双机热备旁挂组网场景实验

原创 已于 2025-02-28 18:45:24 修改 · 564 阅读 · 8 ·
本内容遵循CC 4.0 BY-SA版权协议
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
GEO检测
于 2025-02-28 18:44:50 首次发布

一、实验拓扑

在这里插入图片描述

二、实验需求

需求：
1、SW3的流量
正常情况下：SW1_VRF-->FW1--->SW1_Public--->R5
故障情况下：SW2_VRF-->FW2--->SW2_Public--->R6
 2、SW4的流量
正常情况下：SW2_VRF-->FW2--->SW2_Public--->R6
故障情况下：SW1_VRF-->FW1--->SW1_Public--->R5
 3、交换网络负载均衡

三、实验配置

1.二层交换机配置

在这里插入图片描述

使用传统三层架构中MSTP+VRRP组网形式：
VLAN 2 ----> SW3,Sw4作为备份
VLAN 3 ----> SW4,SW3作为备份

MSTP设计---->SW3、4、5运行
	实例1：VLAN 2
	实例2：VLAN 3
		SW3是实例1的主根，实例2的备份根；
		SW4是实例2的主根，实例1的备份根；
vlan设备ipvlan虚拟ip
vlan2sw3192.168.2.1/24192.168.2.254/24
sw4192.168.2.2/24
vlan3sw3192.168.3.1/24192.168.3.254/24
sw4192.168.3.2/24

sw3配置：

[SW3]vlan batch 2 3
[SW3]interface GigabitEthernet 0/0/3
[SW3-GigabitEthernet0/0/3] port link-type trunk
[SW3-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 3
[SW3-GigabitEthernet0/0/3]interface GigabitEthernet 0/0/4
[SW3-GigabitEthernet0/0/4] port link-type trunk
[SW3-GigabitEthernet0/0/4] port trunk allow-pass vlan 2 to 3
[SW3-GigabitEthernet0/0/4]stp enable 
[SW3]stp mode mstp
[SW3]stp region-configuration 
[SW3-mst-region]region-name aa
[SW3-mst-region]instance 1 vlan 2 
[SW3-mst-region]instance 2 vlan 3 
[SW3-mst-region]active region-configuration 
[SW3]stp instance 1 root primary      
[SW3]stp instance 2 root secondary     
[SW3]stp instance 0 root primary  
[SW3]interface Vlanif 2
[SW3-Vlanif2]ip address 192.168.2.1 24
[SW3-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254     
[SW3-Vlanif2]vrrp vrid 1 priority 120    
[SW3-Vlanif2]vrrp vrid 1 preempt-mode timer delay 20   
[SW3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15    
[SW3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15
[SW3]interface Vlanif 3
[SW3-Vlanif3]ip add 192.168.3.1 24
[SW3-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254

sw4配置：

[SW4]vlan batch 2 3
[SW4]interface GigabitEthernet 0/0/3
[SW4-GigabitEthernet0/0/3] port link-type trunk
[SW4-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 3
[SW4-GigabitEthernet0/0/3]interface GigabitEthernet 0/0/4
[SW4-GigabitEthernet0/0/4] port link-type trunk
[SW4-GigabitEthernet0/0/4] port trunk allow-pass vlan 2 to 3
[SW4-GigabitEthernet0/0/4]stp enable 
[SW4]stp mode mstp
[SW4]stp region-configuration 
[SW4-mst-region]region-name aa
[SW4-mst-region]instance 1 vlan 2
[SW4-mst-region]instance 2 vlan 3
[SW4-mst-region]active region-configuration 
[SW4]stp instance 1 root secondary 
[SW4]stp instance 2 root primary
[SW4]stp instance 0 root secondary
[SW4]interface Vlanif 2
[SW4-Vlanif2]ip add 192.168.2.2 24
[SW4-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254
[SW4-Vlanif2]interface Vlanif3
[SW4-Vlanif3] ip address 192.168.3.2 255.255.255.0
[SW4-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254
[SW4-Vlanif3]vrrp vrid 1 priority 120
[SW4-Vlanif3] vrrp vrid 1 preempt-mode timer delay 20
[SW4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet0/0/1 reduced 15
[SW4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet0/0/2 reduced 15

