实验场景
传统的VRRP协议无法同步防火墙上的会话表项，当主节点故障时，数据包切换至备用线路后会找不到匹配的会话项从而导致会话中断。为了避免单点故障，在出口处配置防火墙的双机热备，实现在主防火墙故障时自动切换到备份防火墙
（即主防火墙的配置会同步到备份防火墙），以此确保网络的持续可用性和安全性。
配置思路
1.配置各接口IP；
2.将接口划分到对应的安全域内，在外网之间使用ospf动态路由；
3.在防火墙上配置vrrp-vgmp+hrp，实现防火墙的双机热备；
4.在主防火墙配置对应的安全策略以及NAT地址转换，实现内网用户访问INTERNET；
5.验证防火墙的主备切换
配置过程
为各接口配置IP
#AR3
interface GigabitEthernet0/0/0
ip address 100.1.1.2 255.255.255.252
#
interface GigabitEthernet0/0/1
ip address 100.101.1.1 255.255.255.252
#AR2
interface GigabitEthernet0/0/0
ip address 200.1.1.2 255.255.255.252
#
interface GigabitEthernet0/0/1
ip address 100.101.1.2 255.255.255.252
#FW1-MASTER
interface Vlanif10
ip address 10.1.1.251 255.255.255.0
vrrp vrid 10 virtual-ip 10.1.1.254 active
service-manage ping permit
#
interface Vlanif20
ip address 20.1.1.251 255.255.255.0
vrrp vrid 20 virtual-ip 20.1.1.254 active
service-manage ping permit
#
interface GigabitEthernet1/0/3
undo shutdown
ip address 100.1.1.1 255.255.255.252
service-manage ping permit
#
#FW2-SLAVE
interface Vlanif10
ip address 10.1.1.251 255.255.255.0
vrrp vrid 10 virtual-ip 10.1.1.254 standby
service-manage ping permit
#
interface Vlanif20
ip address 20.1.1.252 255.255.255.0
vrrp vrid 20 virtual-ip 20.1.1.254 standby
service-manage ping permit
#
l2tp-group default-lns
#
interface GigabitEthernet0/0/0
undo shutdown
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/0
undo shutdown
eth-trunk 1
#
interface GigabitEthernet1/0/1
portswitch
undo shutdown
port link-type trunk
port trunk allow-pass vlan 10 20
#
interface GigabitEthernet1/0/3
undo shutdown
ip address 200.1.1.1 255.255.255.252
service-manage ping permit
将接口划分到对应安全域内，配置ospf路由使外网互联互通
#FW1-MASTER
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/1
add interface Vlanif10
add interface Vlanif20
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/3
#
firewall zone dmz
set priority 50
add interface Eth-Trunk1
#
ospf 1
area 0.0.0.0
network 100.1.1.1 0.0.0.0
#FW2-SLAVE
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/1
add interface Vlanif10
add interface Vlanif20
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/3
#
firewall zone dmz
set priority 50
add interface Eth-Trunk1
#
ospf 1
area 0.0.0.0
network 200.1.1.1 0.0.0.0
#AR2
ospf 1 router-id 2.2.2.2
area 0.0.0.0
network 2.2.2.2 0.0.0.0
network 100.101.1.2 0.0.0.0
network 200.1.1.2 0.0.0.0
#AR3
ospf 1 router-id 3.3.3.3
area 0.0.0.0
network 3.3.3.3 0.0.0.0
network 100.1.1.2 0.0.0.0
network 100.101.1.1 0.0.0.0
测试外网之间的连通性
在防火墙上配置vrrp-vgmp和hrp，使两台防火墙之间为主备关系。
配置链路聚合，将两个物理端口在逻辑上聚合为一个端口，用于防火墙主备之间的心跳检测.
#FW1-MASTER
interface Eth-Trunk1
ip address 172.168.1.1 255.255.255.252
service-manage ping permit
#
interface GigabitEthernet1/0/0
eth-trunk 1
#
interface GigabitEthernet1/0/2
eth-trunk 1
#FW2-SLAVE
interface Eth-Trunk1
ip address 172.168.1.2 255.255.255.252
service-manage ping permit
#
interface GigabitEthernet1/0/0
eth-trunk 1
#
interface GigabitEthernet1/0/2
eth-trunk 1
配置vrrp-vgmp,使FW1和FW2之间为主备关系
#FW1-MASTER
interface Vlanif10
ip address 10.1.1.251 255.255.255.0
vrrp vrid 10 virtual-ip 10.1.1.254 active
service-manage ping permit
#
interface Vlanif20
ip address 20.1.1.252 255.255.255.0
vrrp vrid 20 virtual-ip 20.1.1.254 active
service-manage ping permit
#FW2-SLAVE
interface Vlanif10
ip address 10.1.1.251 255.255.255.0
vrrp vrid 10 virtual-ip 10.1.1.254 standby
service-manage ping permit
#
interface Vlanif20
ip address 20.1.1.252 255.255.255.0
vrrp vrid 20 virtual-ip 20.1.1.254 standby
service-manage ping permit
启用hrp，配置hrp监控接口与心跳检测接口
#FW1-MASTER
hrp enable
hrp interface Eth-Trunk1 remote 172.168.1.2
hrp track interface GigabitEthernet1/0/3
#FW2-SLAVE
hrp enable
hrp interface Eth-Trunk1 remote 172.168.1.1
hrp track interface GigabitEthernet1/0/3
此时我们等待片刻两个防火墙之间会自动选举Master与Backup,选举成功后如下图所示：设备命名也会发生变化
配置对应安全策略
此时只需要在Master防火墙配置策略即可，备份防火墙会自动同步Master设备配置的策略
#FW1-MASTER
security-policy
rule name locale
source-zone local
action permit
rule name Nei
source-zone trust
destination-zone local
action permit
rule name trust-untrust
source-zone trust
destination-zone untrust
action permit
#
nat-policy
rule name local-nat
destination-zone untrust
source-address 10.1.1.0 mask 255.255.255.0 description PC1
source-address 20.1.1.0 mask 255.255.255.0 description PC2
action source-nat easy-ip
配置完成后我们在FW-Slave查看策略，可以看到在Master配置的策略已经全部同步到备份节点上了。
验证内网用户访问INTERNET
PC1：
PC2:
抓包查看数据包，可以看到PC1和PC2访问INTERNET时是先通过NAT策略将源地址转换为Master防火墙的出口地址再发送出去的
故障切换测试
模拟
Master防火墙GE1/0/3接口故障，测试PC1与PC2访问外网
分别在MASTER和SLAVE的GE1/0/3接口开启抓包，查看切换过程
可以看到在丢了一个包后便快速切换至备份防火墙上了
此时在备份防火墙上查看vrrp-vgmp状态时可以看到已经变为Master了
往期推荐
原文始发于微信公众号（青菜浪人）：轻松实现防火墙双机热备配置
版权声明：本文内容由互联网用户自发贡献，该文观点仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 举报，一经查实，本站将立刻删除。
文章由极客之音整理，本文链接：https://www.bmabk.com/index.php/post/264850.html
