请问F5000A防火墙是否支持双机热备,我按照手册配置后不生效,看了产品指导说不支持。不支持为啥有IRF命令? 如果真的不支持的话,双机热备怎么实现?
(0)
最佳答案
防火墙都是做IRF的,但是是有槽位限制的。
由于网络规模迅速扩大,当前中心设备(Device A)安全业务处理能力已经不能满足需求,现需要在保护现有投资的基础上将安全业务处理能力提高一倍,并要求网络易管理、易维护。
图1-15 IRF典型配置组网图(BFD MAD检测方式)
· Device A处于局域网的汇聚层,为了将汇聚层的安全业务处理能力提高一倍,需要另外增加一台设备Device B。
· 鉴于IRF技术具有管理简便、网络扩展能力强、可靠性高等优点,所以本例使用IRF技术构建网络汇聚层(即在Device A和Device B上配置IRF功能),接入层设备通过聚合双链路上行。
· 为了防止IRF链路故障导致IRF分裂,网络中存在两个配置冲突的IRF,需要启用MAD检测功能。因为成员设备比较少,我们采用BFD MAD检测方式来监测IRF的状态。
(1) 配置Device A
# 配置接口IP地址、路由、安全域及域间安全策略保证网络可达,具体配置步骤略。
# 设备成员编号1的设备的优先级为32。
<DeviceA> system-view
[DeviceA] irf member 1 priority 32
# 配置IRF端口1/2,并将它与物理端口Ten-GigabitEthernet1/1/1绑定,并保存配置。
[DeviceA] interface ten-gigabitethernet 1/1/1
[DeviceA-Ten-GigabitEthernet1/1/1] shutdown
[DeviceA-Ten-GigabitEthernet1/1/1] quit
[DeviceA] irf-port 1/2
[DeviceA-irf-port1/2] port group interface ten-gigabitethernet 1/1/1
[DeviceA-irf-port1/2] quit
[DeviceA] interface ten-gigabitethernet 1/1/1
[DeviceA-Ten-GigabitEthernet1/1/1] undo shutdown
[DeviceA-Ten-GigabitEthernet1/1/1] quit
[DeviceA] save
# 激活IRF端口下的配置。
[DeviceA] irf-port-configuration active
(2) 配置Device B
# 配置接口IP地址、路由、安全域及域间安全策略保证网络可达,具体配置步骤略。
# 将Device B的成员编号配置为2,并重启设备使新编号生效。
<DeviceB> system-view
[DeviceB] irf member 1 renumber 2
Warning: Renumbering the member ID may result in configuration change or loss. Continue? [Y/N]:y
[DeviceB] quit
<DeviceB> reboot
# 参照图1-15进行物理连线。
# 重新登录到设备,配置IRF端口2/1,并将它与物理端口Ten-GigabitEthernet2/1/1绑定,并保存配置。
<DeviceB> system-view
[DeviceB] interface ten-gigabitethernet 2/1/1
[DeviceB-Ten-GigabitEthernet2/1/1] shutdown
[DeviceB-Ten-GigabitEthernet2/1/1] quit
[DeviceB] irf-port 2/1
[DeviceB-irf-port2/1] port group interface ten-gigabitethernet 2/1/1
[DeviceB-irf-port2/1] quit
[DeviceB] interface ten-gigabitethernet 2/1/1
[DeviceB-Ten-GigabitEthernet2/1/1] undo shutdown
[DeviceB-Ten-GigabitEthernet2/1/1] quit
[DeviceB] save
# 激活IRF端口下的配置。
[DeviceB] irf-port-configuration active
(3) Device A和Device B间将会进行主设备竞选,竞选失败的一方将重启(Device B),重启完成后,IRF形成。
(4) 配置BFD MAD检测
# 创建三层聚合接口3。
[DeviceA] interface route-aggregation 3
[DeviceA-Route-Aggregation3] quit
# 分别将Device A(成员编号为1)上的接口GE1/0/1和Device B(成员编号为2)上的接口GE2/0/1加入聚合组3中。
[DeviceA] interface gigabitethernet 1/0/1
[DeviceA-GigabitEthernet1/0/1] port link-aggregation group 3
[DeviceA-GigabitEthernet1/0/1] quit
[DeviceA] interface gigabitethernet 2/0/1
[DeviceA-GigabitEthernet2/0/1] port link-aggregation group 3
[DeviceA-GigabitEthernet2/0/1] quit
# 配置三层聚合接口3的MAD IP地址。
[DeviceA] interface route-aggregation 3
[DeviceA-Route-Aggregation3] mad bfd enable
[DeviceA-Route-Aggregation3] mad ip address 192.168.2.1 24 member 1
[DeviceA-Route-Aggregation3] mad ip address 192.168.2.2 24 member 2
[DeviceA-Route-Aggregation3] quit
(1) IRF链路正常情况下查看相关配置
# 查看IRF相关信息,可见IRF成功建立,且DeviceA为主设备。
[DeviceA] display irf
MemberID Role Priority CPU-Mac Description
*+1 Master 32 487a-da95-93b5 ---
2 Standby 1 3897-d6a8-1b1a ---
--------------------------------------------------
* indicates the device is the master.
+ indicates the device through which the user logs in.
The bridge MAC of the IRF is: 487a-da95-93b3
Auto upgrade : yes
Mac persistent : 6 min
Domain ID : 0
# 查看BFD MAD状态,状态正常。
[DeviceA] display mad verbose
Multi-active recovery state: No
Excluded ports (user-configured):
Excluded ports (system-configured):
Ten-GigabitEthernet1/1/2
Ten-GigabitEthernet2/1/1
MAD ARP disabled.
MAD ND disabled.
MAD LACP disabled.
MAD BFD enabled interface: Route-Aggregation3
MAD status : Normal
Member ID MAD IP address Neighbor MAD status
1 192.168.1.1/24 2 Normal
2 192.168.1.2/24 1 Normal
(2) IRF链路异常情况下查看相关配置
# 查看BFD MAD状态,状态异常,表示IRF分裂。
[DeviceA] display mad verbose
Excluded ports (user-configured):
Excluded ports (system-configured):
Ten-GigabitEthernet1/1/2
MAD ARP disabled.
MAD ND disabled.
MAD LACP disabled.
MAD BFD enabled interface: Route-Aggregation3
MAD status : Faulty
Member ID MAD IP address Neighbor MAD status
1 192.168.1.1/24 2 Faulty
# 查看Device B上的非保留端口全部被置为Down,显示信息略。
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论