防火墙irf做mad检测时为什么要用三层链路聚合来做？

您好，请知：

部署IRF不一定要聚合口，可以使用单个物理端口就可以了。

以下是配置举例，请参考：

1.10  IRF典型配置举例

1.10.1  IRF典型配置举例（LACP MAD检测方式）

1. 组网需求

由于公司业务量激增，网络规模迅速扩大，当前中心设备（Device A）安全业务处理能力已经不能满足需求，现在需要另增一台设备Device B，将这两台设备组成一个IRF（如图1-14所示）。由于IRF到中间设备Device C有跨成员设备的聚合链路，且Device C为支持LACP协议的H3C设备，我们配置LACP MAD进行分裂检测。

2. 组网图

图1-14 IRF典型配置组网图（LACP MAD检测方式）

‌

3. 配置步骤

(1)     配置Device A

# 配置接口IP地址、路由、安全域及域间策略保证网络可达，具体配置步骤略。

# 配置IRF中成员编号为1的设备的优先级为32。

<DeviceA> system-view

[DeviceA] irf member 1 priority 32

# 配置IRF端口1/2，并将它与物理端口Ten-GigabitEthernet1/0/1绑定，并保存配置。

[DeviceA] interface ten-gigabitethernet 1/0/1

[DeviceA-Ten-GigabitEthernet1/0/1] shutdown

[DeviceA-Ten-GigabitEthernet1/0/1] quit

[DeviceA] irf-port 1/2

[DeviceA-irf-port1/2] port group interface ten-gigabitethernet 1/0/1

[DeviceA-irf-port1/2] quit

[DeviceA] interface ten-gigabitethernet 1/0/1

[DeviceA-Ten-GigabitEthernet1/0/1] undo shutdown

[DeviceA-Ten-GigabitEthernet1/0/1] quit

[DeviceA] save

# 激活IRF端口下的配置。

[DeviceA] irf-port-configuration active

(2)     配置Device B

# 配置接口IP地址、路由、安全域及域间策略保证网络可达，具体配置步骤略。

# 将Device B的成员编号配置为2，并重启设备使新编号生效。

<DeviceB> system-view

[DeviceB] irf member 1 renumber 2

Warning: Renumbering the member ID may result in configuration change or loss. Continue? [Y/N]:y

[DeviceB] quit

<DeviceB> reboot

# 参照配置组网图进行物理连线。

# 重新登录到设备，配置IRF端口2/1，将它与物理端口Ten-GigabitEthernet2/0/1绑定，并保存配置。

<DeviceB> system-view

[DeviceB] interface ten-gigabitethernet 2/0/1

[DeviceB-Ten-GigabitEthernet2/0/1] shutdown

[DeviceB-Ten-GigabitEthernet2/0/1] quit

[DeviceB] irf-port 2/1

[DeviceB-irf-port2/1] port group interface ten-gigabitethernet 2/0/1

[DeviceB-irf-port2/1] quit

[DeviceB] interface ten-gigabitethernet 2/0/1

[DeviceB-Ten-GigabitEthernet2/0/1] undo shutdown

[DeviceB-Ten-GigabitEthernet2/0/1] quit

[DeviceB] save

# 激活IRF端口下的配置。

[DeviceB] irf-port-configuration active

(3)     Device A和Device B间将会进行主设备竞选，竞选失败的一方（Device B）将重启，重启完成后，IRF形成。

(4)     配置LACP MAD检测

# 设置IRF域编号为1。

[DeviceA] irf domain 1

# 创建一个动态聚合接口，并开启LACP MAD检测功能。

[DeviceA] interface route-aggregation 2

[DeviceA-Route-Aggregation2] link-aggregation mode dynamic

[DeviceA-Route-Aggregation2] mad enable

You need to assign a domain ID (range: 0-4294967295)

[Current domain is: 1]:

The assigned domain ID is: 1

MAD LACP only enable on dynamic aggregation interface.

[DeviceA-Route-Aggregation2] quit

# 在聚合接口中添加成员端口Ten-GigabitEthernet1/0/2和Ten-GigabitEthernet2/0/2，用于Device A和Device B实现LACP MAD检测。

[DeviceA] interface ten-gigabitethernet 1/0/2

[DeviceA-Ten-GigabitEthernet1/0/2] port link-aggregation group 2

[DeviceA-Ten-GigabitEthernet1/0/2] quit

[DeviceA] interface ten-gigabitethernet 2/0/2

[DeviceA-Ten-GigabitEthernet2/0/2] port link-aggregation group 2

[DeviceA-Ten-GigabitEthernet2/0/2] quit

(5)     配置中间设备Device C

# 配置接口IP地址、路由保证网络可达，具体配置步骤略。

# 创建一个动态聚合接口。

<DeviceC> system-view

[DeviceC] interface route-aggregation 2

[DeviceC-Route-Aggregation2] link-aggregation mode dynamic

[DeviceC-Route-Aggregation2] quit

# 在聚合接口中添加成员端口Ten-GigabitEthernet1/0/1和Ten-GigabitEthernet1/0/2，用于帮助LACP MAD检测。

[DeviceC] interface ten-gigabitethernet 1/0/1

[DeviceC-Ten-GigabitEthernet1/0/1] port link-aggregation group 2

[DeviceC-Ten-GigabitEthernet1/0/1] quit

[DeviceC] interface ten-gigabitethernet 1/0/2

[DeviceC-Ten-GigabitEthernet1/0/2] port link-aggregation group 2

[DeviceC-Ten-GigabitEthernet1/0/2] quit

4. 验证配置

·     IRF链路正常情况下查看相关配置

# 查看IRF相关信息，可见IRF成功建立，且DeviceA为主设备。

[DeviceA] display irf

MemberID    Role    Priority  CPU-Mac         Description

 *+1        Master  32        487a-da95-93b5  ---

   2        Standby 1         3897-d6a8-1b1a  ---

--------------------------------------------------

 * indicates the device is the master.

 + indicates the device through which the user logs in.

 The bridge MAC of the IRF is: 487a-da95-93b3

 Auto upgrade                : yes

 Mac persistent              : 6 min

 Domain ID                   : 1

# 查看LACP MAD状态，状态正常。

[DeviceA] display mad verbose

Multi-active recovery state: No

Excluded ports (user-configured):

Excluded ports (system-configured):

  Ten-GigabitEthernet1/0/1

  Ten-GigabitEthernet2/0/1

MAD ARP disabled.

MAD ND disabled.

MAD LACP enabled interface: Route-Aggregation2

  MAD status              : Normal

  Member ID   Port                                    MAD status

  1           Ten-GigabitEthernet1/0/2                Normal

  2           Ten-GigabitEthernet2/0/2                Normal

MAD BFD disabled.

·     IRF链路异常情况下查看相关配置

# 查看LACP MAD状态，状态异常，表示IRF分裂。

[DeviceA] display mad verbose

Multi-active recovery state: No

Excluded ports (user-configured):

Excluded ports (system-configured):

  Ten-GigabitEthernet1/0/1

MAD ARP disabled.

MAD ND disabled.

MAD LACP enabled interface: Route-Aggregation2

  MAD status              : Faulty

  Member ID   Port                                    MAD status

  1           Ten-GigabitEthernet1/0/2                Faulty

MAD BFD disabled.

# 查看Device B，可以看到Device B上的非保留端口全部被置为Down，显示信息略。