两台M9000部署在公网出口实现基于ISP的outbound链路负载,具体需求如下:
1、两台M9000双机IRF部署,使用冗余口组网
2、三条运营商链路(电信、联通、移动),根据目的IP所属运营商来选择对应出口,当任何一条链路故障时可以自动切换到新的链路上
3、移动链路为老师宿舍专用线路,其他区域不使用
4、默认流量(即匹配不到任何三家运营商ISP地址库,或者任何一条链路中断时)走电信链路
1、拓扑
2、组网地址端信息
电信出口:202.103.111.27 202.103.111.28 网关:202.103.111.254/24
联通出口:202.99.18.32 202.99.18.33 网关:202.99.18.254/24
移动出口:211.98.18.175 211.98.18.176 网关:211.98.18.254/24
学生宿舍区:10.10.0.0/16 网关:10.10.0.1
老师宿舍区:10.16.0.0/16 网关:10.16.0.1
办公区:10.18.0.0/16 网关:10.18.0.1
教学区:10.19.0.0/16 网关:10.19.0.1
1、IRF堆叠配置
irf member 1 priority 32
irf member 2 priority 1
irf-port 1/1
port group interface Ten-GigabitEthernet1/1/0/25 mode enhanced
port group interface Ten-GigabitEthernet1/1/0/26 mode enhanced
irf-port 2/2
port group interface Ten-GigabitEthernet2/1/0/25 mode enhanced
port group interface Ten-GigabitEthernet2/1/0/26 mode enhanced
2、冗余接口以及nat配置
interface Reth1
description dianxin
ip address 202.103.111.27 255.255.255.0
member interface GigabitEthernet1/1/0/24.100 priority 200
member interface GigabitEthernet2/1/0/24.100 priority 100
ip last-hop hold
nat outbound 3501 address-group 1
#
interface Reth2
description liantong
ip address 202.99.18.32 255.255.255.0
member interface GigabitEthernet1/1/0/24.200 priority 200
member interface GigabitEthernet2/1/0/24.200 priority 100
ip last-hop hold
nat outbound 3502 address-group 2
#
interface Reth3
description yidong
ip address 211.98.18.175 255.255.255.0
member interface GigabitEthernet1/1/0/24.300 priority 200
member interface GigabitEthernet2/1/0/24.300 priority 100
ip last-hop hold
nat outbound 3503 address-group 3
#
interface Reth4
description neiwang
ip address 172.31.0.254 255.255.255.0
member interface GigabitEthernet1/1/0/23 priority 200
member interface GigabitEthernet2/1/0/23 priority 100
ip last-hop hold
nat address-group 1
address 202.103.111.28 202.103.111.29
#
nat address-group 2
address 202.99.18.33 202.99.18.34
#
nat address-group 3
address 211.98.18.176 211.98.18.177
注:V7盒式和M9000防火墙三层转发组网时,建议全部使用冗余口
3、备份组配置
failover group 7
bind chassis 1 slot 7 cpu 1 primary
bind chassis 2 slot 7 cpu 1 secondary
#
failover group 8
bind chassis 1 slot 8 cpu 1 primary
bind chassis 2 slot 8 cpu 1 secondary
注:M9000流量上防火墙板卡默认情况下通过自动引流实现,IRF堆叠之后主备框同一槽位存在两块FW插卡,通过配置备份组实现M9000在自动引流时把同一槽位的两块FW插卡当做一个整体,确保流量只上一块FW插卡以及业务流量来回都在同一块FW插卡上
4、冗余组配置
redundancy group aaa
member interface Reth1
member interface Reth2
member interface Reth3
member interface Reth4
member failover group 7
member failover group 8
node 1
bind chassis 1
priority 100
track 1 interface GigabitEthernet1/1/0/23
track 2 interface GigabitEthernet1/1/0/24.100
track 3 interface GigabitEthernet1/1/0/24.200
track 4 interface GigabitEthernet1/1/0/24.300
track 9 interface blade 1/7/0/1
track 10 interface blade 1/8/0/1
node 2
bind chassis 2
priority 50
track 5 interface GigabitEthernet2/1/0/23
track 6 interface GigabitEthernet2/1/0/24.100
track 7 interface GigabitEthernet2/1/0/24.200
track 8 interface GigabitEthernet2/1/0/24.300
track 11 interface blade 2/7/0/1
track 12 interface blade 2/8/0/1
track 1 interface GigabitEthernet1/1/0/23 physical
track 2 interface GigabitEthernet1/1/0/24.100 physical
track 3 interface GigabitEthernet1/1/0/24.200 physical
