华三&华为防火墙三层主备组网典型配置

 

 

 

华三：

 

配置接口IPv4地址

<Router> system-view

[Router] interface gigabitethernet 1/0/7

[Router-GigabitEthernet1/0/7] ip address 2.1.1.15 255.255.255.0

[Router-GigabitEthernet1/0/7] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

配置静态路由，保证网络路由可达

[Router] ip route-static 10.1.1.0 255.255.255.0 2.1.1.3

[Router] ip route-static 0.0.0.0 0.0.0.0 3.1.1.15

 

配置Switch A

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] interface gigabitethernet 1/0/1

[SwitchA-GigabitEthernet1/0/1] port access vlan 10

[SwitchA-GigabitEthernet1/0/1] quit

[SwitchA] interface gigabitethernet 1/0/2

[SwitchA-GigabitEthernet1/0/2] port access vlan 10

[SwitchA-GigabitEthernet1/0/2] quit

[SwitchA] interface gigabitethernet 1/0/3

[SwitchA-GigabitEthernet1/0/3] port access vlan 10

[SwitchA-GigabitEthernet1/0/3] quit

 

配置Switch B

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

[SwitchB] interface gigabitethernet 1/0/1

[SwitchB-GigabitEthernet1/0/1] port access vlan 10

[SwitchB-GigabitEthernet1/0/1] quit

[SwitchB] interface gigabitethernet 1/0/2

[SwitchB-GigabitEthernet1/0/2] port access vlan 10

[SwitchB-GigabitEthernet1/0/2] quit

[SwitchB] interface gigabitethernet 1/0/3

[SwitchB-GigabitEthernet1/0/3] port access vlan 10

[SwitchB-GigabitEthernet1/0/3] quit

 

