防火墙二层部署冗余组切换无法实现回切问题分析

不涉及

防火墙组网二层部署，堆叠+冗余组配置，利用二层聚合配置最大选中数实现业务主备处理。

关键配置如下：

#

track 1 interface Ten-GigabitEthernet1/1/0 physical

#

track 2 interface Ten-GigabitEthernet2/1/0 physical

#

track 3 interface Ten-GigabitEthernet1/1/1 physical

#

track 4 interface Ten-GigabitEthernet2/1/1 physical

#

#

interface Bridge-Aggregation6

 port access vlan 10

 link-aggregation mode dynamic

 link-aggregation selected-port maximum 1

#

interface Bridge-Aggregation16

 port access vlan 10

 link-aggregation mode dynamic

 link-aggregation selected-port maximum 1

#

interface Ten-GigabitEthernet1/1/0

 port link-mode bridge

 port access vlan 10

  link-aggregation port-priority 50

 port link-aggregation group 6

#

interface Ten-GigabitEthernet1/1/1

 port link-mode bridge

 port access vlan 10

 link-aggregation port-priority 50

 port link-aggregation group 16

#

interface Ten-GigabitEthernet2/1/0

 port link-mode bridge

 port access vlan 10

 link-aggregation port-priority 100

 port link-aggregation group 6

#

interface Ten-GigabitEthernet2/1/1

 port link-mode bridge

 port access vlan 10

 link-aggregation port-priority 100

 port link-aggregation group 16

#

#

redundancy group aaa

 node 1

  bind slot 1

  priority 100

  track 1 interface Ten-GigabitEthernet1/1/0

  track 3 interface Ten-GigabitEthernet1/1/1

  node-member interface Ten-GigabitEthernet1/1/0

  node-member interface Ten-GigabitEthernet1/1/1

 node 2

  bind slot 2

  priority 50

  track 2 interface Ten-GigabitEthernet2/1/0

  track 4 interface Ten-GigabitEthernet2/1/1

  node-member interface Ten-GigabitEthernet2/1/0

  node-member interface Ten-GigabitEthernet2/1/1

#

初始时，冗余组状态：

[H3C]display redundancy group aaa

Redundancy group aaa (ID 1):

  Node ID      Slot          Priority   Status        Track weight

  1            Slot1         100        Primary       255

  2            Slot2         50         Secondary     255

Preempt delay time remained     : 0    sec

Preempt delay timer setting     : 60   sec

Remaining hold-down time        : 0    sec

Hold-down timer setting         : 1    sec

Manual switchover request       : No

Member interfaces:

Node 1:

  Node member     Physical status

    XGE1/1/0      UP

    XGE1/1/1      UP

  Track info:

    Track    Status           Reduced weight     Interface

    1        Positive         255                XGE1/1/0

    3        Positive         255                XGE1/1/1

Node 2:

  Node member     Physical status

    XGE2/1/0      UP

    XGE2/1/1      UP

  Track info:

    Track    Status           Reduced weight     Interface

    2        Positive         255                XGE2/1/0

    4        Positive         255                XGE2/1/1

当把1框的某一个接口down掉后，冗余组主切换到2框：

[H3C]display redundancy group aaa

Redundancy group aaa (ID 1):

  Node ID      Slot          Priority   Status        Track weight

  1            Slot1         100        Secondary     -255

  2            Slot2         50         Primary       255

Preempt delay time remained     : 0    sec

Preempt delay timer setting     : 60   sec

Remaining hold-down time        : 0    sec

Hold-down timer setting         : 1    sec

Manual switchover request       : No

Member interfaces:

Node 1:

  Node member     Physical status

    XGE1/1/0      DOWN

    XGE1/1/1      DOWN(redundancy down)

  Track info:

    Track    Status           Reduced weight     Interface

    1        Negative(Faulty) 255                XGE1/1/0

    3        Negative         255                XGE1/1/1

Node 2:

