H3C防火墙RBM+context+VRRP组网配置
<H3C>dis blade-controller-team all ID: 1 Name: Default Slot CPU Status LBGroupID * 0 3 Normal 1 1 3 Normal 1 * : Primary blade controller of the team. Load balancing group information for the blade controller team: LBGroupID Name BLAGG 1 Bladespfeafw1 Blade-Aggregation257 # 本机当前只有两个有效的业务CPU资源：slot0 cpu3和slot1 cpu3，加入新组的过程会强制重启对应板卡
<H3C>dis blade-controller-team all ID: 1 Name: Default Slot CPU Status LBGroupID * 0 3 Normal 1 * : Primary blade controller of the team. Load balancing group information for the blade controller team: LBGroupID Name BLAGG 1 Bladespfeafw1 Blade-Aggregation257 ID: 2 Name: 1 Slot CPU Status LBGroupID * 1 3 Normal 2 * : Primary blade controller of the team. Load balancing group information for the blade controller team: LBGroupID Name BLAGG 2 Bladespfeafw2 Blade-Aggregation258
1、RBM主配置
# 1、配置引擎组，加入新组的过程会强制重启对应板卡，使用display blade-controller all命令查看机箱，槽位，CPU编号 blade-controller-team 1 id 2 location blade-controller slot 1 cpu 3 # 将1号槽位安全引擎板的第3颗CPU，划入本组 # 2、配置物理墙带外管理口 ip vpn-instance management route-distinguisher 1000000000:1 vpn-target 1000000000:1 import-extcommunity vpn-target 1000000000:1 export-extcommunity interface M-GigabitEthernet1/0/0/0 description 物理墙带外管理口 ip binding vpn-instance management ip address 55.35.1.232 255.255.255.0 # 3、配置虚墙带外管理口 ip vpn-instance mgt route-distinguisher 1000000000:2 vpn-target 1000000000:2 import-extcommunity vpn-target 1000000000:2 export-extcommunity interface Route-Aggregation1024 description mgt ip binding vpn-instance mgt interface Ten-GigabitEthernet2/1/5 port link-mode route description vfw_management port link-aggregation group 1024 # 4、配置互连接口 interface Route-Aggregation1023 description RBM_互连 ip address 1.1.1.1 255.255.255.252 link-aggregation mode dynamic interface Ten-GigabitEthernet1/1/19 port link-mode route description RBM_互连 port link-aggregation group 1023 interface Ten-GigabitEthernet1/1/20 port link-mode route description RBM_互连 port link-aggregation group 1023 # 5、track配置 track 1 interface Ten-GigabitEthernet1/1/5 physical track 2 interface Ten-GigabitEthernet1/1/6 physical track 3 interface Ten-GigabitEthernet1/1/7 physical track 4 interface Ten-GigabitEthernet1/1/8 physical # 6、配置RBM主备组 remote-backup group remote-ip 1.1.1.2 local-ip 1.1.1.1 delay-time 30 # 故障后等待30s再切换，防止链路抖动频繁切换 track 1 track 2 track 3 track 4 data-channel interface Route-Aggregation1023 # 热备数据通道：使用聚合接口Route-Aggregation100（三层聚合口）传输备份报文、会话表、配置同步 device-role primary # 设置本设备角色为主设备 undo backup-mode # 关闭兼容备份模式，启用标准hot-backup模式 hot-backup enable # 开启跨设备热备份（会话表、NAT表、ARP表等实时备份到备机） configuration auto-sync enable # 开启配置自动同步：主设备配置自动同步至备机 configuration sync-check interval 5 # 配置同步校验周期12分钟 # 7、配置上行接口 interface Route-Aggregation 2 description wan link-aggregation mode dynamic interface Ten-GigabitEthernet1/1/5 port link-mode route description wan port link-aggregation group 2 interface Ten-GigabitEthernet1/1/6 port link-mode route description wan port link-aggregation group 2 interface Route-Aggregation 2.500 vrrp vrid 1 virtual-ip 55.40.144.3 active ip address 55.40.144.1 255.255.255.248 vlan-type dot1q vid 500 # 8、配置下行接口 interface Route-Aggregation 3 description lan link-aggregation mode dynamic interface Ten-GigabitEthernet1/1/7 port link-mode route description lan port link-aggregation group 3 interface Ten-GigabitEthernet1/1/8 port link-mode route description lan port link-aggregation group 3 interface Route-Aggregation 3.501 vrrp vrid 1 virtual-ip 55.40.144.11 active ip address 55.40.144.9 255.255.255.248 vlan-type dot1q vid 501 # 9、将接口加入对应的安全域 security-zone name Untrust import interface Route-Aggregation 2.500 security-zone name Trust import interface Route-Aggregation 3.501 security-zone name Management import interface M-GigabitEthernet1/0/0/0 import interface Route-Aggregation1024 # 10、配置安全策略规则，允许VRRP协议报文通过。