华三防火墙IRF冗余组对接单台路由器，路由器不支持二层，只能三层对接，三角形组网，如何对接

摇人 沟通方案可行性吧

另外不是所有防火墙都支持irf，而且也不推荐开局了。

可以啊，防火墙支持三层冗余组，参考案例：

2.13.2  工作在三层，上下行分别连接一台设备

1. 组网需求

·     如图2-7所示，Device A和Device B组成IRF，Device A和Device B分别用一个接口组建成冗余接口，连接上行设备Device C；再分别用一个接口组建成冗余接口，连接下行设备Device D。

·     Device C使用VLAN接口连接Device A和Device B，Device D也使用VLAN接口连接Device A和Device B。

·     正常情况下，流量走Device D——Device A——Device C；当这条通道上的任一链路或者设备故障时，流量切换到Device D——Device B——Device C。正常通道故障恢复时，流量再切回。

2. 组网图

图2-7 配置组网图

3. 配置步骤

(1)     配置IRF

IRF的配置请参见“工作在三层，上下行分别连接两台路由器，两台路由器接口不在同一网段

”。

(2)     配置以太网冗余接口

# 创建Reth1，IP地址为1.1.1.2/24，成员接口为GigabitEthernet1/0/1和GigabitEthernet2/0/1，其中GigabitEthernet1/0/1的优先级为255，GigabitEthernet2/0/1的优先级为50。

<DeviceA> system-view

[DeviceA] interface reth 1

[DeviceA-Reth1] ip address 1.1.1.2 24

[DeviceA-Reth1] member interface gigabitethernet 1/0/1 priority 255

[DeviceA-Reth1] member interface gigabitethernet 2/0/1 priority 50

[DeviceA-Reth1] quit

# 创建Reth2，IP地址为2.2.2.2/24，成员接口为GigabitEthernet1/0/2和GigabitEthernet2/0/2，其中GigabitEthernet1/0/2的优先级为255，GigabitEthernet2/0/2的优先级为50。

[DeviceA] interface reth 2

[DeviceA-Reth2] ip address 2.2.2.2 24

[DeviceA-Reth2] member interface gigabitethernet 1/0/2 priority 255

[DeviceA-Reth2] member interface gigabitethernet 2/0/2 priority 50

[DeviceA-Reth2] quit

(3)     配置Track，监测上、下行接口的状态。

[DeviceA] track 1 interface gigabitethernet 1/0/1 physical

[DeviceA-track-1] quit

[DeviceA] track 2 interface gigabitethernet 1/0/2 physical

[DeviceA-track-2] quit

[DeviceA] track 3 interface gigabitethernet 2/0/1 physical

[DeviceA-track-3] quit

[DeviceA] track 4 interface gigabitethernet 2/0/2 physical

[DeviceA-track-4] quit

(4)     配置冗余组

# 创建Node 1，Node 1和Device A绑定，为主节点。关联的Track项为1和2。

[DeviceA] redundancy group aaa

[DeviceA-redundancy-group-aaa] node 1

[DeviceA-redundancy-group-aaa-node1] bind slot 1

[DeviceA-redundancy-group-aaa-node1] priority 100

[DeviceA-redundancy-group-aaa-node1] track 1 interface gigabitethernet 1/0/1

[DeviceA-redundancy-group-aaa-node1] track 2 interface gigabitethernet 1/0/2

[DeviceA-redundancy-group-aaa-node1] quit

# 创建Node 2，Node 2和Device B绑定，为备节点。关联的Track项为3和4。

[DeviceA-redundancy-group-aaa] node 2

[DeviceA-redundancy-group-aaa-node2] bind slot 2

[DeviceA-redundancy-group-aaa-node2] priority 50

[DeviceA-redundancy-group-aaa-node2] track 3 interface gigabitethernet 2/0/1

[DeviceA-redundancy-group-aaa-node2] track 4 interface gigabitethernet 2/0/2

[DeviceA-redundancy-group-aaa-node2] quit

# 将Reth1和Reth2添加到冗余组中。

[DeviceA-redundancy-group-aaa] member interface reth 1

[DeviceA-redundancy-group-aaa] member interface reth 2

[DeviceA-redundancy-group-aaa] quit

(5)     配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由。本举例假设LAN的网段为3.3.3.0/24，实际使用中请以具体组网情况为准，具体配置步骤如下。

[DeviceA] ip route-static 0.0.0.0 0 1.1.1.1

[DeviceA] ip route-static 3.3.3.0 24 2.2.2.1

(6)     配置接口加入安全域

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[DeviceA] security-zone name untrust

[DeviceA-security-zone-Untrust] import interface reth 1

[DeviceA-security-zone-Untrust] quit

[DeviceA] security-zone name trust

[DeviceA-security-zone-Trust] import interface reth 2

[DeviceA-security-zone-Trust] quit

(7)     配置安全策略

# 配置名称为trust-untrust的安全策略规则，使LAN中的主机可以访问外网，具体配置步骤如下。

[DeviceA] security-policy ip

[DeviceA-security-policy-ip] rule 1 name trust-untrust

[DeviceA-security-policy-ip-1-trust-untrust] source-zone trust

[DeviceA-security-policy-ip-1-trust-untrust] destination-zone untrust

[DeviceA-security-policy-ip-1-trust-untrust] source-ip-subnet 3.3.3.0 24

[DeviceA-security-policy-ip-1-trust-untrust] action pass

[DeviceA-security-policy-ip-1-trust-untrust] quit

[DeviceA-security-policy-ip] quit

4. 验证配置