两台防火墙堆叠,下接两台交换机堆叠,每台设备出两个口形成全交叉互联,使用冗余口冗余组的方式,请问防火墙是否需要配置两个冗余口?交换机又如何配置呢?
(0)
最佳答案
您好,请知:
因为都是三层的互联,可以考虑两个冗余组的。
可参考如下配置举例:
· 如图2-6所示,Device A和Device B组成IRF,Router 1和IRF相连的接口与Router 2和IRF相连的接口不在同一网段,Router 3和IRF相连的接口与Router 4和IRF相连的接口不在同一网段。
· 正常情况下,流量走Router 1——Device A——Router 3;当这条通道上的任一链路或者设备故障时,流量切换到Router 2——Device B——Router 4。正常通道故障恢复时,流量再切回。
(1) 配置各接口的IP地址、路由、安全域及域间策略保证网络可达,具体配置过程略。
(2) 配置IRF
¡ 配置Device A
# 配置IRF端口1/2,并将它与物理端口GigabitEthernet1/0/3绑定,并保存配置。
<DeviceA> system-view
[DeviceA] interface GigabitEthernet 1/0/3
[DeviceA-GigabitEthernet1/0/3] shutdown
[DeviceA-GigabitEthernet1/0/3] quit
[DeviceA] irf-port 1/2
[DeviceA-irf-port1/2] port group interface GigabitEthernet 1/0/3
You must perform the following tasks for a successful IRF setup:
Save the configuration after completing IRF configuration.
Execute the "irf-port-configuration active" command to activate the IRF ports.
[DeviceA-irf-port1/2] quit
[DeviceA] interface GigabitEthernet 1/0/3
[DeviceA-GigabitEthernet1/0/3] undo shutdown
[DeviceA-GigabitEthernet1/0/3] quit
[DeviceA] save
[DeviceA] irf-port-configuration active
# 为确保Device A与Device B在主设备选举过程中,Device A为主,修改Device A成员优先级为2(成员优先级大的优先,缺省情况下,设备的成员优先级均为1)。
[DeviceA] irf member 1 priority 2
# 激活IRF端口下的配置。
[DeviceA] irf-port-configuration active
¡ 配置Device B
# 将Device B的成员编号配置为2,并重启设备使新编号生效。
<DeviceB> system-view
[DeviceB] irf member 1 renumber 2
Renumbering the member ID may result in configuration change or loss. Continue? [Y/N]:y
[DeviceB] quit
<DeviceB> reboot
# 参照图2-6进行物理连线。
# 重新登录到Device B,配置IRF端口2/1,并将它与物理端口GigabitEthernet2/0/3绑定,并保存配置。
<DeviceB> system-view
[DeviceB] interface gigabitethernet 2/0/3
[DeviceB-GigabitEthernet2/0/3] shutdown
[DeviceB-GigabitEthernet2/0/3] quit
[DeviceB] irf-port 2/1
[DeviceB-irf-port2/1] port group interface GigabitEthernet 2/0/3
You must perform the following tasks for a successful IRF setup:
Save the configuration after completing IRF configuration.
Execute the "irf-port-configuration active" command to activate the IRF ports.
