双机热备实验
文章目录
实验环境
实验思路
具体步骤
1.配置ip地址
PC1:
AR1:
[AR1]int g0/0/0
[AR1-GigabitEthernet0/0/0]ip add 200.1.1.3 24
[AR1]ip route-static 192.168.1.0 24 200.1.1.100
FW1:
[FW1]int g1/0/2
[FW1-GigabitEthernet1/0/2]ip add 200.1.1.1 24
[FW1-GigabitEthernet1/0/2]int g1/0/1
[FW1-GigabitEthernet1/0/1]ip add 12.1.1.1 24
[FW1-GigabitEthernet1/0/1]int g1/0/0
[FW1-GigabitEthernet1/0/0]ip add 192.168.1.1 24
FW2:
[FW2]int g1/0/2
[FW2-GigabitEthernet1/0/2]ip add 200.1.1.2 24
[FW2-GigabitEthernet1/0/2]int g1/0/1
[FW2-GigabitEthernet1/0/1]ip add 12.1.1.2 24
[FW2-GigabitEthernet1/0/1]int g1/0/0
[FW2-GigabitEthernet1/0/0]ip add 192.168.1.2 24
2.将接口划分到相应安全区域
FW1:
[FW1]firewall zone trust
[FW1-zone-trust]add int g1/0/0
[FW1-zone-trust]firewall zone untrust
[FW1-zone-untrust]add int g1/0/2
[FW1-zone-untrust]firewall zone dmz
[FW1-zone-dmz]add int g1/0/1
FW2:
[FW2]firewall zone trust
[FW2-zone-trust]add int g1/0/0
[FW2-zone-trust]firewall zone untrust
[FW2-zone-untrust]add int g1/0/2
[FW2-zone-untrust]firewall zone dmz
[FW2-zone-dmz]add int g1/0/1
3.创建VRRP备份组
FW1:
[FW1]int g1/0/0
[FW1-GigabitEthernet1/0/0]vrrp vrid 2 virtual-ip 192.168.1.100 active
[FW1-GigabitEthernet1/0/0]int g1/0/2
[FW1-GigabitEthernet1/0/2]vrrp vrid 1 virtual-ip 200.1.1.100 active
FW2:
[FW2]int g1/0/0
[FW2-GigabitEthernet1/0/0]vrrp vrid 2 virtual-ip 192.168.1.100 standby
[FW2-GigabitEthernet1/0/0]int g1/0/2
[FW2-GigabitEthernet1/0/2]vrrp vrid 1 virtual-ip 200.1.1.100 standby
4.配置HRP并开启
FW1:
[FW1]hrp interface g1/0/1 remote 12.1.1.2
[FW1]hrp enable
FW2:
[FW2]hrp int g1/0/1 remote 12.1.1.1
[FW2]hrp enable
5.进入Hrp配置安全策略
FW1:
HRP_M[FW1]security-policy (+B)
HRP_M[FW1-policy-security]rule name t_u (+B)
HRP_M[FW1-policy-security-rule-t_u]source-zone trust (+B)
HRP_M[FW1-policy-security-rule-t_u]destination-zone untrust (+B)
HRP_M[FW1-policy-security-rule-t_u]source-address 192.168.1.0 24 (+B)
HRP_M[FW1-policy-security-rule-t_u]service icmp (+B)
HRP_M[FW1-policy-security-rule-t_u]action permit (+B)
6.测试
PC>ping 200.1.1.3
Ping 200.1.1.3: 32 data bytes, Press Ctrl_C to break
From 200.1.1.3: bytes=32 seq=1 ttl=254 time=78 ms
From 200.1.1.3: bytes=32 seq=2 ttl=254 time=63 ms
From 200.1.1.3: bytes=32 seq=3 ttl=254 time=62 ms
From 200.1.1.3: bytes=32 seq=4 ttl=254 time=78 ms
From 200.1.1.3: bytes=32 seq=5 ttl=254 time=63 ms
--- 200.1.1.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 62/68/78 ms
FW2无包,说明只使用FW1
7.关掉FW1的上行接口g1/0/1
关闭
[FW1]int g 1/0/0
[FW1-GigabitEthernet1/0/0]shutdown
ping:
PC>ping 200.1.1.3
Ping 200.1.1.3: 32 data bytes, Press Ctrl_C to break
From 200.1.1.3: bytes=32 seq=2 ttl=254 time=47 ms
From 200.1.1.3: bytes=32 seq=2 ttl=254 time=47 ms
From 200.1.1.3: bytes=32 seq=3 ttl=254 time=78 ms
From 200.1.1.3: bytes=32 seq=4 ttl=254 time=62 ms
From 200.1.1.3: bytes=32 seq=5 ttl=254 time=63 ms
--- 200.1.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received 0.00% packet loss
round-trip min/avg/max = 0/62/78 ms
查看VRRP:
HRP_S[FW2]di vrrp
2021-03-25 00:01:17.900
GigabitEthernet1/0/0 | Virtual Router 1
State : Master
Virtual IP : 192.168.1.100
Master IP : 192.168.1.1
PriorityRun : 120
PriorityConfig : 100
MasterPriority : 100
Preempt : YES Delay Time : 0 s
TimerRun : 60 s
TimerConfig : 60 s
Auth type : NONE
Virtual MAC : 0000-5e00-0101
Check TTL : YES
Config type : vgmp-vrrp
Backup-forward : disabled
Create time : 2021-03-24 23:55:50
Last change time : 2021-03-24 23:55:50
GigabitEthernet1/0/2 | Virtual Router 2
State : Master
Virtual IP : 200.1.1.100
Master IP : 200.1.1.1
PriorityRun : 120
PriorityConfig : 100
MasterPriority : 100
Preempt : YES Delay Time : 0 s
TimerRun : 60 s
TimerConfig : 60 s
Auth type : NONE
Virtual MAC : 0000-5e00-0102
Check TTL : YES
Config type : vgmp-vrrp
Backup-forward : disabled
Create time : 2021-03-24 23:53:47
Last change time : 2021-03-24 23:53:47
此时FW2成为Master
打开FW1接口:
[FW1]int g1/0/0
[FW1-GigabitEthernet1/0/0]undo shutdown
HRP_M[FW1]
ping:
PC>ping 200.1.1.3 -t
Ping 200.1.1.3: 32 data bytes, Press Ctrl_C to break From 200.1.1.3: bytes=32 seq=1 ttl=254 time=62 ms
From 200.1.1.3: bytes=32 seq=2 ttl=254 time=63 ms
From 200.1.1.3: bytes=32 seq=3 ttl=254 time=62 ms
From 200.1.1.3: bytes=32 seq=4 ttl=254 time=47 ms
From 200.1.1.3: bytes=32 seq=5 ttl=254 time=47 ms
From 200.1.1.3: bytes=32 seq=6 ttl=254 time=62 ms
Request timeout!
From 200.1.1.3: bytes=32 seq=97 ttl=254 time=62 ms
From 200.1.1.3: bytes=32 seq=98 ttl=254 time=94 ms
中途突然超时后又联通,说明转换成功
个人总结
双机热备技术是为了解决单点故障,使业务平滑过渡,VGMP协议和HRP协议用于保证主备防火墙的状态和路径保持一致而设定的协议,在防火墙上,所有的VRRP备份都会由一个VGMP组来集中管理,HRP报文即是主备防火墙用来沟通的报文,主墙通过心跳链路不断对备墙汇报自身状况,当HRP报文持续一段时间不发送,备墙就会把所有的VRRP都转换为Master。