track 4 interface GigabitEthernet1/1/0/24.300 physical
track 5 interface GigabitEthernet2/1/0/23 physical
track 6 interface GigabitEthernet2/1/0/24.100 physical
track 7 interface GigabitEthernet2/1/0/24.200 physical
track 8 interface GigabitEthernet2/1/0/24.300 physical
track 9 interface blade 1/7/0/1
track 10 interface blade 1/8/0/1
track 11 interface blade 2/7/0/1
track 12 interface blade 2/8/0/1
注:使用冗余组技术能够提供监控机制,快速检测上、下行链路是否故障,如果故障,则通知组内所有成员(包括以太网冗余接口)整体进行倒换,以便保证倒换后,报文的出接口和入接口仍然在同一台设备上
5、基于ISP的outband链路负载配置
sticky-group sip type address-port
ip port source
#
loadbalance link-group dianxin
transparent enable
probe icmp
#
loadbalance link-group liantong
transparent enable
probe icmp
#
loadbalance link-group yidong
transparent enable
probe icmp
#
loadbalance class dianxin type link-generic match-any
match 1 isp chinatel
#
loadbalance class laoshi_yidong type link-generic match-any
match 1 source ip address 10.16.0.0 16
#
loadbalance class liantong type link-generic match-any
match 1 isp cnc
#
loadbalance action ##defaultactionforllbipv4##%%autocreatedbyweb%% type link-generic
forward all
#
loadbalance action ob$action$#for#dianxin type link-generic
link-group dianxin sticky sip
fallback-action continue
#
loadbalance action ob$action$#for#laoshi_yidong type link-generic
link-group yidong sticky sip
fallback-action continue
#
loadbalance action ob$action$#for#liantong type link-generic
link-group liantong sticky sip
fallback-action continue
#
loadbalance policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%% type link-generic
class dianxin action ob$action$#for#dianxin
class liantong action ob$action$#for#liantong
class laoshi_yidong action ob$action$#for#laoshi_yidong
default-class action ##defaultactionforllbipv4##%%autocreatedbyweb%%
#
virtual-server ##defaultvsforllbipv4##%%autocreatedbyweb%% type link-ip
virtual ip address 0.0.0.0 0
lb-policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%%
service enable
connection-sync enable
sticky-sync enable
bandwidth busy-protection enable
bandwidth interface statistics enable
#
loadbalance isp file lbispinfo_v1.5.tp
#
loadbalance link dianxin
router ip 202.103.111.254
link-group dianxin
probe icmp
#
loadbalance link liantong
router ip 202.99.18.254
link-group liantong
probe icmp
#
loadbalance link yidong
router ip 211.98.18.254
link-group yidong
probe icmp
注:在配置之前务必先导入运营商地址库文件,然后再在设备中引用地址库文件
1、备份组用于实现特定业务(例如NAT业务)在指定CPU之间的数据备份,为特定业务的高可靠性运行提供保障。备份组由主节点和备节点组成。业务模块引用备份组后,主节点处理业务流量并将业务数据备份到备节点,备节点处于备份状态,不处理业务。当主节点故障时,流量自动切换到备节点。当主节点再次恢复后,流量会切回到主节点,实现业务的备份和可靠运行。
备份组有两种:
(1)自动备份组:
为了满足NAT业务的备份需求,系统会自动为每块引擎板创建一个备份组,这种备份组称为自动备份组,这块引擎板即为自动备份组的主节点。
缺省情况下自动备份组没有备节点。当引擎板被拔出时,系统会自动选择同一安全引擎组内的其它引擎板作为备节点,并将流量自动切换到备节点。
(2)手动备份组:
用户通过命令行创建的备份组。手动备份组的主节点和备节点可通过命令行配置。
建议IRF堆叠情况下均启用备份组
2、NAT业务配置
M9000上NAT配置有诸多限制,详细可以参考最新的版本说明书,简单概括如下:
(1)NAT不支持Easy IP
(2)NAT 地址池中的地址数必须大于或等于防火墙引擎板个数(未启用备份组特性);NAT 地址池中的地址数必须大于或等于备份组个数(启用备份组特性);如果地址数少于FW引擎板个数或者少于备份组个数,需要使用手动MQC引流实现NAT业务
(3)静态NAT Global地址、NAT Server Global地址、NAT地址池地址不能使用M9000接口IP地址
(4)静态NAT Global地址和NAT地址池地址不要冲突; NAT Server Global地址和NAT地址池地址不要冲突
(5)由于接口卡支持引流表项有限,NAT地址池包含地址强烈建议配置成掩码网段
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作