华为 hrp vgmp 联动技术

最新推荐文章于 2024-05-05 01:48:28 发布
最新推荐文章于 2024-05-05 01:48:28 发布
阅读量785 收藏
点赞数 2
文章标签： 网络安全 Powered by 金山文档
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/weixin_44548030/article/details/129229445
版权

1 拓扑

2分析

  1. fw1 和fw2 作为主备 fw1 hrp为主，fw2 hrp 为备

  1. 用vgmp 和hrp 联动

  1. isp 用8.8.8.8

  1. lsw2 直接模拟pc 192.168.10.3 上外网8.8.8.8

3配置

1 fw1 上配置

HRP_M[fw1] display current-configuration

2023-02-26 10:32:11.090

!Software Version V500R005C10SPC300

#

sysname fw1

#

l2tp domain suffix-separator @

#

ipsec sha2 compatible enable

#

undo telnet server enable

undo telnet ipv6 server enable

#

hrp enable

hrp interface GigabitEthernet1/0/2 remote 1.1.1.2

hrp timer hello 500

hrp standby config enable

hrp preempt delay 5

hrp track interface GigabitEthernet1/0/0

hrp track interface GigabitEthernet1/0/1

#

update schedule location-sdb weekly Sun 03:24

#

firewall defend action discard

#

banner enable

#

user-manage web-authentication security port 8887

undo privacy-statement english

undo privacy-statement chinese

page-setting

user-manage security version tlsv1.1 tlsv1.2

password-policy

level high

user-manage single-sign-on ad

user-manage single-sign-on tsm

user-manage single-sign-on radius

user-manage auto-sync online-user

#

web-manager security version tlsv1.1 tlsv1.2

web-manager enable

web-manager security enable

#

firewall dataplane to manageplane application-apperceive default-action drop

#

undo ips log merge enable

#

decoding uri-cache disable

#

update schedule ips-sdb daily 23:41

update schedule av-sdb daily 23:41

update schedule sa-sdb daily 23:41

update schedule cnc daily 23:41

update schedule file-reputation daily 23:41

#

ip vpn-instance default

ipv4-family

#

time-range worktime

period-range 08:00:00 to 18:00:00 working-day

#

ike proposal default

encryption-algorithm aes-256 aes-192 aes-128

dh group14

authentication-algorithm sha2-512 sha2-384 sha2-256

authentication-method pre-share

integrity-algorithm hmac-sha2-256

prf hmac-sha2-256

#

aaa

authentication-scheme default

authentication-scheme admin_local

authentication-scheme admin_radius_local

authentication-scheme admin_hwtacacs_local

authentication-scheme admin_ad_local

authentication-scheme admin_ldap_local

authentication-scheme admin_radius

authentication-scheme admin_hwtacacs

authentication-scheme admin_ad

authorization-scheme default

accounting-scheme default

domain default

service-type internetaccess ssl-vpn l2tp ike

internet-access mode password

reference user current-domain

manager-user audit-admin

password cipher @%@%]xm9*o$.rLah^u%S0+*L>s7=0%yN#(}x911;9p"p`go,s7@>@%@%

service-type web terminal

level 15

manager-user api-admin

password cipher @%@%^qL'0Y^jhUC*~(=/Ua=%rLDa_G%rHt!;SHg-(71&QenPLDdr@%@%

level 15

manager-user admin

password cipher @%@%edE1=4'1$N`z^B~]nKgWrW#k,8CzS=dY52=_Wg"OGDr'W#nr@%@%

service-type web terminal

level 15

role system-admin

role device-admin

role device-admin(monitor)