sw5配置：

[SW5]vlan batch 2 3
[SW5]interface GigabitEthernet 0/0/3
[SW5-GigabitEthernet0/0/3]port link-type access 
[SW5-GigabitEthernet0/0/3]port default vlan 2
[SW5-GigabitEthernet0/0/3]interface GigabitEthernet 0/0/4
[SW5-GigabitEthernet0/0/4]port link-type access 	
[SW5-GigabitEthernet0/0/4]port default vlan 3
[SW5-GigabitEthernet0/0/4]interface GigabitEthernet 0/0/1
[SW5-GigabitEthernet0/0/1]port link-type trunk 
[SW5-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3
[SW5-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[SW5-GigabitEthernet0/0/2]port link-type trunk
[SW5-GigabitEthernet0/0/2]port trunk allow-pass vlan 2 to 3
[SW5]stp enable 
[SW5]stp mode mstp
[SW5]stp region-configuration 
[SW5-mst-region]region-name aa
[SW5-mst-region]instance 1 vlan 2
[SW5-mst-region]instance 2 vlan 3
[SW5-mst-region]active region-configuration

stp生成树与二层交换网络测试：
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

3.汇聚到核心层路由配置

在这里插入图片描述

连接设备区域vlan网段
sw1-sw210210.10.2.0/24
sw1-sw310310.10.3.0/24
sw1-sw410410.10.4.0/24
sw2-sw320310.20.3.0/24
sw2-sw420410.20.4.0/24

sw3配置：

[SW3]vlan batch 103 203
[SW3]interface GigabitEthernet 0/0/1
[SW3-GigabitEthernet0/0/1]port link-type access 
[SW3-GigabitEthernet0/0/1]port default vlan 103
[SW3-GigabitEthernet0/0/1]undo stp enable  
[SW3-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2	
[SW3-GigabitEthernet0/0/2]port link-type access 
[SW3-GigabitEthernet0/0/2]port default vlan 203
[SW3-GigabitEthernet0/0/2]undo stp enable
[SW3]interface Vlanif 103
[SW3-Vlanif103]ip add 10.10.3.3 24
[SW3]interface Vlanif 203
[SW3-Vlanif203]ip add 10.20.3.3 24
[SW3]ospf 1 router-id 3.3.3.3
[SW3-ospf-1]area 0
[SW3-ospf-1-area-0.0.0.0]network 10.10.3.3 0.0.0.0
[SW3-ospf-1-area-0.0.0.0]network 10.20.3.3 0.0.0.0
[SW3-ospf-1-area-0.0.0.0]network 192.168.2.1 0.0.0.0	
[SW3-ospf-1-area-0.0.0.0]network 192.168.3.1 0.0.0.0
[SW3-ospf-1]silent-interface Vlanif 2     
[SW3-ospf-1]silent-interface Vlanif 3

sw4配置：

[SW4]vlan batch 104 204
[SW4]interface GigabitEthernet 0/0/1
[SW4-GigabitEthernet0/0/1]port link-type access
[SW4-GigabitEthernet0/0/1]port default vlan 204
[SW4-GigabitEthernet0/0/1]undo stp enable
[SW4]interface GigabitEthernet 0/0/2
[SW4-GigabitEthernet0/0/2]port link-type access 
[SW4-GigabitEthernet0/0/2]port default vlan 104
[SW4-GigabitEthernet0/0/2]undo stp enable 
[SW4]interface Vlanif 104
[SW4-Vlanif104]ip address 10.10.4.4 24
[SW4]interface Vlanif 204
[SW4-Vlanif204]ip add 10.20.4.4 24
[SW4]ospf 1 router-id 4.4.4.4 
area 0.0.0.0
[SW4-ospf-1]network 10.10.4.4 0.0.0.0
[SW4-ospf-1-area-0.0.0.0]network 10.20.4.4 0.0.0.0
[SW4-ospf-1-area-0.0.0.0]network 192.168.2.2 0.0.0.0
[SW4-ospf-1-area-0.0.0.0]network 192.168.3.2 0.0.0.0
[SW4-ospf-1]silent-interface Vlanif 2
[SW4-ospf-1]silent-interface Vlanif 3

创建VRF空间并配置VRF信息：

​ 因为SW1和SW2需要被分割为两台设备，分别与上下行设备连接，故需要先创建VRF空间，其中GE0/0/2、5、6、7属于该空间接口。

VRRF空间配置信息：
	名称：VRF
	RD：100:1
	RT：100:1

[SW1]ip vpn-instance VRF  
[SW1-vpn-instance-VRF]route-distinguisher 100:1  
[SW1-vpn-instance-VRF-af-ipv4]vpn-target 100:1 both  
[SW2]ip vpn-instance VRF
[SW2-vpn-instance-VRF]route-distinguisher 100:1	
[SW2-vpn-instance-VRF-af-ipv4]vpn-target 100:1 both

