配置防火墙双机热备

1.配置主备备份模式的双机热备

1.1 FW1为主机

将端口添加到FW1防火墙对应的区域
[FW1]firewall zone trust
[FW1-zone-trust]add int g1/0/0
[FW1]firewall zone untrust
[FW1-zone-untrust]add int g1/0/2
[FW1]firewall zone dmz
[FW1-zone-dmz]add int g1/0/1

配置FW1防火墙安全策略
[FW1]security-policy
[FW1-policy-security]rule name to_internet
[FW1-policy-security-rule-to_internet]source-zone local
[FW1-policy-security-rule-to_internet]source-zone trust
[FW1-policy-security-rule-to_internet]source-zone dmz
[FW1-policy-security-rule-to_internet]destination-zone any
[FW1-policy-security-rule-to_internet]action permit

配置FW1防火墙源NAT策略
[FW1]nat-policy
[FW1-policy-nat]rule name to_internet_nat
[FW1-policy-nat-rule-to_internet_nat]destination-zone untrust
[FW1-policy-nat-rule-to_internet_nat]act source-nat easy-ip

配置默认路由
[FW1]ip route-static 0.0.0.0 0 192.168.100.254

为接口配置虚拟IP地址
[FW1]int g1/0/0 #trust
[FW1-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 192.168.10.100 24 active
[FW1]int g1/0/2 #untrust
[FW1-GigabitEthernet1/0/2]vrrp vrid 2 virtual-ip 192.168.100.100 24 active

配置心跳线路，remote地址为另一台防火墙的心跳线路地址
[FW1]hrp int g1/0/1 remote 192.168.1.2

配置FW1防火墙启用hrp并查看其状态
[FW1]hrp enable
HRP_S[FW1]display vrrp #查看vrrp状态
HRP_S[FW1]dis hrp state #查看hrp状态

1.2 FW2为备份机

将端口添加到FW2防火墙对应的区域
[FW2]firewall zone trust
[FW2-zone-trust]add int g1/0/0
[FW2]firewall zone untrust
[FW2-zone-untrust]add int g1/0/2
[FW2]firewall zone dmz
[FW2-zone-dmz]add int g1/0/1

配置FW2防火墙安全策略
[FW2]security-policy
[FW2-policy-security]rule name to_internet
[FW2-policy-security-rule-to_internet]source-zone local
[FW2-policy-security-rule-to_internet]source-zone trust
[FW2-policy-security-rule-to_internet]source-zone dmz
[FW2-policy-security-rule-to_internet]destination-zone any
[FW2-policy-security-rule-to_internet]action permit

配置FW2防火墙源NAT策略
[FW2]nat-policy
[FW2-policy-nat]rule name to_internet_nat
[FW2-policy-nat-rule-to_internet_nat]destination-zone untrust
[FW2-policy-nat-rule-to_internet_nat]act source-nat easy-ip

配置默认路由
[FW2]ip route-static 0.0.0.0 0 192.168.100.254

为接口配置虚拟IP地址
[FW2]int g1/0/0
[FW2-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 192.168.10.100 24 standby
[FW2]int g1/0/2
[FW2-GigabitEthernet1/0/2]vrrp vrid 2 virtual-ip 192.168.100.100 24 standby

配置心跳线路，remote地址为另一台防火墙的心跳线路地址
[FW2]hrp int g1/0/1 remote 192.168.1.1

配置FW2防火墙为standby设备
[FW2]hrp standby-device

配置FW2防火墙启用hrp并查看其状态
[FW2]hrp enable
HRP_S[FW2]dis vrrp
HRP_S[FW2]dis hrp state

---

2.配置负载分担模式的双机热备（在主备备份配置的基础上进行调整）

在FW1和FW2上允许https协议通过
FW1
[FW1]int g1/0/0
[FW1-GigabitEthernet1/0/0]service-manage https permit
[FW1]int g1/0/2
[FW1-GigabitEthernet1/0/2]service-manage https permit
FW2
[FW2]int g1/0/0
[FW2-GigabitEthernet1/0/0]service-manage https permit
[FW2]int g1/0/2
[FW2-GigabitEthernet1/0/2]service-manage https permit

在FW1和FW2上配置负载分担模式
FW1
HRP_M[FW1]hrp load balance device #配置负载分担模式
FW2
HRP_S[FW2]undo hrp standby-device
HRP_S[FW2]hrp load balance device #配置负载分担模式

查看防火墙会话列表
dis firewall session table