配置Device A

<DeviceA> system-view

[DeviceA] interface gigabitethernet 1/0/1

[DeviceA-GigabitEthernet1/0/1] ip address 2.1.1.1 255.255.255.0

[DeviceA-GigabitEthernet1/0/1] quit

#

[DeviceA] security-zone name untrust

[DeviceA-security-zone-Untrust] import interface gigabitethernet 1/0/1

[DeviceA-security-zone-Untrust] quit

[DeviceA] security-zone name trust

[DeviceA-security-zone-Trust] import interface gigabitethernet 1/0/2

[DeviceA-security-zone-Trust] quit

#

[DeviceA] ip route-static 0.0.0.0 0.0.0.0 2.1.1.15

#

[DeviceA] security-policy ip

[DeviceA-security-policy-ip] rule name trust-untrust

[DeviceA-security-policy-ip-0-trust-untrust] source-zone trust

[DeviceA-security-policy-ip-0-trust-untrust] destination-zone untrust

[DeviceA-security-policy-ip-0-trust-untrust] source-ip-subnet 10.1.1.0 24

[DeviceA-security-policy-ip-0-trust-untrust] action pass

[DeviceA-security-policy-ip-0-trust-untrust] quit

#

[DeviceA-security-policy-ip] rule name vrrp1

[DeviceA-security-policy-ip-1-vrrp1] source-zone trust

[DeviceA-security-policy-ip-1-vrrp1] destination-zone local

[DeviceA-security-policy-ip-1-vrrp1] service vrrp

[DeviceA-security-policy-ip-1-vrrp1] action pass

[DeviceA-security-policy-ip-1-vrrp1] quit

[DeviceA-security-policy-ip] rule name vrrp2

[DeviceA-security-policy-ip-2-vrrp2] source-zone local

[DeviceA-security-policy-ip-2-vrrp2] destination-zone trust

[DeviceA-security-policy-ip-2-vrrp2] service vrrp

[DeviceA-security-policy-ip-2-vrrp2] action pass

[DeviceA-security-policy-ip-2-vrrp2] quit

[DeviceA-security-policy-ip] rule name vrrp3

[DeviceA-security-policy-ip-3-vrrp3] source-zone untrust

[DeviceA-security-policy-ip-3-vrrp3] destination-zone local

[DeviceA-security-policy-ip-3-vrrp3] service vrrp

[DeviceA-security-policy-ip-3-vrrp3] action pass

[DeviceA-security-policy-ip-3-vrrp3] quit

[DeviceA-security-policy-ip] rule name vrrp4

[DeviceA-security-policy-ip-4-vrrp4] source-zone local

[DeviceA-security-policy-ip-4-vrrp4] destination-zone untrust

[DeviceA-security-policy-ip-4-vrrp4] service vrrp

[DeviceA-security-policy-ip-4-vrrp4] action pass

[DeviceA-security-policy-ip-4-vrrp4] quit

[DeviceA-security-policy-ip] quit

#

[DeviceA] remote-backup group

[DeviceA-remote-backup-group] remote-ip 10.2.1.2

[DeviceA-remote-backup-group] local-ip 10.2.1.1

[DeviceA-remote-backup-group] data-channel interface gigabitethernet 1/0/3

[DeviceA-remote-backup-group] device-role primary

RBM_P[DeviceA-remote-backup-group] undo backup-mode

RBM_P[DeviceA-remote-backup-group] hot-backup enable

RBM_P[DeviceA-remote-backup-group] configuration auto-sync enable

RBM_P[DeviceA-remote-backup-group] configuration sync-check interval 12

RBM_P[DeviceA-remote-backup-group] quit

# 配置VRRP备份组，并与HA关联。实现HA对VRRP备份组的统一管理和流量引导。

RBM_P[DeviceA] interface gigabitethernet 1/0/1

RBM_P[DeviceA-GigabitEthernet1/0/1] vrrp vrid 1 virtual-ip 2.1.1.3 active

RBM_P[DeviceA-GigabitEthernet1/0/1] quit

RBM_P[DeviceA] interface gigabitethernet 1/0/2

RBM_P[DeviceA-GigabitEthernet1/0/2] vrrp vrid 2 virtual-ip 10.1.1.3 active

RBM_P[DeviceA-GigabitEthernet1/0/2] quit

#

 

配置Device B

<DeviceB> system-view

[DeviceB] interface gigabitethernet 1/0/1

[DeviceB-GigabitEthernet1/0/1] ip address 2.1.1.2 255.255.255.0

[DeviceB-GigabitEthernet1/0/1] quit

[DeviceB] security-zone name untrust

[DeviceB-security-zone-Untrust] import interface gigabitethernet 1/0/1

[DeviceB-security-zone-Untrust] quit

[DeviceB] security-zone name trust

[DeviceB-security-zone-Trust] import interface gigabitethernet 1/0/2

[DeviceB-security-zone-Trust] quit

               #

[DeviceB] ip route-static 0.0.0.0 0.0.0.0 2.1.1.15

#

[DeviceB] remote-backup group

[DeviceB-remote-backup-group] remote-ip 10.2.1.1

[DeviceB-remote-backup-group] local-ip 10.2.1.2

[DeviceB-remote-backup-group] data-channel interface gigabitethernet 1/0/3

[DeviceB-remote-backup-group] device-role secondary

RBM_S[DeviceB-remote-backup-group] undo backup-mode

RBM_S[DeviceB-remote-backup-group] hot-backup enable

RBM_S[DeviceB-remote-backup-group] configuration auto-sync enable

RBM_S[DeviceB-remote-backup-group] configuration sync-check interval 12

RBM_S[DeviceB-remote-backup-group] quit

#

RBM_S[DeviceB] interface gigabitethernet 1/0/1

RBM_S[DeviceB-GigabitEthernet1/0/1] vrrp vrid 1 virtual-ip 2.1.1.3 standby

RBM_S[DeviceB-GigabitEthernet1/0/1] quit

RBM_S[DeviceB] interface gigabitethernet 1/0/2

RBM_S[DeviceB-GigabitEthernet1/0/2] vrrp vrid 2 virtual-ip 10.1.1.3 standby

RBM_S[DeviceB-GigabitEthernet1/0/2] quit

#

 

华为

DeviceA

<HUAWEI> system-view

[HUAWEI] sysname DeviceA

[DeviceA] interface ge 0/0/1

[DeviceA-GE0/0/1] ip address 10.2.0.1 24

[DeviceA-GE0/0/1] quit

[DeviceA] interface ge 0/0/3

[DeviceA-GE0/0/3] ip address 10.3.0.1 24

[DeviceA-GE0/0/3] quit

[DeviceA] interface ge 0/0/7

[DeviceA-GE0/0/7] ip address 10.10.0.1 24

[DeviceA-GE0/0/7] quit
# [DeviceA] firewall zone untrust

[DeviceA-zone-untrust] add interface ge 0/0/1

[DeviceA-zone-untrust] quit

[DeviceA] firewall zone trust

[DeviceA-zone-trust] add interface ge 0/0/3

[DeviceA-zone-trust] quit

[DeviceA] firewall zone dmz

[DeviceA-zone-dmz] add interface ge 0/0/7

[DeviceA-zone-dmz] quit
# [DeviceA] ip route-static 0.0.0.0 0.0.0.0 1.1.1.10
#
[DeviceA] interface ge 0/0/1