vlan配置：
sw1：

[SW1]vlan batch 102 103 104
[SW1]interface GigabitEthernet 0/0/6
[SW1-GigabitEthernet0/0/6]port link-type access 
[SW1-GigabitEthernet0/0/6]port default vlan 103	
[SW1-GigabitEthernet0/0/6]undo stp enable
[SW1]interface GigabitEthernet 0/0/5
[SW1-GigabitEthernet0/0/5]port link-type trunk 
[SW1-GigabitEthernet0/0/5]undo port trunk allow-pass vlan 1
[SW1-GigabitEthernet0/0/5]port trunk allow-pass vlan 102
[SW1-GigabitEthernet0/0/5]undo stp enable
[SW1]interface GigabitEthernet 0/0/7
[SW1-GigabitEthernet0/0/7]port link-type access 
[SW1-GigabitEthernet0/0/7]port default vlan 104
[SW1-GigabitEthernet0/0/7]undo stp enable

sw2：

[SW2]vlan batch 102 203 204
[SW2]interface GigabitEthernet 0/0/6
[SW2-GigabitEthernet0/0/6]port link-type access 	
[SW2-GigabitEthernet0/0/6]port default vlan 204
[SW2-GigabitEthernet0/0/6]undo stp enable
[SW2]interface GigabitEthernet 0/0/7
[SW2-GigabitEthernet0/0/7]port link-type access 
[SW2-GigabitEthernet0/0/7]port default vlan 203
[SW2-GigabitEthernet0/0/7]undo stp enable 
[SW2]interface GigabitEthernet 0/0/5
[SW2-GigabitEthernet0/0/5]port link-type trunk 
[SW2-GigabitEthernet0/0/5]port trunk allow-pass vlan 102
[SW2-GigabitEthernet0/0/5]undo port trunk allow-pass vlan 1
[SW2-GigabitEthernet0/0/5]undo stp enable

创建vlanif接口，划入vrf并检测：

[SW1]interface Vlanif 102
[SW1-Vlanif102]ip binding vpn-instance VRF 
[SW1-Vlanif102]ip address 10.10.2.1 24
[SW1]interface Vlanif 103
[SW1-Vlanif103]ip binding vpn-instance VRF
[SW1-Vlanif103]ip add 10.10.3.1 24
[SW1]interface Vlanif 104
[SW1-Vlanif104]ip binding vpn-instance VRF
[SW1-Vlanif104]ip add 10.10.4.1 24

[SW2]interface Vlanif 102
[SW2-Vlanif102]ip binding vpn-instance VRF
[SW2-Vlanif102]ip address 10.10.2.2 24
[SW2]interface Vlanif 203
[SW2-Vlanif203]ip binding vpn-instance VRF
[SW2-Vlanif203]ip address 10.20.3.2 24
[SW2]interface Vlanif 204
[SW2-Vlanif204]ip binding vpn-instance VRF
[SW2-Vlanif204]ip add 10.20.4.2 24

配置vrf的ospf：

[SW1]ospf 1 router-id 1.1.1.1 vpn-instance VRF 
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 10.10.2.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.10.3.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.10.4.1 0.0.0.0
[SW1-ospf-1]default-route-advertise

[SW2]ospf 1 router-id 2.2.2.2 vpn-instance VRF	
[SW2-ospf-1]area 0
[SW2-ospf-1-area-0.0.0.0]network 10.10.2.2 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.20.3.2 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.20.4.2 0.0.0.0
[SW2-ospf-1]default-route-advertise


[SW2]ping -vpn-instance VRF 10.10.2.1
  PING 10.10.2.1: 56  data bytes, press CTRL_C to break
    Reply from 10.10.2.1: bytes=56 Sequence=1 ttl=255 time=83 ms
    Reply from 10.10.2.1: bytes=56 Sequence=2 ttl=255 time=32 ms
    Reply from 10.10.2.1: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 10.10.2.1: bytes=56 Sequence=4 ttl=255 time=50 ms
    Reply from 10.10.2.1: bytes=56 Sequence=5 ttl=255 time=55 ms

[SW2]ping -vpn-instance VRF 10.20.4.4
  PING 10.20.4.4: 56  data bytes, press CTRL_C to break
    Reply from 10.20.4.4: bytes=56 Sequence=1 ttl=255 time=72 ms
    Reply from 10.20.4.4: bytes=56 Sequence=2 ttl=255 time=52 ms
    Reply from 10.20.4.4: bytes=56 Sequence=3 ttl=255 time=30 ms
    Reply from 10.20.4.4: bytes=56 Sequence=4 ttl=255 time=40 ms
    Reply from 10.20.4.4: bytes=56 Sequence=5 ttl=255 time=45 ms

（这里一开始找了好多办法都没ping通，后来把sw4配置全重做了一遍通了）

ospf：

[SW1]ospf 1 router-id 1.1.1.1 vpn-instance VRF
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 10.10.2.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.10.3.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.10.4.1 0.0.0.0
[SW1-ospf-1]default-route-advertise

