防火墙板卡虚拟化

配置较多可以参考H3C官网典型配置开局案例：

SecBlade III FW的接口配置步骤 

（1） 创建ACL，允许内网10.1.0.0/16网段地址 [H3C] acl advanced 3500 [H3C-acl-ipv4-adv-3500] rule 0 permit ip source 10.1.0.0 0.0.255.255 [H3C-acl-ipv4-adv-3500]quit 

（2） 创建聚合口RAG1和RAG2，将Slot 1和Slot 2的4个内联口分别加入聚合口RAG1和RAG2 [H3C]interface Route-Aggregation 1 

[H3C-Route-Aggregation1]quit 

[H3C]interface Ten-GigabitEthernet 1/0/1 

[H3C-Ten-GigabitEthernet1/0/1]port link-aggregation group 1 

[H3C-Ten-GigabitEthernet1/0/1]quit 

依次将Ten1/0/2，Ten1/0/3，Ten1/0/4都加入聚合组RAG1 

# [H3C]interface Route-Aggregation 2 

[H3C-Route-Aggregation2]quit 

[H3C]interface Ten-GigabitEthernet 2/0/1 

[H3C-Ten-GigabitEthernet2/0/1]port link-aggregation group 2

 [H3C-Ten-GigabitEthernet2/0/1]quit 依次将Ten2/0/2，Ten2/0/3，Ten2/0/4都加入聚合组RAG2 # 创建聚合子接口RAG1.4011,RAG1.4012,RAG2.4011,RAG2.4012

 [H3C]interface Route-Aggregation 1.4011 

[H3C-Route-Aggregation1.4011]vlan-type dot1q vid 4011 

[H3C-Route-Aggregation1.4011]quit

 其他聚合子接口的配置略。 

（3） 创建冗余口并应用NAT和冗余组的配置 #创建冗余口Reth2，IP地址为222.173.111.50/ 30，成员接口为RAG1.4011和RAG2.4011，其中RAG1.4011的优先级为100，RAG2.4011的优先级为50。开启 

[H3C] interface Reth 2

 [H3C-Reth2] ip address 222.173.111.50 255.255.255.240 

[H3C-Reth2] nat outbound 3500 address-group 1 

[H3C-Reth2] nat server global 222.173.111.60 inside 10.1.0.6

 [H3C-Reth2] member interface Route-Aggregation1.4011 priority 100 [H3C-Reth2] member interface Route-Aggregation2.4011 priority 50 [H3C-Reth2] ip last-hop hold # 创建冗余口Reth3，IP地址为222.173.112.100/28，成员接口为RAG1.4012和RAG2.4012，其中RAG1.4012的优先级为100，RAG2.4012的优先级为50。开启 [H3C] interface Reth 3 [H3C-Reth3] ip address 222.173.112.100 255.255.255.240 [H3C-Reth3] nat outbound 3500 address-group 2 [H3C-Reth3] member interface Route-Aggregation1.4012 priority 100 [H3C-Reth3] member interface Route-Aggregation2.4012 priority 50 [H3C-Reth3] ip last-hop hold [H3C-Reth3] quit # 创建内网入口冗余口Reth1，IP地址为10.1.0.1/16，成员接口为RAG1.4010和RAG2.4010，其中RAG1.4010的优先级为100，RAG2.4010的优先级为50。开启 [H3C] interface Reth 1 [H3C-Reth1] ip address 10.1.0.1 255.255.0.0 [H3C-Reth1] member interface Route-Aggregation1.4010 priority 100 [H3C-Reth1] member interface Route-Aggregation2.4010 priority 50 [H3C-Reth1] ip last-hop hold [H3C-Reth1] quit #配置track，监测业务端口端口状态。 [H3C] track 1 interface Route-Aggregation1 [H3C] track 2 interface Route-Aggregation2 #配置冗余组1，创建Node 1，Node 1和FW1绑定，为主节点。关联的Track项为1。 [H3C] redundancy group 1 [H3C-redundancy-group-1] node 1 [H3C-redundancy-group-1-node1] bind slot 1 [H3C-redundancy-group-1-node1] priority 100 [H3C-redundancy-group-1-node1] track 1 interface Route-Aggregation1 #配置冗余组1，创建Node 2，Node 2和FW2绑定，为备节点。关联的Track项为2。 [H3C-redundancy-group-1] node 2 [H3C-redundancy-group-1-node2] bind slot 2 [H3C-redundancy-group-1-node2] priority 50 [H3C-redundancy-group-1-node2] track 2 interface Route-Aggregation2 [H3C-redundancy-group-1-node2] quit # 将Reth1、Reth2和Reth3添加到冗余组中。 [H3C-redundancy-group-1] member interface reth 1 [H3C-redundancy-group-1] member interface reth 2 [H3C-redundancy-group-1] member interface reth 3 [H3C-redundancy-group-1] quit 

（4） 将冗余口加入安全域并配置域间策略 #将内网接口Reth1和MAD检测接口vlan-interface3加入trust域 

[H3C]security-zone name Trust 

[H3C-security-zone-Trust]import interface reth 1

[H3C-security-zone-Trust] import interface Vlan-interface3 

配 置关键点及注意事项： 堆叠的两台设备需采用相同的型号，使用相同的版本。 SecBlade III FW的堆叠口请使用前面板的光口。 防火墙内联口需要聚合，并配置子接口作为上下行，再做冗余。 目前防火墙插卡不允许跨框流量，需要配置冗余组。