ensp双机热备

双机热备实验

---

---

实验环境

---

实验思路

---

具体步骤

1.配置ip地址

PC1：

AR1：

[AR1]int g0/0/0

[AR1-GigabitEthernet0/0/0]ip add 200.1.1.3 24

[AR1]ip route-static 192.168.1.0 24 200.1.1.100

FW1：

[FW1]int g1/0/2

[FW1-GigabitEthernet1/0/2]ip add 200.1.1.1 24

[FW1-GigabitEthernet1/0/2]int g1/0/1

[FW1-GigabitEthernet1/0/1]ip add 12.1.1.1 24

[FW1-GigabitEthernet1/0/1]int g1/0/0

[FW1-GigabitEthernet1/0/0]ip add 192.168.1.1 24

FW2：

[FW2]int g1/0/2

[FW2-GigabitEthernet1/0/2]ip add 200.1.1.2 24

[FW2-GigabitEthernet1/0/2]int g1/0/1

[FW2-GigabitEthernet1/0/1]ip add 12.1.1.2 24

[FW2-GigabitEthernet1/0/1]int g1/0/0

[FW2-GigabitEthernet1/0/0]ip add 192.168.1.2 24

2.将接口划分到相应安全区域

FW1：

[FW1]firewall zone trust

[FW1-zone-trust]add int g1/0/0

[FW1-zone-trust]firewall zone untrust

[FW1-zone-untrust]add int g1/0/2

[FW1-zone-untrust]firewall zone dmz

[FW1-zone-dmz]add int g1/0/1

FW2：

[FW2]firewall zone  trust 

[FW2-zone-trust]add int g1/0/0

[FW2-zone-trust]firewall zone untrust

[FW2-zone-untrust]add int g1/0/2

[FW2-zone-untrust]firewall zone dmz

[FW2-zone-dmz]add int g1/0/1

3.创建VRRP备份组

FW1：

[FW1]int g1/0/0

[FW1-GigabitEthernet1/0/0]vrrp vrid 2 virtual-ip 192.168.1.100 active

[FW1-GigabitEthernet1/0/0]int g1/0/2

[FW1-GigabitEthernet1/0/2]vrrp vrid 1 virtual-ip 200.1.1.100 active

FW2：

[FW2]int g1/0/0

[FW2-GigabitEthernet1/0/0]vrrp vrid 2 virtual-ip 192.168.1.100 standby 

[FW2-GigabitEthernet1/0/0]int g1/0/2

[FW2-GigabitEthernet1/0/2]vrrp vrid 1 virtual-ip 200.1.1.100 standby 

4.配置HRP并开启

FW1：

[FW1]hrp interface g1/0/1 remote 12.1.1.2

[FW1]hrp enable

FW2：

[FW2]hrp int g1/0/1 remote 12.1.1.1

[FW2]hrp enable

5.进入Hrp配置安全策略

FW1：

HRP_M[FW1]security-policy  (+B)

HRP_M[FW1-policy-security]rule name t_u (+B)

HRP_M[FW1-policy-security-rule-t_u]source-zone trust (+B)

HRP_M[FW1-policy-security-rule-t_u]destination-zone untrust  (+B)

HRP_M[FW1-policy-security-rule-t_u]source-address 192.168.1.0 24 (+B)

HRP_M[FW1-policy-security-rule-t_u]service icmp (+B)

HRP_M[FW1-policy-security-rule-t_u]action permit  (+B)

6.测试

PC>ping 200.1.1.3 

Ping 200.1.1.3: 32 data bytes, Press Ctrl_C to break
 
From 200.1.1.3: bytes=32 seq=1 ttl=254 time=78 ms 
From 200.1.1.3: bytes=32 seq=2 ttl=254 time=63 ms 
From 200.1.1.3: bytes=32 seq=3 ttl=254 time=62 ms 
From 200.1.1.3: bytes=32 seq=4 ttl=254 time=78 ms 
From 200.1.1.3: bytes=32 seq=5 ttl=254 time=63 ms