[SW2]ospf 1 router-id 2.2.2.2 vpn-instance VRF	
[SW2-ospf-1]area 0
[SW2-ospf-1-area-0.0.0.0]network 10.10.2.2 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.20.3.2 0.0.0.0
[SW2-ospf-1-area-0.0.0.0]network 10.20.4.2 0.0.0.0
[SW2-ospf-1]default-route-advertise

在这里插入图片描述
此时回程流量是等价路由，负载均衡，不符合来回路径一致要求。故需要进行路由干涉，使用路由策略。
sw3和sw4只需要修改接口Cost数值，让sw3优选从SW1学习到的路由，让sw4优先从sw2学习到的路由即可。

路由策略规划：
    sw3：
        主要流量发送给sw1，备份发给sw2
    sw4：
        主要流量发送给sw2，备份发给sw1
    sw1：
        192.168.2.0/24---->	主要流量发送给sw3，备份发给sw4
        192.168.3.0/24---->	主要流量发送给sw4，备份发给sw3
    sw2：
        192.168.2.0/24---->	主要流量发送给sw3，备份发给sw4
        192.168.3.0/24---->	主要流量发送给sw4，备份发给sw3


[SW3]interface Vlanif 203
[SW3-Vlanif203]ospf cost 5

[SW4]interface Vlanif 104
[SW4-Vlanif104]ospf cost 5

路由策略配置：

删除宣告的192.168.2.0/24和192.168.3.0/24网段信息，防止发生冲突：
[SW3-ospf-1-area-0.0.0.0]undo network 192.168.2.1 0.0.0.0
[SW3-ospf-1-area-0.0.0.0]undo network 192.168.3.1 0.0.0.0
[SW4-ospf-1-area-0.0.0.0]undo network 192.168.2.2 0.0.0.0
[SW4-ospf-1-area-0.0.0.0]undo network 192.168.3.2 0.0.0.0


sw3
	将sw3本地发送的192.168.3.0/24路由的开销值改大，192.168.2.0/24路由开销值不变。
	通过重发布调用路由策略：重发布时不要引入其他路由信息。
1、抓流量
[SW3]ip ip-prefix aa permit 192.168.2.0 24
[SW3]ip ip-prefix bb permit 192.168.3.0 24
2、做策略
[SW3]route-policy bb permit node 10
[SW3-route-policy]if-match ip-prefix bb
[SW3-route-policy]apply cost 5
[SW3]route-policy bb permit node 20
[SW3-route-policy]if-match ip-prefix aa
3、调用策略
[SW3]ospf 1	
[SW3-ospf-1]import-route direct route-policy bb

sw4
	将sw4本地发送的192.168.2.0/24路由的开销值改大，192.168.3.0/24路由开销值不变。
	通过重发布调用路由策略：重发布时不要引入其他路由信息。
1、抓流量
[SW4]ip ip-prefix aa permit 192.168.2.0 24
[SW4]ip ip-prefix bb permit 192.168.3.0 24
2、做策略
[SW4]route-policy aa permit node 10
[SW4-route-policy]if-match ip-prefix aa
[SW4-route-policy]apply cost 5
[SW4]route-policy aa permit node 20
[SW4-route-policy]if-match ip-prefix bb
3、调用策略
[SW4]ospf 1
[SW4-ospf-1]import-route direct route-policy aa

在这里插入图片描述

3.VRF交换机和防火墙的路由交互

在这里插入图片描述

FW1为主
VRRP备份组1---VRRP备份组5
 VRRP备份组3---VRRP备份组7
 FW2为主
VRRP备份组2---VRRP备份组6
 VRRP备份组4---VRRP备份组8
VRRP备份组Master角色Backuo角色vlan网段sw1-IPsw2-IP虚拟IP
备份组1sw1sw240110.40.1.0/2410.40.1.1/2410.40.1.2/2410.40.1.100/24VRF使用
备份组2sw2sw140210.40.2.0/2410.40.2.1/2410.40.2.2/2410.40.2.100/24VRF使用
备份组3sw1sw240310.40.3.0/2410.40.3.1/2410.40.3.2/2410.40.3.100/24Public使用
备份组4sw2sw140410.40.4.0/2410.40.4.1/2410.40.4.2/2410.40.4.100/24Public使用
备份组5FW1FW240110.40.1.0/2410.40.1.10/2410.40.1.20/2410.40.1.200/24防火墙使用
备份组6FW2FW140210.40.2.0/2410.40.2.10/2410.40.2.20/2410.40.2.200/24防火墙使用
备份组7FW1FW240310.40.3.0/2410.40.3.10/2410.40.3.20/2410.40.3.200/24防火墙使用
备份组8FW2FW140410.40.4.0/2410.40.4.10/2410.40.4.20/2410.40.4.200/24防火墙使用

