IRF

防火墙做二层主备，参考配置为什么要开会话同步命令？

做了报错一直up/down，请问是哪里有问题呢？

%Jan 29 19:40:03:426 2022 FW1 IFNET/3/PHY_UPDOWN: -COntext=1; Physical state on the interface GigabitEthernet1/0/1 changed to down.

%Jan 29 19:40:03:426 2022 FW1 IFNET/5/LINK_UPDOWN: -COntext=1; Line protocol state on the interface GigabitEthernet1/0/1 changed to down.

%Jan 29 19:40:03:428 2022 FW1 IFNET/3/PHY_UPDOWN: -COntext=1; Physical state on the interface Bridge-Aggregation1 changed to down.

%Jan 29 19:40:03:428 2022 FW1 IFNET/5/LINK_UPDOWN: -COntext=1; Line protocol state on the interface Bridge-Aggregation1 changed to down.

%Jan 29 19:40:12:389 2022 FW1 LAGG/6/LAGG_ACTIVE: -COntext=1; Member port GE1/0/1 of aggregation group BAGG1 changed to the active state.

%Jan 29 19:40:12:390 2022 FW1 IFNET/3/PHY_UPDOWN: -COntext=1; Physical state on the interface GigabitEthernet1/0/1 changed to up.

%Jan 29 19:40:12:395 2022 FW1 IFNET/3/PHY_UPDOWN: -COntext=1; Physical state on the interface Bridge-Aggregation1 changed to up.

%Jan 29 19:40:12:395 2022 FW1 IFNET/5/LINK_UPDOWN: -COntext=1; Line protocol state on the interface Bridge-Aggregation1 changed to up.

%Jan 29 19:40:12:396 2022 FW1 IFNET/5/LINK_UPDOWN: -COntext=1; Line protocol state on the interface GigabitEthernet1/0/1 changed to up.

%Jan 29 19:40:16:425 2022 FW1 IFNET/3/PHY_UPDOWN: -COntext=1; Physical state on the interface GigabitEthernet1/0/1 changed to down.

%Jan 29 19:40:16:425 2022 FW1 IFNET/5/LINK_UPDOWN: -COntext=1; Line protocol state on the interface GigabitEthernet1/0/1 changed to down.

%Jan 29 19:40:16:425 2022 FW1 LAGG/6/LAGG_INACTIVE_PHYSTATE: -COntext=1; Member port GE1/0/1 of aggregation group BAGG1 changed to the inactive state, because the physical state of the port is down.

配置如下

先将防火墙配置为两台堆叠设备，配置bfd mad，配置方式与正常堆叠一样。

堆叠完成后，

1、  开启会话同步功能

session synchronization enable

2、创建vlan，创建聚合口，配置相应设置。

#

interface Bridge-Aggregation1

 port link-type trunk

 port trunk permit vlan 1 to 2

 link-aggregation mode dynamic

 link-aggregation selected-port maximum 1

#

interface Bridge-Aggregation2

 port link-type trunk

 port trunk permit vlan 1 to 2

 link-aggregation mode dynamic

 link-aggregation selected-port maximum 1

3、  进入物理接口配置相应属性，加入聚合口

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable copper

 link-aggregation port-priority 10

 port link-aggregation group 1

#

interface GigabitEthernet1/0/2

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable copper

 link-aggregation port-priority 11

 port link-aggregation group 2

#

interface GigabitEthernet2/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable copper

 port link-aggregation group 2

#

interface GigabitEthernet2/0/2

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable copper

 port link-aggregation group 1

4、  配置安全域并放通策略。

security-zone name Trust

 import interface Bridge-Aggregation1 vlan 2

#

security-zone name Untrust

 import interface Bridge-Aggregation2 vlan 2

#

security-policy ip

 rule 1 name 1

  action pass

  source-zone trust

  source-zone untrust

  destination-zone untrust

  destination-zone trust

5、  配置track监视物理接口

#

track 1 interface GigabitEthernet1/0/1 physical

#

track 2 interface GigabitEthernet1/0/2 physical

#

track 3 interface GigabitEthernet2/0/1 physical

#

track 4 interface GigabitEthernet2/0/2 physical

配置冗余组、冗余组节点、节点成员、加入track相应接口。

#

redundancy group 1

 node 1

  bind slot 1

  priority 100

  track 1 interface GigabitEthernet1/0/1

  track 2 interface GigabitEthernet1/0/2

  node-member interface GigabitEthernet1/0/1

  node-member interface GigabitEthernet1/0/2

 node 2

  bind slot 2

  priority 50

  track 3 interface GigabitEthernet2/0/1

  track 4 interface GigabitEthernet2/0/2

  node-member interface GigabitEthernet2/0/1

  node-member interface GigabitEthernet2/0/2

交换机3的配置

1、创建vlan，创建集合口配置相应参数。在vlan接口配置ip地址

#

interface Bridge-Aggregation1

 port link-type trunk

 port trunk permit vlan 1 to 2

 link-aggregation mode dynamic

 link-aggregation selected-port maximum 1

#

interface Vlan-interface2

 ip address 10.1.34.3 255.255.255.0

2、  将物理接口加入聚合口内

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable fiber

 link-aggregation port-priority 11

 port link-aggregation group 1

#

interface GigabitEthernet1/0/2

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable fiber

 port link-aggregation group 1

交换机4的配置

1、  创建vlan，创建集合口配置相应参数。在vlan接口配置ip地址

#

interface Bridge-Aggregation1

 port link-type trunk

 port trunk permit vlan 1 to 2

 link-aggregation mode dynamic

 link-aggregation selected-port maximum 1

#

interface Vlan-interface2

 ip address 10.1.34.4 255.255.255.0

2、  将物理接口加入聚合口内

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable fiber

 port link-aggregation group 1

#

interface GigabitEthernet1/0/2

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 to 2

 combo enable fiber

 link-aggregation port-priority 10

port link-aggregation group 1