 --- 200.1.1.3 ping statistics --- 
 5 packet(s) transmitted 
 5 packet(s) received 
 0.00% packet loss 
 round-trip min/avg/max = 62/68/78 ms

FW2无包，说明只使用FW1

7.关掉FW1的上行接口g1/0/1

关闭

[FW1]int g 1/0/0

[FW1-GigabitEthernet1/0/0]shutdown 

ping：

PC>ping 200.1.1.3 

Ping 200.1.1.3: 32 data bytes, Press Ctrl_C to break 

From 200.1.1.3: bytes=32 seq=2 ttl=254 time=47 ms
From 200.1.1.3: bytes=32 seq=2 ttl=254 time=47 ms 
From 200.1.1.3: bytes=32 seq=3 ttl=254 time=78 ms 
From 200.1.1.3: bytes=32 seq=4 ttl=254 time=62 ms 
From 200.1.1.3: bytes=32 seq=5 ttl=254 time=63 ms 

--- 200.1.1.1 ping statistics --- 
5 packet(s) transmitted 
5 packet(s) received 0.00% packet loss 
round-trip min/avg/max = 0/62/78 ms

查看VRRP：

HRP_S[FW2]di vrrp
2021-03-25 00:01:17.900 
  GigabitEthernet1/0/0 | Virtual Router 1
    State :  Master
    Virtual IP : 192.168.1.100
    Master IP : 192.168.1.1
    PriorityRun : 120
    PriorityConfig : 100
    MasterPriority : 100
    Preempt : YES   Delay Time : 0 s
    TimerRun : 60 s
    TimerConfig : 60 s
    Auth type : NONE
    Virtual MAC : 0000-5e00-0101
    Check TTL : YES
    Config type : vgmp-vrrp
    Backup-forward : disabled
    Create time : 2021-03-24 23:55:50
    Last change time : 2021-03-24 23:55:50

  GigabitEthernet1/0/2 | Virtual Router 2
    State :  Master
    Virtual IP : 200.1.1.100
    Master IP : 200.1.1.1
    PriorityRun : 120
    PriorityConfig : 100
    MasterPriority : 100
    Preempt : YES   Delay Time : 0 s
    TimerRun : 60 s
    TimerConfig : 60 s
    Auth type : NONE
    Virtual MAC : 0000-5e00-0102
    Check TTL : YES
    Config type : vgmp-vrrp
    Backup-forward : disabled
    Create time : 2021-03-24 23:53:47
    Last change time : 2021-03-24 23:53:47

此时FW2成为Master

打开FW1接口：

[FW1]int g1/0/0 

[FW1-GigabitEthernet1/0/0]undo shutdown 

HRP_M[FW1]

ping：

PC>ping 200.1.1.3 -t

Ping 200.1.1.3: 32 data bytes, Press Ctrl_C to break From 200.1.1.3: bytes=32 seq=1 ttl=254 time=62 ms 
From 200.1.1.3: bytes=32 seq=2 ttl=254 time=63 ms 
From 200.1.1.3: bytes=32 seq=3 ttl=254 time=62 ms 
From 200.1.1.3: bytes=32 seq=4 ttl=254 time=47 ms 
From 200.1.1.3: bytes=32 seq=5 ttl=254 time=47 ms 
From 200.1.1.3: bytes=32 seq=6 ttl=254 time=62 ms 
Request timeout! 
From 200.1.1.3: bytes=32 seq=97 ttl=254 time=62 ms 
From 200.1.1.3: bytes=32 seq=98 ttl=254 time=94 ms 

中途突然超时后又联通，说明转换成功

---

个人总结

双机热备技术是为了解决单点故障，使业务平滑过渡，VGMP协议和HRP协议用于保证主备防火墙的状态和路径保持一致而设定的协议，在防火墙上，所有的VRRP备份都会由一个VGMP组来集中管理，HRP报文即是主备防火墙用来沟通的报文，主墙通过心跳链路不断对备墙汇报自身状况，当HRP报文持续一段时间不发送，备墙就会把所有的VRRP都转换为Master。

---