VRF区域配置：
sw1：

[SW1]vlan batch 401 402
[SW1]interface GigabitEthernet 0/0/2
[SW1-GigabitEthernet0/0/2]port link-type trunk 	
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 401 402
[SW1-GigabitEthernet0/0/2]interface GigabitEthernet 0/0/5
[SW1-GigabitEthernet0/0/5]port link-type trunk 
[SW1-GigabitEthernet0/0/5]port trunk allow-pass vlan 401 402
[SW1]interface Vlanif 401
[SW1-Vlanif401]ip binding vpn-instance VRF
[SW1-Vlanif401]ip address 10.40.1.1 24
[SW1-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100
[SW1-Vlanif401]vrrp vrid 1 priority 120
[SW1-Vlanif401]vrrp vrid 1 preempt-mode timer delay 60
[SW1-Vlanif401]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 30
[SW1]interface Vlanif 402
[SW1-Vlanif402]ip binding vpn-instance VRF
[SW1-Vlanif402]ip address 10.40.2.1 24
[SW1-Vlanif402]vrrp vrid 2 virtual-ip 10.40.2.100

sw2：

[SW2]vlan batch 401 402
[SW2]interface GigabitEthernet 0/0/3
[SW2-GigabitEthernet0/0/3]port link-type trunk 
[SW2-GigabitEthernet0/0/3]port trunk allow-pass vlan 401 402
[SW2-GigabitEthernet0/0/3]interface GigabitEthernet 0/0/5
[SW2-GigabitEthernet0/0/5]port link-type trunk 
[SW2-GigabitEthernet0/0/5]port trunk allow-pass vlan 401 402
[SW2]interface Vlanif 401
[SW2-Vlanif401]ip binding vpn-instance VRF
[SW2-Vlanif401]ip address 10.40.1.2 24
[SW2-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100
[SW2]interface Vlanif 402
[SW2-Vlanif402]ip binding vpn-instance VRF
[SW2-Vlanif402]ip address 10.40.2.2 24
[SW2-Vlanif402]vrrp vrid 2 virtual-ip 10.40.2.100
[SW2-Vlanif402]vrrp vrid 2 priority 120
[SW2-Vlanif402]vrrp vrid 2 preempt-mode timer delay 60
[SW2-Vlanif402]vrrp vrid 2 track interface GigabitEthernet 0/0/3 reduced 30

FW1：

[FW1]vlan batch 401 402 403 404
[FW1]interface GigabitEthernet 1/0/0
[FW1-GigabitEthernet1/0/0]ip add 10.10.10.1 30
[FW1]interface GigabitEthernet 1/0/1.401
[FW1-GigabitEthernet1/0/1.401]ip add 10.40.1.10 24
[FW1-GigabitEthernet1/0/1.401]vlan-type dot1q 401
[FW1]interface GigabitEthernet 1/0/1.402
[FW1-GigabitEthernet1/0/1.402]ip address 10.40.2.10 24
[FW1-GigabitEthernet1/0/1.402]vlan-type dot1q 402
[FW1-GigabitEthernet1/0/1.402]interface GigabitEthernet 1/0/2.403
[FW1-GigabitEthernet1/0/2.403]ip address 10.40.3.10 24
[FW1-GigabitEthernet1/0/2.403]vlan-type dot1q 403
[FW1-GigabitEthernet1/0/2.403]interface GigabitEthernet 1/0/2.404
[FW1-GigabitEthernet1/0/2.404]ip add 10.40.4.10 24
[FW1-GigabitEthernet1/0/2.404]vlan-type dot1q 404

FW2：

[FW2]vlan batch 401 402 403 404
[FW2]interface GigabitEthernet 1/0/0
[FW2-GigabitEthernet1/0/0]ip add 10.10.10.2 30
[FW2]interface GigabitEthernet 1/0/2.401
[FW2-GigabitEthernet1/0/2.401]ip address 10.40.1.20 24
[FW2-GigabitEthernet1/0/2.401]vlan-type dot1q 401
[FW2-GigabitEthernet1/0/2.401]interface GigabitEthernet 1/0/2.402
[FW2-GigabitEthernet1/0/2.402]ip add 10.40.2.20 24
[FW2-GigabitEthernet1/0/2.402]vlan-type dot1q 402
[FW2-GigabitEthernet1/0/2.402]interface GigabitEthernet 1/0/1.403
[FW2-GigabitEthernet1/0/1.403]ip add 10.40.3.20 24
[FW2-GigabitEthernet1/0/1.403]vlan-type dot1q 403
[FW2-GigabitEthernet1/0/1.403]interface GigabitEthernet 1/0/1.404
[FW2-GigabitEthernet1/0/1.404]ip add 10.40.4.20 24
[FW2-GigabitEthernet1/0/1.404]vlan-type dot1q 404