  Node member     Physical status

    XGE2/1/0      UP

    XGE2/1/1      UP

  Track info:

    Track    Status           Reduced weight     Interface

    2        Positive         255                XGE2/1/0

    4        Positive         255                XGE2/1/1

以上切换均没有问题，当1框的接口恢复UP后，冗余组1 min缺省实现回切，但是查看聚合口的成员接口，发现还是2框的接口被选中。

[H3C-Ten-GigabitEthernet1/1/0]undo shutdown

[H3C-Ten-GigabitEthernet1/1/0]%Jul 15 15:49:07:023 2022 H3C IFNET/3/PHY_UPDOWN: -COntext=1; Physical state on the interface Ten-GigabitEthernet1/1/0 changed to up.

%Jul 15 15:49:08:149 2022 H3C IFNET/3/PHY_UPDOWN: -COntext=1; Physical state on the interface Ten-GigabitEthernet1/1/1 changed to up.

[H3C]display redundancy group aaa

Redundancy group aaa (ID 1):

  Node ID      Slot          Priority   Status        Track weight

  1            Slot1         100        Primary       255

  2            Slot2         50         Secondary     255

Preempt delay time remained     : 0    sec

Preempt delay timer setting     : 60   sec

Remaining hold-down time        : 0    sec

Hold-down timer setting         : 1    sec

Manual switchover request       : No

Member interfaces:

Node 1:

  Node member     Physical status

    XGE1/1/0      UP

    XGE1/1/1      UP

  Track info:

    Track    Status           Reduced weight     Interface

    1        Positive         255                XGE1/1/0

    3        Positive         255                XGE1/1/1

Node 2:

  Node member     Physical status

    XGE2/1/0      UP

    XGE2/1/1      UP

  Track info:

    Track    Status           Reduced weight     Interface

    2        Positive         255                XGE2/1/0

    4        Positive         255                XGE2/1/1

[H3C-Ten-GigabitEthernet1/1/0]display  link-aggregation verbose

Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing

Port Status: S -- Selected, U -- Unselected, I -- Individual

Port: A -- Auto port

Flags:  A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,

        D -- Synchronization, E -- Collecting, F -- Distributing,

        G -- Defaulted, H -- Expired

Aggregate Interface: Bridge-Aggregation6

Creation Mode: Manual

Aggregation Mode: Dynamic

Loadsharing Type: Shar

System ID: 0x8000, 782c-29c4-0800

Local:

  Port             Status  Priority Oper-Key  Flag

--------------------------------------------------------------------------------

  XGE1/1/0         U       50       5         {ACD}

  XGE2/1/0         S       100      5         {ACDEF}

Remote:

  Actor            Partner Priority Oper-Key  SystemID               Flag

--------------------------------------------------------------------------------

  XGE1/1/0         1       10       321       0x8000, 9c52-f882-7f51 {AC}

  XGE2/1/0         2       100      321       0x8000, 9c52-f882-7f51 {ACDEF}

Aggregate Interface: Bridge-Aggregation16

Creation Mode: Manual

Aggregation Mode: Dynamic

Loadsharing Type: Shar

System ID: 0x8000, 782c-29c4-0800

Local:

  Port             Status  Priority Oper-Key  Flag

--------------------------------------------------------------------------------

  XGE1/1/1         U       50       4         {ACD}

  XGE2/1/1         S       100      4         {ACDEF}

Remote:

  Actor            Partner Priority Oper-Key  SystemID               Flag

--------------------------------------------------------------------------------

  XGE1/1/1         3       10       577       0x8000, 9c52-f882-7f51 {AC}

  XGE2/1/1         4       100      577       0x8000, 9c52-f882-7f51 {ACDEF}

链路聚合没有抢占机制。 1框的接口UP后，不会参与抢占，所以聚合选中接口还在2框。

需要人工干预，使聚合组选中接口回到1框。