2021-04-28

1.1
FW1/FW2
firewall zone dmz
add interface g1/0/0
firewall zone trust
add interface g1/0/1
firewall zone name dmz1
set priority 45
add interface g1/0/2
firewall zone name dmz2
set priority 40
add interface g1/0/5
firewall zone name isp1
set priority 15
add interface g1/0/3
firewall zone name isp2
set priority 10
add interface g1/0/4
1.2
vsys enable
vsys name vfw1
assign interface g1/0/2
assign resource-class r0
vsys name vfw2
assign interface g1/0/1
assign resource-class r0
firewall zone trust
add interface virtual-if 0
firewall zone untrust
add interface g1/0/0
ip route-static 0.0.0.0 0 10.1.70.2
ip route-static 10.1.23.0 24 vpn-instance vfw1
ip route-static 10.1.22.0 24 vpn-instance vfw2
security-policy
rule name internet
source-zone trust
destination-zone untrust
source-address 10.1.23.0 24
action permit
switch vsys vfw1
sys
interface g1/0/2
ip address 10.1.23.23 24
firewall zone untrust
add interface virtual-if1
firewall zone trust
add interface g1/0/2
security-policy
rule name pc3_internet
source-zone trust
destination-zone untrust
source-address 10.1.23.0 24
action permit
ip route-static 0.0.0.0 0 public
switch vsys vfw2
sys
instance g1/0/1
ip address 10.1.22.32 24
firewall zone untrust
add interface virtual-if2
firewall zone trust
add interface g1/0/1
ip route-static 0.0.0.0 0 public
1.3
FW1
hrp interface g1/0/5 remote 10.1.8.22
hrp track interface g1/0/2
interface g1/0/0
vrrp vrid 1 virtual-ip 10.1.5.254 active
vrrp virtual-mac enable
link-group 1
interface g1/0/1
link-group 1
interface g1/0/2
link-group 1
interface g1/0/3
vrrp vrid 2 virtual-ip 10.1.9.254 active
vrrp virtual-mac enable
link-group 1
interface g1/0/4
vrrp vrid 3 virtual-ip 10.1.10.254 active
link-group 1
hrp preempt delay 60
hrp enable
ip-link check enable
ip-link name isp1
destination 10.1.40.11 interface g1/0/3 mode icmp next-hop 10.1.9.11
hrp track ip-link isp1
ip route-static 0.0.0.0 0 10.1.9.11
ip route-static 0.0.0.0 0 10.1.10.12 preference 100
security-policy
source-zone local
destination-zone isp1
destination-address 10.1.9.11 32
action permit
rule name ospf
service ospf
action permit
undo firewall packet-filter basic-protocol enable

FW2
hrp standby-device
hrp interface g1/0/5 remote 10.1.8.21
hrp t