安全区域划分
FW1：

[FW1]firewall zone trust 
[FW1-zone-trust]add interface GigabitEthernet 1/0/1.401
[FW1-zone-trust]add interface GigabitEthernet 1/0/1.402
[FW1]firewall zone untrust 
[FW1-zone-untrust]add interface GigabitEthernet 1/0/2.403
[FW1-zone-untrust]add interface GigabitEthernet 1/0/2.404
[FW1]firewall zone dmz 
[FW1-zone-dmz]add interface GigabitEthernet 1/0/0

FW2：

[FW2]firewall zone trust 
[FW2-zone-trust]add interface GigabitEthernet 1/0/2.401
[FW2-zone-trust]add interface GigabitEthernet 1/0/2.402
[FW2]firewall zone untrust 
[FW2-zone-untrust]add interface GigabitEthernet 1/0/1.403
[FW2-zone-untrust]add interface GigabitEthernet 1/0/1.404
[FW2]firewall zone dmz 
[FW2-zone-dmz]add interface GigabitEthernet 1/0/0

sw1、sw2的Public区域配置
sw1：

[SW1]vlan batch 403 404
[SW1]interface GigabitEthernet 0/0/3
[SW1-GigabitEthernet0/0/3]port link-type trunk 
[SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 403 404
[SW1-GigabitEthernet0/0/3]interface GigabitEthernet 0/0/4
[SW1-GigabitEthernet0/0/4]port link-type trunk 
[SW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 403 404
[SW1]interface Vlanif 403
[SW1-Vlanif403]ip address 10.40.3.1 24
[SW1-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100
[SW1-Vlanif403]vrrp vrid 3 priority 120
[SW1-Vlanif403]vrrp vrid 3 preempt-mode timer delay 60
[SW1-Vlanif403]vrrp vrid 3 track interface GigabitEthernet 0/0/3 reduced 30
[SW1]interface Vlanif 404
[SW1-Vlanif404]ip add 10.40.4.1 24
[SW1-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100

sw2：

[SW2]vlan batch 403 404
[SW2]interface GigabitEthernet 0/0/2
[SW2-GigabitEthernet0/0/2]port link-type trunk 
[SW2-GigabitEthernet0/0/2]port trunk allow-pass vlan 403 404
[SW2-GigabitEthernet0/0/2]interface GigabitEthernet 0/0/4
[SW2-GigabitEthernet0/0/4]port link-type trunk 
[SW2-GigabitEthernet0/0/4]port trunk allow-pass vlan 403 404
[SW2]interface  Vlanif 403
[SW2-Vlanif403]ip address 10.40.3.2 24
[SW2-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100
[SW2]interface Vlanif 404
[SW2-Vlanif404]ip address 10.40.4.2 24
[SW2-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100
[SW2-Vlanif404]vrrp vrid 4 priority 120
[SW2-Vlanif404]vrrp vrid 4 preempt-mode timer delay 60
[SW2-Vlanif404]vrrp vrid 4 track interface GigabitEthernet 0/0/2 reduced 30

路由配置：

[SW1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200
[SW1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 preference 70
[SW1]ip route-static 192.168.0.0 16 10.40.3.200
[SW1]ip route-static 192.168.0.0 16 10.40.4.200 preference 70

[SW2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200
[SW2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200 preference 70
[SW2]ip route-static 192.168.0.0 16 10.40.4.200	
[SW2]ip route-static 192.168.0.0 16 10.40.3.200 preference 70

4.防火墙双机热备配置

FW1：

下联VRF：
 [FW1]int g 1/0/2.401
 [FW1-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.1.200 active 
[FW1]interface GigabitEthernet 1/0/2.402
 [FW1-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.2.200 standby -上联Public：
 [FW1]interface GigabitEthernet 1/0/3.403
 [FW1-GigabitEthernet1/0/3.403]vrrp vrid 7 virtual-ip 10.40.3.200 active 
[FW1]int g 1/0/3.404
 [FW1-GigabitEthernet1/0/3.404]vrrp vrid 8 virtual-ip 10.40.4.200 standby 
[FW1]hrp mirror session enable 
[FW1]hrp interface GigabitEthernet 1/0/0 remote 10.10.10.2 
 [FW1]hrp enable

