防火墙旁挂rbm对接核心堆叠

防火墙主配置：

track 1 interface GigabitEthernet1/0/0

interface GigabitEthernet1/0/0

 ip address 192.168.20.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 ip address 192.168.0.2 255.255.255.0

#

security-zone name Trust

 import interface GigabitEthernet1/0/0

 import interface Vlan-interface10

#

 ip route-static 0.0.0.0 0 192.168.20.2

#

security-policy ip

 rule 1 name 1

  action pass

#

remote-backup group

 data-channel interface GigabitEthernet1/0/1

 configuration sync-check interval 12

 delay-time 1

 track 1

 local-ip 192.168.0.2

 remote-ip 192.168.0.1

 device-role primary

防火墙备配置：

track 1 interface GigabitEthernet1/0/0

#

interface GigabitEthernet1/0/0

 ip address 192.168.30.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 ip address 192.168.0.1 255.255.255.0

#

security-zone name Trust

 import interface GigabitEthernet1/0/0

 import interface Vlan-interface10

#

 ip route-static 0.0.0.0 0 192.168.30.2

#

security-policy ip

 rule 1 name 1

  action pass

#

remote-backup group

 data-channel interface GigabitEthernet1/0/1

 configuration sync-check interval 12

 delay-time 1

 track 1

 local-ip 192.168.0.1

 remote-ip 192.168.0.2

 device-role secondary

交换机配置堆叠和策略路由：

 undo ip fast-forwarding load-sharing

irf-port 1/1

 port group interface Ten-GigabitEthernet1/0/49

irf-port 2/2

 port group interface Ten-GigabitEthernet2/0/49

#

policy-based-route 1 permit node 1

 if-match acl 3001

 apply next-hop 192.168.20.1 track 1

 apply next-hop 192.168.30.1 

#

policy-based-route 2 permit node 1

 if-match acl 3002

 apply next-hop 192.168.20.1 track 1

 apply next-hop 192.168.30.1 

#

nqa entry admin test

 type icmp-echo

  destination ip 192.168.20.1

　fre　100

  reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only

#

 nqa schedule admin test start-time now lifetime forever

#

interface Bridge-Aggregation1

 port link-type trunk

 port trunk permit vlan all

#

interface Bridge-Aggregation2

 port link-type trunk

 port trunk permit vlan all

 port trunk pvid vlan 50

#

interface Vlan-interface10

 ip address 192.168.10.2 255.255.255.0

#

interface Vlan-interface20

 ip address 192.168.20.2 255.255.255.0

#

interface Vlan-interface30

 ip address 192.168.30.2 255.255.255.0

#

interface Vlan-interface40

 ip address 10.1.1.1 255.255.255.0

 ip policy-based-route 1

#

interface Vlan-interface50

 ip address 1.1.1.1 255.255.255.0

 ip policy-based-route 2

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan all

 combo enable fiber

 port link-aggregation group 1

#

interface GigabitEthernet1/0/2

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan all

 port trunk pvid vlan 50

 combo enable fiber

 port link-aggregation group 2

#

interface GigabitEthernet1/0/3

 port link-mode bridge

 port access vlan 20

#

 ip route-static 0.0.0.0 0 1.1.1.2

#

acl advanced 3001

 rule 12 permit ip source 10.1.1.0 0.0.0.255

#

acl advanced 3002

 rule 12 permit ip destination 10.1.1.0 0.0.0.255