参考防火墙虚拟化配置举例,本章不做介绍。 2.2.2 防火墙开启会话同步并关闭本框优先命令#开启本地IP优先转发功能 [Sysname] ip load-sharing local-first enable #开启会话同步功能 [Sysname] session synchronization enable #开启会话数据统计功能 [Sysname] session statistics enable 2.2.3 防火墙聚合配置1. 防火墙上行接口聚合配置#创建二层聚合接口并设置聚合最大选中个数。 system [H3C]interface Bridge-Aggregation 1 [H3C-Bridge-Aggregation1]link-aggregation selected-port maximum 1 [H3C-Bridge-Aggregation1]quit #将1/0/1接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 1/0/1 [H3C-GigabitEthernet1/0/1]link-aggregation port-priority 10 [H3C-GigabitEthernet1/0/1]port link-aggregation group 1 [H3C-GigabitEthernet1/0/1]quit #将2/0/2接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 2/0/2 [H3C-GigabitEthernet2/0/2]link-aggregation port-priority 100 [H3C-GigabitEthernet2/0/2]port link-aggregation group 1 [H3C-GigabitEthernet2/0/2]quit 2. 防火墙下行接口聚合配置#创建二层聚合接口并设置聚合最大选中个数。 system [H3C]interface Bridge-Aggregation 2 [H3C-Bridge-Aggregation2]link-aggregation selected-port maximum 1 [H3C-Bridge-Aggregation2]quit #将1/0/1接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 1/0/3 [H3C-GigabitEthernet1/0/3]link-aggregation port-priority 10 [H3C-GigabitEthernet1/0/3]port link-aggregation group 2 [H3C-GigabitEthernet1/0/3]quit #将2/0/3接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 2/0/3 [H3C-GigabitEthernet2/0/3]link-aggregation port-priority 100 [H3C-GigabitEthernet2/0/3]port link-aggregation group 2 [H3C-GigabitEthernet2/0/3]quit 2.2.4 防火墙安全域配置#将防火墙上行接口接入Untrust区域 [H3C]security-zone name Untrust [H3C-security-zone-Untrust]import interface Bridge-Aggregation1 vlan 1 [H3C-security-zone-Untrust]import interface GigabitEthernet1/0/1 vlan 1 [H3C-security-zone-Untrust]import interface GigabitEthernet2/0/2 vlan 1 [H3C-security-zone-Untrust]quit #将防火墙下行接口接入trust区域 [H3C]security-zone name Untrust [H3C-security-zone-Trust]import interface Bridge-Aggregation2 vlan 1 [H3C-security-zone-Trust]import interface GigabitEthernet1/0/3 vlan 1 [H3C-security-zone-Trust]import interface GigabitEthernet2/0/3 vlan 1 [H3C-security-zone-Trust]quit 2.2.5 配置端口冗余组配置#配置track监控物理端口 [H3C]track 1 interface GigabitEthernet1/0/1 physical [H3C]track 2 interface GigabitEthernet2/0/2 physical [H3C]track 3 interface GigabitEthernet1/0/3 physical [H3C]track 4 interface GigabitEthernet2/0/3 physical #创建节点1与防火墙A所有接口绑定 [H3C]redundancy group aaa [H3C-redundancy-group-aaa] node 1 [H3C-redundancy-group-aaa-node1] bind slot 1 [H3C-redundancy-group-aaa-node1] priority 100 [H3C-redundancy-group-aaa-node1] node-member interface gigabitethernet 1/0/1 [H3C-redundancy-group-aaa-node1] node-member interface gigabitethernet 1/0/3 [H3C-redundancy-group-aaa-node1] track 1 interface gigabitethernet 1/0/1 [H3C-redundancy-group-aaa-node1] track 3 interface gigabitethernet 1/0/3 [H3C-redundancy-group-aaa-node1] quit 1. 创建节点2与防火墙B所有接口绑定[H3C-redundancy-group-aaa] node 2 [H3C-redundancy-group-aaa-node2] bind slot 2 [H3C-redundancy-group-aaa-node2] priority 50 [H3C-redundancy-group-aaa-node2] node-member interface gigabitethernet 2/0/2 [H3C-redundancy-group-aaa-node2] node-member interface gigabitethernet 2/0/3 [H3C-redundancy-group-aaa-node2] track 2 interface gigabitethernet 2/0/2 [H3C-redundancy-group-aaa-node2] track 4 interface gigabitethernet 2/0/3 [H3C-redundancy-group-aaa-node2] quit 2.2.6 安全策略配置防火墙目前版本存在两套安全策略,请在放通安全策略前确认设备运行那种类型的安全策略?以下配置任选其一。 1. 通过命令“display cu | in security-policy”如果查到命令行存在“security-policy disable”或者没有查到任何信息,则使用下面策略配置。[H3C]display cu | in security-policy security-policy disable #创建对象策略pass。 [H3C]object-policy ip pass [H3C-object-policy-ip-pass] rule 0 pass [H3C-object-policy-ip-pass]quit #创建Trust到Untrust域的域间策略调用pass策略。 [H3C]zone-pair security source Trust destination local [H3C-zone-pair-security-Trust- local]object-policy apply ip pass [H3C-zone-pair-security-Trust- local]quit [H3C]zone-pair security source local destination Trust [H3C-zone-pair-security-local -trust]object-policy apply ip pass [H3C-zone-pair-security-local -trust]quit [H3C]zone-pair security source Untrust destination local [H3C-zone-pair-security-Untrust- local]object-policy apply ip pass [H3C-zone-pair-security-Untrust- local]quit [H3C]zone-pair security source local destination Untrust [H3C-zone-pair-security-local -Untrust]object-policy apply ip pass [H3C-zone-pair-security-local -Untrust]quit [H3C]zone-pair security source Trust destination Untrust [H3C-zone-pair-security-Trust -Untrust]object-policy apply ip pass [H3C-zone-pair-security-Trust -Untrust]quit 2. 通过命令“display cu | in security-policy”如果查到命令行存在“security-policy ip”并且没有查到“security-policy disable”,则使用下面策略配置。[H3C]display cu | in security-policy security-policy ip 创建安全策略并放通local到trust和trust到local的安全策略。 [H3C]security-policy ip [H3C-security-policy-ip]rule 10 name test [H3C-security-policy-ip-10-test]action pass [H3C-security-policy-ip-10-test]source-zone local [H3C-security-policy-ip-10-test]source-zone Trust [H3C-security-policy-ip-10-test]source-zone Untrust [H3C-security-policy-ip-10-test]destination-zone local [H3C-security-policy-ip-10-test]destination-zone Trust [H3C-security-policy-ip-10-test]destination-zone Untrust [H3C-security-policy-ip-10-test]quit 2.3 汇聚交换机配置#创建三层聚合接口并设置IP地址。 system [H3C]interface Route-Aggregation 1 [H3C-Route-Aggregation1]ip address 192.168.1.2 255.255.255.0 [H3C-Route-Aggregation1]link-aggregation selected-port maximum 1 [H3C-Route-Aggregation1]quit #将1/0/4接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 1/0/4 [H3C-GigabitEthernet1/0/4]link-aggregation port-priority 10 [H3C-GigabitEthernet1/0/4]port link-aggregation group 1 [H3C-GigabitEthernet1/0/4]quit #将1/0/5接口加入聚合组并设置聚合优先级。 [H3C]interface GigabitEthernet 1/0/5 [H3C-GigabitEthernet1/0/5]link-aggregation port-priority 100 [H3C-GigabitEthernet1/0/5]port link-aggregation group 1 [H3C-GigabitEthernet1/0/5]quit 3 检验配置结果3.1.1 正常时查看冗余组状态节点1为主用状态,节点二为备用状态。 [H3C-redundancy-group-aaa] display redundancy group aaa Redundancy group aaa (ID 1): Node ID Slot Priority Status Track weight 1 Slot1 100 Primary 255 2 Slot2 50 Secondary 255
Preempt delay time remained : 0 min Preempt delay timer setting : 1 min Remaining hold-down time : 0 sec Hold-down timer setting : 1 sec Manual switchover request : No
Member interfaces:
Node 1: Node member Physical status GE1/0/1 UP GE1/0/3 UP Track info: Track Status Reduced weight Interface 1 Positive 255 GE1/0/1 2 Positive 255 GE1/0/3 Node 2: Node member Physical status GE2/0/2 UP GE2/0/3 UP Track info: Track Status Reduced weight Interface 3 Positive 255 GE2/0/2 4 Positive 255 GE2/0/3 3.1.2 手动关闭1/0/1接口后时查看冗余组状态查看到主备状态已经发生了变化,并且1/0/1与1/0/3的物理状态全部置为down。 [H3C] display redundancy group aaa Redundancy group aaa (ID 1): Node ID Slot Priority Status Track weight 1 Slot1 100 Secondary -255 2 Slot2 50 Primary 255
Preempt delay time remained : 0 min Preempt delay timer setting : 1 min Remaining hold-down time : 0 sec Hold-down timer setting : 1 sec Manual switchover request : No
Member interfaces:
Node 1: Node member Physical status GE1/0/1 DOWN(redundancy down) GE1/0/3 DOWN Track info: Track Status Reduced weight Interface 1 Negative 255 GE1/0/1 2 Negative 255 GE1/0/2 (Fault) Node 2: Node member Physical status GE2/0/2 UP GE2/0/3 UP Track info: Track Status Reduced weight Interface 3 Positive 255 GE2/0/2 4 Positive 255 GE2/0/3 |
今日新闻 |
推荐新闻 |
CopyRight 2018-2019 办公设备维修网 版权所有 豫ICP备15022753号-3 |