FW2：

下联VRF:
 [FW2]int g 1/0/2.401
 [FW2-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.1.200 standby 
[FW2]interface GigabitEthernet 1/0/2.402
 [FW2-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.2.200 active -上联Public:
 [FW2]interface GigabitEthernet 1/0/1.403
 [FW2-GigabitEthernet1/0/1.403]vrrp vrid 7 virtual-ip 10.40.3.200 standby 
[FW2]int g 1/0/1.404
 [FW2-GigabitEthernet1/0/1.404]vrrp vrid 8 virtual-ip 10.40.4.200 active 
[FW1]hrp mirror session enable 
[FW1]hrp interface GigabitEthernet 1/0/0 remote 10.10.10.2 1
 [FW1]hrp enable

路由配置：

HRP_S[FW1]ip route-static 0.0.0.0 0 10.40.3.100	
HRP_S[FW1]ip route-static 0.0.0.0 0 10.40.4.100 preference 70
HRP_M[FW1]ip route-static 192.168.0.0 16 10.40.1.100
HRP_M[FW1]ip route-static 192.168.0.0 16 10.40.2.100 preference 70

HRP_S[FW2]ip route-static 0.0.0.0 0 10.40.4.100
HRP_S[FW2]ip route-static 0.0.0.0 0 10.40.3.100 preference 70
HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.2.100
HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.1.100 preference 70

安全策略配置：

HRP_M[FW1]security-policy  (+B)
HRP_M[FW1-policy-security]rule name trust_to_untrust (+B)
HRP_M[FW1-policy-security-rule-trust_to_untrust]source-zone trust  (+B)
HRP_M[FW1-policy-security-rule-trust_to_untrust]destination-zone untrust  (+B)
HRP_M[FW1-policy-security-rule-trust_to_untrust]source-address 192.168.0.0 16 (+B)
HRP_M[FW1-policy-security-rule-trust_to_untrust]action permit  (+B)

5.核心到边界配置

在这里插入图片描述

SW1-SW2：VLAN 12 --- 10.12.1.0/24
SW1-R1：VLAN 11 ---- 10.11.1.0/24
SW2-R2：VLAN 22 ---- 10.22.2.0/24
R1-R2： 	    ---- 10.12.2.0/24

sw1：

[SW1]vlan batch 11 12
[SW1]interface GigabitEthernet 0/0/1
[SW1-GigabitEthernet0/0/1]port link-type access
[SW1-GigabitEthernet0/0/1]port default vlan 11
[SW1-GigabitEthernet0/0/1]undo stp enable 
[SW1-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/4
[SW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 12
[SW1-GigabitEthernet0/0/4]undo stp enable 
[SW1]interface Vlanif 11
[SW1-Vlanif11]ip address 10.11.1.1 24
[SW1]interface Vlanif 12
[SW1-Vlanif12]ip add 10.12.1.1 24
[SW1]ospf 2 router-id 1.1.1.1
[SW1-ospf-2]area 0
[SW1-ospf-2-area-0.0.0.0]network 10.11.1.1 0.0.0.0
[SW1-ospf-2-area-0.0.0.0]network 10.12.1.1 0.0.0.0

sw2：

[SW2]vlan batch 12 22
[SW2]interface GigabitEthernet 0/0/1
[SW2-GigabitEthernet0/0/1]port link-type access 
[SW2-GigabitEthernet0/0/1]port default vlan 22
[SW2-GigabitEthernet0/0/1]undo stp enable
[SW2-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/4
[SW2-GigabitEthernet0/0/4]port trunk allow-pass vlan 12
[SW2-GigabitEthernet0/0/4]undo stp enable 
[SW2]interface Vlanif 12
[SW2-Vlanif12]ip address 10.12.1.2 24
[SW2]interface Vlanif 22
[SW2-Vlanif22]ip address 10.22.2.1 2
[SW2-ospf-2]dis th
ospf 2 router-id 2.2.2.2
[SW2-ospf-2]area 0.0.0.0
[SW2-ospf-2-area-0.0.0.0]network 10.12.1.2 0.0.0.0
[SW2-ospf-2-area-0.0.0.0] network 10.22.2.1 0.0.0.0

R5:

[R5]interface GigabitEthernet 0/0/0
[R5-GigabitEthernet0/0/0]ip add 10.11.1.2 24
[R5-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[R5-GigabitEthernet0/0/1]ip address 10.12.2.1 24
[R5-ospf-1]display this 
ospf 1 router-id 3.3.3.3 
[R5-ospf-1]area 0.0.0.0 
[R5-ospf-1-area-0.0.0.0]network 10.11.1.2 0.0.0.0 
[R5-ospf-1-area-0.0.0.0]network 10.12.2.1 0.0.0.0

R6:

