ensp双机热备实验

ensp双机热备实验

防火墙FW1
接口进行配置IP：

interface GigabitEthernet1/0/0
ip address 192.168.1.2 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/1
ip address 172.16.2.1 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/2
ip address 10.1.1.10 255.255.255.0
service-manage ping permit

接口分配区域

firewall zone trust
add interface GigabitEthernet1/0/0
quit
firewall zone untrust
add interface GigabitEthernet1/0/2

新建一个区域heartbeat存放心跳线的口

firewall zone name heartbeat id 4
set priority 80
add interface GigabitEthernet1/0/1
quit

防火墙FW2
接口进行配置IP：

interface GigabitEthernet1/0/0
ip address 192.168.1.3 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/1
ip address 172.16.2.2 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/2
ip address 192.168.2.3 255.255.255.0
service-manage ping permit
接口分配区域

firewall zone trust
add interface GigabitEthernet1/0/0
quit
firewall zone untrust
add interface GigabitEthernet1/0/2
quit
新建一个区域heartbeat存放心跳线的口

firewall zone name heartbeat id 4
set priority 80
add interface GigabitEthernet1/0/1
quit

基础配置完成
FW1（主设备）进行配置VRRP1：

interface GigabitEthernet1/0/0
vrrp vrid 1 virtual-ip 192.168.1.254 active

VRRP2的配置：
interface GigabitEthernet1/0/2
vrrp vrid 2 virtual-ip 192.168.2.254 active

FW2（备用设备）进行配置VRRP1：
interface GigabitEthernet1/0/0
vrrp vrid 1 virtual-ip 192.168.1.254 standby

VRRP2的配置：
interface GigabitEthernet1/0/2
vrrp vrid 2 virtual-ip 192.168.2.254 standby

VRRP配置完成。配置心跳口

FW1: hrp interface GigabitEthernet1/0/1 remote 192.168.3.2
FW2: hrp interface GigabitEthernet1/0/1 remote 192.168.3.1

两台设备都开启HRP：
hrp enable
hrp auto-sync

然后进行配置安全策略：关闭CLI之后再进入FW1，直接在FW1配置安全策略即可，命令后面的（+B）即表示会同步到备用设备上

HRP_M[FW1]security-policy (+B)
HRP_M[FW1-policy-security]rule name ping (+B)
HRP_M[FW1-policy-security-rule-ping]source-address 192.168.1.0 0.0.0.255 (+B)
HRP_M[FW1-policy-security-rule-ping]destination-address 10.1.1.0 0.0.0.255 (+B)
HRP_M[FW1-policy-security-rule-ping]service icmp (+B)
HRP_M[FW1-policy-security-rule-ping]action  permit  (+B)

关掉主设备（FW1）的一个口，再进行验证

HRP_M[FW1]interface GigabitEthernet 1/0/0 (+B) # 这个关闭端口的命令不会同步到备用设备，可以放心使用
HRP_M[FW1-GigabitEthernet1/0/0]shutdown
HRP_M[FW1-GigabitEthernet1/0/0]quit