当HA通道断开时，使主备之间可以通过上行交换机透传VRRP报文，进行VRRP角色竞选，保证网络互通 security-policy ip rule 1 name vrrp1 action pass source-zone trust destination-zone local service vrrp rule 2 name vrrp2 action pass source-zone untrust destination-zone local service vrrp # 11、配置路由 ip route-static 0.0.0.0 0.0.0.0 55.40.144.4 ip route-static vpn-instance management 0.0.0.0 0 55.35.1.1 description management # 12、创建虚墙，将虚墙分配到不同的板卡 context test1 id 2 context start location blade-controller-team 1 # 将虚墙分配到引擎组，1是team id，不是组名称，1为默认组 allocate interface Route-Aggregation2 to Route-Aggregation3 share allocate interface Route-Aggregation1024 share context test2 id 3 context start location blade-controller-team 2 # 将虚墙分配到引擎组2，2是team id，不是组名称 allocate interface Route-Aggregation2 to Route-Aggregation3 share allocate interface Route-Aggregation1024 share # 13、配置context test1上行口，虚墙配置以test1为例(switchto context test1) interface Route-Aggregation2.1062 ip address 55.40.145.1 255.255.255.248 vrrp vrid 2 virtual-ip 55.40.145.3 255.255.255.248 active vlan-type dot1q vid 1062 # 14、配置context test1下行口 interface Route-Aggregation3.1068 ip address 55.40.145.9 255.255.255.248 vrrp vrid 3 virtual-ip 55.40.145.11 255.255.255.248 active vlan-type dot1q vid 1068 # 15、配置context test1带外管理口 ip vpn-instance mgt interface Route-Aggregation1024 ip binding vpn-instance mgt ip address 55.35.9.41 255.255.255.0 # 16、配置context test1默认路由 ip route-static 0.0.0.0 0 55.40.145.4 ip route-static vpn-instance mgt 0.0.0.0 0 55.35.9.1 description mgt # 17、配置context test1安全域 security-zone name Trust import interface Route-Aggregation3.1068 security-zone name Untrust import interface Route-Aggregation2.1062 security-zone name Management import interface Route-Aggregation1024 # 18、配置context test1安全策略 security-policy ip rule 0 name vrrp action pass service vrrp rule 1 name 1 action pass source-zone local source-zone Trust source-zone Untrust destination-zone local destination-zone Trust destination-zone Untrust
2、RBM备配置
# 1、配置引擎组，加入新组的过程会强制重启对应板卡，使用display blade-controller all命令查看机箱，槽位，CPU编号 blade-controller-team 1 id 2 location blade-controller slot 1 cpu 3 # 将1号槽位安全引擎板的第3颗CPU，划入本组 # 2、配置物理墙带外管理口 ip vpn-instance management route-distinguisher 1000000000:1 vpn-target 1000000000:1 import-extcommunity vpn-target 1000000000:1 export-extcommunity interface M-GigabitEthernet1/0/0/0 description 物理墙带外管理口 ip binding vpn-instance management ip address 55.35.1.233 255.255.255.0 # 3、配置虚墙带外管理口 ip vpn-instance mgt route-distinguisher 1000000000:2 vpn-target 1000000000:2 import-extcommunity vpn-target 1000000000:2 export-extcommunity interface Route-Aggregation1024 description mgt ip binding vpn-instance mgt interface Ten-GigabitEthernet2/1/5 port link-mode route description vfw_management port link-aggregation group 1024 # 4、配置互连接口 interface Route-Aggregation1023 description RBM_互连 ip address 1.1.1.2 255.255.255.252 link-aggregation mode dynamic interface Ten-GigabitEthernet1/1/19 port link-mode route description RBM_互连 port link-aggregation group 1023 interface Ten-GigabitEthernet1/1/20 port link-mode route description RBM_互连 port link-aggregation group 1023 # 5、track配置，physical：只看光/电物理状态；不看协议状态。