[DeviceA-GE0/0/1] vrrp vrid 1 virtual-ip 1.1.1.1 24 active

[DeviceA-GE0/0/1] quit
#
[DeviceA] interface ge 0/0/3

[DeviceA-GE0/0/3] vrrp vrid 2 virtual-ip 10.3.0.3 active

[DeviceA-GE0/0/3] quit
# [DeviceA] security-policy

[DeviceA-policy-security] rule name ha_local_to_dmz

[DeviceA-policy-security-rule-ha_local_to_dmz] source-zone local dmz

[DeviceA-policy-security-rule-ha_local_to_dmz] destination-zone local dmz

[DeviceA-policy-security-rule-ha_local_to_dmz] service protocol udp destination-port 18514

[DeviceA-policy-security-rule-ha_local_to_dmz] action permit

[DeviceA-policy-security-rule-ha_local_to_dmz] quit

[DeviceA-policy-security] quit
#
[DeviceA] hrp interface ge 0/0/7 remote 10.10.0.2

[DeviceA] hrp authentication-key YsHsjx_202206

[DeviceA] hrp enable

#   DeviceB

<HUAWEI> system-view

[HUAWEI] sysname DeviceB

[DeviceB] interface ge 0/0/1

[DeviceB-GE0/0/1] ip address 10.2.0.2 24

[DeviceB-GE0/0/1] quit

[DeviceB] interface ge 0/0/3

DeviceB-GE0/0/3] ip address 10.3.0.2 24

[DeviceB-GE0/0/3] quit

[DeviceB] interface ge 0/0/7

[DeviceB-GE0/0/7] ip address 10.10.0.2 24

[DeviceB-GE0/0/7] quit

#

[DeviceB] firewall zone untrust

[DeviceB-zone-untrust] add interface ge 0/0/1

[DeviceB-zone-untrust] quit

[DeviceB] firewall zone trust

[DeviceB-zone-trust] add interface ge 0/0/3

[DeviceB-zone-trust] quit

[DeviceB] firewall zone dmz

[DeviceB-zone-dmz] add interface ge 0/0/7

[DeviceB-zone-dmz] quit
# [DeviceB] ip route-static 0.0.0.0 0.0.0.0 1.1.1.10
#
[DeviceB] interface ge 0/0/1

[DeviceB-GE0/0/1] vrrp vrid 1 virtual-ip 1.1.1.1 24 standby

[DeviceB-GE0/0/1] quit
[DeviceB] interface ge 0/0/3

[DeviceB-GE0/0/3] vrrp vrid 2 virtual-ip 10.3.0.3 standby

[DeviceB-GE0/0/3] quit

[DeviceB] security-policy

[DeviceB-policy-security] rule name ha_local_to_dmz

[DeviceB-policy-security-rule-ha_local_to_dmz] source-zone local dmz

[DeviceB-policy-security-rule-ha_local_to_dmz] destination-zone local dmz

[DeviceB-policy-security-rule-ha_local_to_dmz] service protocol udp destination-port 18514

[DeviceB-policy-security-rule-ha_local_to_dmz] action permit

[DeviceB-policy-security-rule-ha_local_to_dmz] quit

[DeviceB-policy-security] qui
[DeviceB] hrp interface ge 0/0/7 remote 10.10.0.1

[DeviceB] hrp authentication-key YsHsjx_202206

[DeviceB] hrp enable

HRP_M[DeviceA] security-policy

HRP_M[DeviceA-policy-security] rule name trust_to_untrust

HRP_M[DeviceA-policy-security-rule-trust_to_untrust] source-zone trust

HRP_M[DeviceA-policy-security-rule-trust_to_untrust] destination-zone untrust

HRP_M[DeviceA-policy-security-rule-trust_to_untrust] source-address 10.3.0.0 24

HRP_M[DeviceA-policy-security-rule-trust_to_untrust] action permit

HRP_M[DeviceA-policy-security-rule-trust_to_untrust] quit

HRP_M[DeviceA-policy-security] quit

HRP_M[DeviceA] nat address-group group1

HRP_M[DeviceA-address-group-group1] section 0 1.1.1.2 1.1.1.5

HRP_M[DeviceA-address-group-group1] quit

HRP_M[DeviceA] nat-policy

HRP_M[DeviceA-policy-nat] rule name policy_nat1

HRP_M[DeviceA-policy-nat-rule-policy_nat1] source-zone trust

HRP_M[DeviceA-policy-nat-rule-policy_nat1] destination-zone untrust

HRP_M[DeviceA-policy-nat-rule-policy_nat1] source-address 10.3.0.0 16

HRP_M[DeviceA-policy-nat-rule-policy_nat1] action source-nat address-group group1