防火墙堆叠-负载均衡转发

图3-14 IRF典型配置组网图（BFD MAD检测方式）

3. 配置思路

·              Device A处于局域网的汇聚层，为了将汇聚层的转发能力提高一倍，需要另外增加一台设备Device B。

·              鉴于IRF技术具有管理简便、网络扩展能力强、可靠性高等优点，所以本例使用IRF技术构建网络汇聚层（即在Device A和Device B上配置IRF功能），接入层设备通过聚合双链路上行。

·              为了防止万一IRF链路故障导致IRF分裂、网络中存在两个配置冲突的IRF，需要启用MAD检测功能。因为成员设备比较少，我们采用BFD MAD检测方式来监测IRF的状态。

4. 配置步骤

(1)      配置Device A

# 设置Device A的成员编号为1，创建IRF端口2，并将它与物理端口Ten-GigabitEthernet3/0/1绑定。

<Sysname> system-view

[Sysname] irf member 1

 Info: Member ID change will take effect after the member reboots and operates in IRF mode.

[Sysname] irf-port 2

[Sysname-irf-port2] port group interface ten-gigabitethernet 3/0/1

[Sysname-irf-port2] quit

# 将当前配置保存到下次启动配置文件。

[Sysname] quit

<Sysname> save

# 将设备的运行模式切换到IRF模式。

<Sysname> system-view

[Sysname] chassis convert mode irf

The device will switch to IRF mode and reboot. You are recommended to save the current running configuration and specify the configuration file for the next startup. Continue? [Y/N]:y

 Do you want to convert the content of the next startup configuration file flash:/startup.cfg to make it available in IRF mode? [Y/N]:y

 Please wait...

 Saving the converted configuration file to the main board succeeded.

Slot 1:

 Saving the converted configuration file succeeded.

 Now rebooting, please wait...

设备重启后Device A组成了只有一台成员设备的IRF。

(2)      配置Device B

# 配置Device B的成员编号为2，创建IRF端口1，并将它与物理端口Ten-GigabitEthernet3/0/1绑定。

<Sysname> system-view

[Sysname] irf member 2

 Info: Member ID change will take effect after the member reboots and operates in IRF mode.

[Sysname] irf-port 1

[Sysname-irf-port1] port group interface ten-gigabitethernet 3/0/1

[Sysname-irf-port1] quit

# 将当前配置保存到下次启动配置文件。

[Sysname] quit

<Sysname> save

# 参照图3-14进行物理连线。

# 将设备的运行模式切换到IRF模式。

<Sysname> system-view

[Sysname] chassis convert mode irf

The device will switch to IRF mode and reboot. You are recommended to save the current running configuration and specify the configuration file for the next startup. Continue? [Y/N]:y

 Do you want to convert the content of the next startup configuration file flash:/startup.cfg to make it available in IRF mode? [Y/N]:y

 Please wait...

 Saving the converted configuration file to the main board succeeded.

Slot 1:

 Saving the converted configuration file succeeded.

 Now rebooting, please wait...

设备B重启后与设备A形成IRF。

(3)      配置BFD MAD检测

# 创建VLAN 3，并将Device A（成员编号为1）上的端口1/4/0/1和Device B（成员编号为2）上的端口2/4/0/1加入VLAN中。

<Sysname> system-view

[Sysname] vlan 3

[Sysname-vlan3] port gigabitethernet 1/4/0/1 gigabitethernet 2/4/0/1

[Sysname-vlan3] quit

# 创建VLAN接口3，并配置MAD IP地址。

[Sysname] interface vlan-interface 3

[Sysname-Vlan-interface3] mad bfd enable

[Sysname-Vlan-interface3] mad ip address 192.168.2.1 24 member 1

[Sysname-Vlan-interface3] mad ip address 192.168.2.2 24 member 2

[Sysname-Vlan-interface3] quit

# 因为BFD MAD和生成树功能互斥，所以在GigabitEthernet1/4/0/1和GigabitEthernet2/4/0/1上关闭生成树协议。

[Sysname] interface gigabitethernet 1/4/0/1

[Sysname-gigabitethernet-1/4/0/1] undo stp enable

[Sysname-gigabitethernet-1/4/0/1] quit

[Sysname] interface gigabitethernet 2/4/0/1

[Sysname-gigabitethernet-2/4/0/1] undo stp enable

# 向安全域Trust中添加VLAN接口3。

<Sysname> system-view

[Sysname] security-zone name trust

[Sysname-security-zone-Trust] import interface vlan-interface 3

[Sysname-security-zone-Trust] quit

# 配置ACL 2000，定义规则：仅允许来自192.168.2.0网段的报文通过。

[Sysname] acl number 2000

[Sysname-acl-basic-2000] rule permit source 192.168.2.0 0.0.0.255

[Sysname-acl-basic-2000] quit

# 创建源安全域Trust到目的安全域Local的安全域间实例，并在该域间实例上应用包过滤策略

[Sysname] zone-pair security source trust destination loacl

[Sysname-zone-pair-security-Trust-Local] packet-filter 2000

[Sysname-zone-pair-security-Trust-Local] quit

# 创建源安全域Local到目的安全域Trust的安全域间实例，并在该域间实例上应用包过滤策略

[Sysname] zone-pair security source local destination trust

[Sysname-zone-pair-security-Local-Trust] packet-filter 2000

[Sysname-zone-pair-security-Local-Trust] quit