如需同时监控协议状态，去掉physical关键字 track 1 interface Ten-GigabitEthernet1/1/5 physical track 2 interface Ten-GigabitEthernet1/1/6 physical track 3 interface Ten-GigabitEthernet1/1/7 physical track 4 interface Ten-GigabitEthernet1/1/8 physical # 6、配置RBM主备组 remote-backup group remote-ip 1.1.1.1 local-ip 1.1.1.2 delay-time 30 # 故障后等待30s再切换，防止链路抖动频繁切换 track 1 track 2 track 3 track 4 data-channel interface Route-Aggregation1023 # 热备数据通道：使用聚合接口Route-Aggregation100（三层聚合口）传输备份报文、会话表、配置同步 device-role secondary # 设置本设备角色为主设备 undo backup-mode # 关闭兼容备份模式，启用标准hot-backup模式 hot-backup enable # 开启跨设备热备份（会话表、NAT表、ARP表等实时备份到备机） configuration auto-sync enable # 开启配置自动同步：主设备配置自动同步至备机 configuration sync-check interval 5 # 配置同步校验周期12分钟 # 7、配置上行接口 interface Route-Aggregation 2 description wan link-aggregation mode dynamic interface Ten-GigabitEthernet1/1/5 port link-mode route description wan port link-aggregation group 2 interface Ten-GigabitEthernet1/1/6 port link-mode route description wan port link-aggregation group 2 interface Route-Aggregation 2.500 vrrp vrid 1 virtual-ip 55.40.144.3 standby ip address 55.40.144.2 255.255.255.248 vlan-type dot1q vid 500 # 8、配置下行接口 interface Route-Aggregation 3 description lan link-aggregation mode dynamic interface Ten-GigabitEthernet1/1/7 port link-mode route description lan port link-aggregation group 3 interface Ten-GigabitEthernet1/1/8 port link-mode route description lan port link-aggregation group 3 interface Route-Aggregation 3.501 vrrp vrid 1 virtual-ip 55.40.144.11 standby ip address 55.40.144.10 255.255.255.248 vlan-type dot1q vid 501 # 9、将接口加入对应的安全域 security-zone name Untrust import interface Route-Aggregation 2.500 security-zone name Trust import interface Route-Aggregation 3.501 security-zone name Management import interface M-GigabitEthernet1/0/0/0 import interface Route-Aggregation1024 # 10、配置安全策略规则，允许VRRP协议报文通过。当HA通道断开时，使主备之间可以通过上行交换机透传VRRP报文，进行VRRP角色竞选，保证网络互通 security-policy ip rule 1 name vrrp1 action pass source-zone trust destination-zone local service vrrp rule 2 name vrrp2 action pass source-zone untrust destination-zone local service vrrp # 11、配置默认路由 ip route-static 0.0.0.0 0.0.0.0 55.40.144.4 ip route-static vpn-instance management 0.0.0.0 0 55.35.1.1 description management # 12、创建虚墙，将虚墙分配到不同的板卡 context test1 id 2 context start location blade-controller-team 1 # 将虚墙分配到引擎组，1是team id，不是组名称，1为默认引擎组 allocate interface Route-Aggregation2 to Route-Aggregation3 share allocate interface Route-Aggregation1024 share context test2 id 3 context start location blade-controller-team 2 # 将虚墙分配到引擎组2，2是team id，不是组名称 allocate interface Route-Aggregation2 to Route-Aggregation3 share allocate interface Route-Aggregation1024 share # 13、配置context test1上行口，虚墙配置以test1为例(switchto context test1) interface Route-Aggregation2.1062 ip address 55.40.145.2 255.255.255.248 vrrp vrid 2 virtual-ip 55.40.145.3 255.255.255.248 standby vlan-type dot1q vid 1062 # 14、配置context test1下行口 interface Route-Aggregation3.1068 ip address 55.40.145.10 255.255.255.248 vrrp vrid 3 virtual-ip 55.40.145.11 255.255.255.248 standby vlan-type dot1q vid 1068 # 15、配置context test1带外管理口 ip vpn-instance mgt interface Route-Aggregation1024 ip binding vpn-instance mgt ip address 55.35.9.42 255.255.255.0 # 16、配置context test1默认路由 ip route-static 0.0.0.0 0 55.40.145.4 ip route-static vpn-instance mgt 0.0.0.0 0 55.35.9.1 description mgt # 17、配置context test1安全域 security-zone name Trust import interface Route-Aggregation3.1068 security-zone name Untrust import interface Route-Aggregation2.1062 security-zone name Management import interface Route-Aggregation1024 # 18、配置context test1安全策略 security-policy ip rule 0 name vrrp action pass service vrrp rule 1 name 1 action pass source-zone local source-zone Trust source-zone Untrust destination-zone local destination-zone Trust destination-zone Untrust
3、配置同步说明
display remote-backup-group status # 查看RBM整体状态，主备角色、通道状态、track状态 display remote-backup-group sync-check # 查看配置同步校验结果 display track all # 查看track条目状态（Positive/Negative） 会同步的配置 1、在主墙上创建的虚墙能同步到备墙 2、在主虚墙上创建的三层子接口能同步到备虚墙 不会同步的配置 1、虚墙名称配置不同步(hostname test-vfw) 2、主墙和虚墙接口IP配置不同步 3、主墙和虚墙snmp配置不同步 4、主墙和虚墙用户配置不同步 5、主墙和虚墙开启网页访问配置不同步(ip https enable) 6、主墙和虚墙开启ssh配置不同步(ssh server enable) 7、主墙和虚墙开启netconf配置不同步(netconf ssh server enable) 8、主墙和虚墙静态路由配置不同步
浙公网安备 33010602011771号