华为防火墙双机热备实验

拓扑

说明

1. 防火墙的G1/0/0口接外网，开启easy-ip NAT转发

   1. 虚拟ip为192.168.1.200/24

2. 防火墙的G1/0/1口接内网

   1. 虚拟IP为172.16.1.200/24

3. 防火墙G1/0/6用作hrp心跳线，区域为DMZ区域

配置

FW1(主)

# G1/0/0
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 192.168.1.254 255.255.255.0
 vrrp vrid 1 virtual-ip 192.168.1.200 active
#G1/0/1
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 172.16.1.254 255.255.255.0
 vrrp vrid 2 virtual-ip 172.16.1.200 active
#安全策略
security-policy
#开放trust到untrust
 rule name PC1_PC2
  source-zone trust
  destination-zone untrust
  action permit
#开放dmz和local互通
#nat的地址是local区域
#心跳线的ip是dmz区域
 rule name local_dmz
  source-zone dmz
  source-zone local
  destination-zone dmz
  destination-zone local
  action permit
#hrp配置
 hrp enable
 #hrp心跳从G1/0/6口发送都对端10.10.10.2的地址
 hrp interface GigabitEthernet1/0/6 remote 10.10.10.2

FW2（备）

# G1/0/0
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 192.168.1.253 255.255.255.0
 vrrp vrid 1 virtual-ip 192.168.1.200 standby
#G1/0/1
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 172.16.1.253 255.255.255.0
 vrrp vrid 2 virtual-ip 172.16.1.200 standby
#安全策略
security-policy
#开放trust到untrust
 rule name PC1_PC2
  source-zone trust
  destination-zone untrust
  action permit
#开放dmz和local互通
#nat的地址是local区域
#心跳线的ip是dmz区域
 rule name local_dmz
  source-zone dmz
  source-zone local
  destination-zone dmz
  destination-zone local
  action permit
#hrp配置
 hrp enable
 #hrp心跳从G1/0/6口发送都对端10.10.10.1的地址
 hrp interface GigabitEthernet1/0/6 remote 10.10.10.1

验证

hrp心跳会话表

PC1 ping PC2 会话表

断开主防火墙线路，备防火墙自动抢占

• PC1 ping PC2 中途断开主防火墙的线路，备防火墙自动抢占为主模式，接管流量；
• 中途PC1出现一次丢包后恢复正常通信。