[R6]interface GigabitEthernet 0/0/0
[R6-GigabitEthernet0/0/0]ip add 10.22.2.2 24
[R6-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[R6-GigabitEthernet0/0/1]ip add 10.12.2.2 14
[R6]ospf 1 router-id 4.4.4.4
[R6-ospf-1]area 0
[R6-ospf-1-area-0.0.0.0]network 10.22.2.2 0.0.0.0
[R6-ospf-1-area-0.0.0.0]network 10.12.2.2 0.0.0.0

6.边界配置

在这里插入图片描述
R5：

[R5]interface GigabitEthernet 0/0/2
[R5-GigabitEthernet0/0/2]ip add 12.0.0.1 24
[R5]ip route-static 0.0.0.0 0 12.0.0.100
[R5-ospf-1]default-route-advertise      
[R5]acl 2000
[R5-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[R5]interface GigabitEthernet 0/0/2
[R5-GigabitEthernet0/0/2]nat outbound 2000

R6：

[R6]interface GigabitEthernet 0/0/2
[R6-GigabitEthernet0/0/2]ip add 13.0.0.1 24
[R6]ip route-static 0.0.0.0 0 13.0.0.100
[R6-ospf-1]default-route-advertise
[R6]acl 2000
[R6-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255
[R6]int g 0/0/2
[R6-GigabitEthernet0/0/2]nat outbound 2000

ISP：

[ISP]int g  0/0/0
[ISP-GigabitEthernet0/0/0]ip add 12.0.0.100 24
[ISP]int g  0/0/1
[ISP-GigabitEthernet0/0/1]ip add 13.0.0.100 24
[ISP]interface LoopBack 0
[ISP-LoopBack0]ip add 100.1.1.1 24

引入静态路由：

[SW1-ospf-2]import-route static 
[SW2-ospf-2]import-route static

四、试验检测

1.PC1和PC2分别pingISP的环回接口：

请添加图片描述

请添加图片描述

2.关闭SW1的某些接口后pingISP的环回接口：

[SW1-GigabitEthernet0/0/2]shutdown

请添加图片描述

（测试网络只存在一瞬间的丢弃，但网络并未断开）

标签
#防御保护 #安全
SLYRN9
关注
双机热备旁挂负载分担组网场景实验
2301_81731076的博客
08-18 858
SW3流量：正常：SW1---FW1---SW1---R5故障：SW2---FW2---SW2---R5SW4流量：正常：SW2---FW2---SW2---R5故障：SW1---FW1---SW1---R5交互网络负载均衡。
防御保护双机热备旁挂组网场景实验
m0_74765025的博客
03-09 218
当SW1的某些接口发生故障时，对PC1到ISP环回接口的网络进行测试。正常情况下，PC1和PC2分别pingISP的环回接口。创建Vlanif接口，并将接口划入VRF空间。SW1、SW2的Public区域配置。创建VRF空间并配置VRF信息。配置VRF空间的OSPF。
防御保护实验四：复现双机热备旁挂组网场景实验
2201_75408313的博客
02-28 276
网络基础配置：IP地址、安全区域、OSPF配置、安全策略(包括本地local的策略)当SW1的某些接口发生故障时，对PC1到ISP环回接口的网络进行测试。正常情况下，PC1和PC2分别pingISP的环回接口。创建Vlanif接口，并将接口划入VRF空间。SW1、SW2的Public区域配置。创建VRF空间并配置VRF信息。配置VRF空间的OSPF。
防火墙基础实验：双机热备下的旁挂负载分担组网场景
2403_83436016的博客
03-04 379
1、SW3的流量：正常情况下全部经过SW1---FW1---SW1---R1；故障情况下全部经过SW2---FW2---SW2---R2。2、SW4的流量：正常情况下全部经过SW2---FW2---SW2---R2；故障情况下全部经过SW1---FW1---SW1---R1。3、交换网络实现负载均衡。
旁挂负载分担组网场景 作业
shy1017的博客
03-02 996
作业
防火墙双机热备（旁挂负载分担组网）
Y13394995211的博客
02-05 203
华为手机地震预警全面升级，提前开启筑牢“安全防线”
最新发布
bineans的博客
07-01 290
2026年4月17日，华为正式完成全系手机终端设备接入中国地震预警网统一信息服务，成为行业首批实现“全机型、全系统版本”接入国家统一地震预警信息的科技企业。依托中国地震局的国家级权威数据，华为以硬核科技赋能应急防护，为亿万用户构建起“权威统一、稳定可靠、广域覆盖”的地震安全防线。此次事件中，华为手机向1711万用户成功推送预警消息，结合其他渠道，总覆盖人数超2000万，创下我国地震预警工程竣工以来单次事件手机触达人数之最，为用户争取避险黄金时间，守护每一个人。完成设置，即可享受国家级统一地震预警服务。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值