[DeviceB-irf-port2/1] quit
[DeviceB] interface GigabitEthernet 2/0/3
[DeviceB-GigabitEthernet2/0/3] undo shutdown
[DeviceB-GigabitEthernet2/0/3] quit
[DeviceB] save
# 激活IRF端口下的配置。
[DeviceB] irf-port-configuration active
Device A和Device B间将会进行主设备竞选,竞选失败的一方将重启,重启完成后,IRF形成。
(3) 配置Track,监测上、下行接口的以及安全引擎的状态。
<Sysname> system-view
[Sysname] track 1 interface gigabitethernet 1/0/1 physical
[Sysname-track-1] quit
[Sysname] track 2 interface gigabitethernet 1/0/2 physical
[Sysname-track-2] quit
[Sysname] track 3 interface gigabitethernet 2/0/1 physical
[Sysname-track-3] quit
[Sysname] track 4 interface gigabitethernet 2/0/2 physical
[Sysname-track-4] quit
(4) 配置冗余组。
# 创建Node 1,Node 1和Device A绑定,为主节点,成员接口为GigabitEthernet1/0/1和GigabitEthernet1/0/2。关联的Track项为1和2。
[Sysname] redundancy group aaa
[Sysname]redundancy-group-aaa] node 1
[Sysname-redundancy-group-aaa-node1] bind slot 1
[Sysname-redundancy-group-aaa-node1] priority 100
[Sysname-redundancy-group-aaa-node1] node-member interface gigabitethernet 1/0/1
[Sysname-redundancy-group-aaa-node1] node-member interface gigabitethernet 1/0/2
[Sysname-redundancy-group-aaa-node1] track 1 interface gigabitethernet 1/0/1
[Sysname-redundancy-group-aaa-node1] track 2 interface gigabitethernet 1/0/2
[Sysname-redundancy-group-aaa-node1] quit
# 创建Node 2,Node 2和Device B绑定,为备节点,成员接口为GigabitEthernet2/0/1和GigabitEthernet2/0/2。关联的Track项为3和4。
[Sysname]redundancy-group-aaa] node 2
[Sysname-redundancy-group-aaa-node2] bind slot 2
[Sysname-redundancy-group-aaa-node2] priority 50
[Sysname-redundancy-group-aaa-node2] node-member interface gigabitethernet 2/0/1
[Sysname-redundancy-group-aaa-node2] node-member interface gigabitethernet 2/0/2
[Sysname-redundancy-group-aaa-node2] track 3 interface gigabitethernet 2/0/1
[Sysname-redundancy-group-aaa-node2] track 4 interface gigabitethernet 2/0/2
[Sysname-redundancy-group-aaa-node2] quit
(1) 缺省情况下的显示信息
# 显示冗余组信息。可以看到优先级高的Node 1为主节点,Node 1和Node 2下面的成员接口都处于UP状态。
[Sysname-redundancy-group-aaa] display redundancy group aaa
Redundancy group aaa (ID 1):
Node ID Slot Priority Status Track weight
1 Slot1 100 Primary 255
2 Slot2 50 Secondary 255
Preempt delay time remained : 0 min
Preempt delay timer setting : 1 min
Remaining hold-down time : 0 sec
Hold-down timer setting : 1 sec
Manual switchover request : No
Member interfaces:
Member failover groups:
Node 1:
Node member Physical status
GE1/0/1 UP
GE1/0/2 UP
Track info:
Track Status Reduced weight Interface
1 Positive 255 GE1/0/1
2 Positive 255 GE1/0/2
Node 2:
Node member Physical status
GE2/0/1 UP
GE2/0/2 UP
Track info:
Track Status Reduced weight Interface
3 Positive 255 GE2/0/1
4 Positive 255 GE2/0/2
(2) 冗余组内主备倒换后的显示信息
# 手工关闭接口GigabitEthernet1/0/2,显示冗余组信息。可以看到优先级低的Node 2为主节点,Node 1的成员接口GigabitEthernet1/0/2故障(DOWN),GigabitEthernet1/0/1被协议关闭(DOWN(redundancy down)),Node 2的成员接口转发报文。
[Sysname-redundancy-group-aaa] quit
[Sysname] interface gigabitethernet 1/0/2
[Sysname-GigabitEthernet1/0/2] shutdown
[Sysname-GigabitEthernet1/0/2] display redundancy group aaa
Redundancy group aaa (ID 1):
Node ID Slot Priority Status Track weight
1 Slot1 100 Secondary -255
2 Slot2 50 Primary 255
Preempt delay time remained : 0 min
Preempt delay timer setting : 1 min
Remaining hold-down time : 0 sec
Hold-down timer setting : 1 sec
Manual switchover request : No
Member interfaces:
Member failover groups:
Node 1:
Node member Physical status
GE1/0/1 DOWN(redundancy down)
GE1/0/2 DOWN
Track info:
Track Status Reduced weight Interface
1 Negative 255 GE1/0/1
2 Negative 255 GE1/0/2 (Fault)
Node 2:
Node member Physical status
GE2/0/1 UP
GE2/0/2 UP
Track info:
Track Status Reduced weight Interface
3 Positive 255 GE2/0/1
4 Positive 255 GE2/0/2
(0)
逻辑上你是一根线出去,一个冗余口就行了,交换机将接口划入VLAN即可,不需要交叉,A交换机两根线接A防火墙,B交换机接2根线接B防火墙就行了。
https://www.h3c.com/cn/d_202006/1307719_30005_0.htm配置方法参考这个章节来配置。
(0)
暂无评论
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论