华为防火墙双机热备与IP-link联动

1.配置内网IP地址及其区域
[FW1-GigabitEthernet1/0/0]ip add 10.1.1.1 24
[FW1-GigabitEthernet1/0/0]service-manage ping permit
[FW1]firewall zone trust
[FW1-zone-trust]add interface g1/0/0
[FW1]ip route-static 0.0.0.0 0.0.0.0 10.1.3.3
[FW2-GigabitEthernet1/0/0]ip add 10.1.1.2 24
[FW2-GigabitEthernet1/0/0]service-manage ping permit
[FW2]firewall zone trust
[FW2-zone-trust]add interface g1/0/0
[FW2]ip route-static 0.0.0.0 0.0.0.0 10.1.4.4

2.配置外网IP地址及其连通性
[FW1-GigabitEthernet1/0/1]ip add 10.1.3.1 24
[FW1-GigabitEthernet1/0/1]service-manage ping permit
[FW1]firewall zone untrust
[FW1-zone-untrust]add interface g1/0/1
[FW2-GigabitEthernet1/0/2]ip add 10.1.4.2 24
[FW2-GigabitEthernet1/0/2]service-manage ping permit
[FW2]firewall zone untrust
[FW2-zone-untrust]add interface g1/0/2
[ISP1-GigabitEthernet0/0/0]ip add 10.1.3.3 24
[ISP1-GigabitEthernet0/0/1]ip add 10.1.5.3 24
[ISP2-GigabitEthernet0/0/0]ip add 10.1.4.4 24
[ISP2-GigabitEthernet0/0/1]ip add 10.1.5.4 24

[ISP1]ospf
[ISP1-ospf-1]area 0
[ISP1-ospf-1-area-0.0.0.0]network 10.1.2.0 0.0.0.255
[ISP1-ospf-1-area-0.0.0.0]network 10.1.5.0 0.0.0.255
[ISP2]ospf
[ISP2-ospf-1]area 0
[ISP2-ospf-1-area-0.0.0.0]network 10.1.4.0 0.0.0.255
[ISP2-ospf-1-area-0.0.0.0]network 10.1.5.0 0.0.0.255
[ISP1-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 10.1.5.254

[ISP2-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 10.1.5.254

3.配置DMZ IP及其区域
[FW1-GigabitEthernet1/0/3]ip add 10.1.2.1 24
[FW1]firewall zone dmz
[FW1-zone-dmz]add interface g1/0/3
[FW2-GigabitEthernet1/0/3]ip add 10.1.2.2 24
[FW2]firewall zone dmz
[FW2-zone-dmz]add interface g1/0/3
4.配置NAT策略easy-ip
[FW1]nat-policy
[FW1-policy-nat]rule name nat_isp1
[FW1-policy-nat-rule-nat_isp1]source-zone trust
[FW1-policy-nat-rule-nat_isp1]destination-zone untrust
[FW1-policy-nat-rule-nat_isp1]action source-nat easy-ip
[FW2]nat-policy
[FW2-policy-nat]rule name nat_isp2
[FW2-policy-nat-rule-nat_isp2]source-zone trust
[FW2-policy-nat-rule-nat_isp2]destination-zone untrust
[FW2-policy-nat-rule-nat_isp2]action source-nat easy-ip
5.配置IP-link
[FW1]ip-link check enable
[FW1]ip-link name ip_link1
[FW1-iplink-ip_link1]destination 10.1.3.3 interface g1/0/1 mode icmp
[FW2]ip-link check enable
[FW2]ip-link name ip_link2
[FW2-iplink-ip_link2]destination 10.1.4.4 interface g1/0/2 mode icmp
6.配置双机热备
[FW1-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.1.1.254 active
[FW1-GigabitEthernet1/0/0]vrrp virtual-mac enable
[FW2-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.1.1.254 standby
[FW2-GigabitEthernet1/0/0]vrrp virtual-mac enable
7.配置域间防火墙策略
[FW1]security-policy
[FW1-policy-security]rule name dmz_local
[FW1-policy-security-rule-dmz_local]source-zone dmz local
[FW1-policy-security-rule-dmz_local]destination-zone dmz local
[FW1-policy-security-rule-dmz_local]action permit
[FW1-policy-security]rule name trust_isp1
[FW1-policy-security-rule-trust_isp1]source-zone trust
[FW1-policy-security-rule-trust_isp1]destination-zone untrust
[FW1-policy-security-rule-trust_isp1]action permit
[FW1-policy-security]rule name ip_link
[FW1-policy-security-rule-ip_link]source-zone local
[FW1-policy-security-rule-ip_link]destination-zone untrust
[FW1-policy-security-rule-ip_link]service icmp
[FW1-policy-security-rule-ip_link]action permit

[FW2]security-policy
[FW2-policy-security]rule name dmz_local
[FW2-policy-security-rule-dmz_local]source-zone local dmz
[FW2-policy-security-rule-dmz_local]destination-zone local dmz
[FW2-policy-security-rule-dmz_local]action permit
[FW2-policy-security]rule name trust_isp2
[FW2-policy-security-rule-trust_isp2]source-zone trust
[FW2-policy-security-rule-trust_isp2]destination-zone untrust
[FW2-policy-security-rule-trust_isp2]action permit
[FW2-policy-security]rule name ip_link
[FW2-policy-security-rule-ip_link]source-zone local
[FW2-policy-security-rule-ip_link]destination-zone untrust
[FW2-policy-security-rule-ip_link]service icmp
[FW2-policy-security-rule-ip_link]action permit

8.配置IP-link与双机热备联动
[FW1]hrp enable
HRP_S[FW1]hrp interface g1/0/3 remote 10.1.2.2
HRP_S[FW1]hrp track interface g1/0/1
HRP_S[FW1]hrp track ip-link ip_link1
[FW2]hrp enable
HRP_S[FW2]hrp interface g1/0/3 remote 10.1.2.1
HRP_S[FW2]hrp track interface g1/0/2
HRP_S[FW2]hrp track ip-link ip_link2
9.验证
PC1 tracert PC2

关闭AR1上的g0/0/0接口后再PC1 tracert PC2，发现链路自动切换到ISP2上了