role audit-admin

bind manager-user audit-admin role audit-admin

bind manager-user admin role system-admin

#

l2tp-group default-lns

#

interface GigabitEthernet0/0/0

undo shutdown

ip binding vpn-instance default

ip address 192.168.0.1 255.255.255.0

alias GE0/METH

#

interface GigabitEthernet1/0/0

undo shutdown

ip address 192.168.10.1 255.255.255.0

vrrp vrid 1 virtual-ip 192.168.10.254 active

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

#

interface GigabitEthernet1/0/1

undo shutdown

ip address 10.1.1.1 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

#

interface GigabitEthernet1/0/2

undo shutdown

ip address 1.1.1.1 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

#

interface GigabitEthernet1/0/3

undo shutdown

#

interface GigabitEthernet1/0/4

undo shutdown

#

interface GigabitEthernet1/0/5

undo shutdown

#

interface GigabitEthernet1/0/6

undo shutdown

#

interface Virtual-if0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet0/0/0

add interface GigabitEthernet1/0/0

#

firewall zone untrust

set priority 5

add interface GigabitEthernet1/0/1

#

firewall zone dmz

set priority 50

add interface GigabitEthernet1/0/2

#

ip route-static 0.0.0.0 0.0.0.0 10.1.1.2

#

undo ssh server compatible-ssh1x enable

ssh authentication-type default password

ssh server cipher aes256_ctr aes128_ctr

ssh server hmac sha2_256 sha1

ssh client cipher aes256_ctr aes128_ctr

ssh client hmac sha2_256 sha1

#

firewall detect ftp

#

user-interface con 0

authentication-mode aaa

user-interface vty 0 4

authentication-mode aaa

protocol inbound ssh

user-interface vty 16 20

#

pki realm default

#

sa

#

location

#

multi-linkif

mode proportion-of-weight

#

right-manager server-group

#

device-classification

device-group pc

device-group mobile-terminal

device-group undefined-group

#

user-manage server-sync tsm

#

security-policy

rule name hrp

source-zone dmz

source-zone local

destination-zone dmz

destination-zone local

source-address 1.1.1.0 mask 255.255.255.0

destination-address 1.1.1.0 mask 255.255.255.0

action permit

rule name vrrp

source-zone local

source-zone trust

destination-zone local

destination-zone trust

source-address 192.168.10.0 mask 255.255.255.0

destination-address 192.168.10.0 mask 255.255.255.0

action permit

rule name shangwang

source-zone trust

destination-zone untrust

source-address 192.168.10.0 mask 255.255.255.0

action permit

#

auth-policy

#

traffic-policy

#

policy-based-route

#

nat-policy

rule name wai

source-zone trust

destination-zone untrust

source-address 192.168.10.0 mask 255.255.255.0

action source-nat easy-ip

#

quota-policy

#

pcp-policy

#

dns-transparent-policy

#

rightm-policy

#

return

2 fw2

#

HRP_S<fw2>display current-configuration

2023-02-26 10:33:24.290

!Software Version V500R005C10SPC300

#

sysname fw2

#

l2tp domain suffix-separator @

#

ipsec sha2 compatible enable

#

undo telnet server enable

undo telnet ipv6 server enable

#

hrp enable

hrp standby-device

hrp interface GigabitEthernet1/0/2 remote 1.1.1.1

hrp timer hello 500

hrp standby config enable

hrp preempt delay 5

hrp track interface GigabitEthernet1/0/0

hrp track interface GigabitEthernet1/0/1

#

update schedule location-sdb weekly Sun 23:06

#

firewall defend action discard

#

banner enable

#

user-manage web-authentication security port 8887

undo privacy-statement english

undo privacy-statement chinese

page-setting

user-manage security version tlsv1.1 tlsv1.2

password-policy

level high

user-manage single-sign-on ad

user-manage single-sign-on tsm

user-manage single-sign-on radius

user-manage auto-sync online-user

#

web-manager security version tlsv1.1 tlsv1.2

web-manager enable

web-manager security enable

#

firewall dataplane to manageplane application-apperceive default-action drop

#

undo ips log merge enable

#

decoding uri-cache disable

#

update schedule ips-sdb daily 04:46

update schedule av-sdb daily 04:46

update schedule sa-sdb daily 04:46

update schedule cnc daily 04:46

update schedule file-reputation daily 04:46

#

ip vpn-instance default

ipv4-family

#

time-range worktime

period-range 08:00:00 to 18:00:00 working-day

#

ike proposal default

encryption-algorithm aes-256 aes-192 aes-128

dh group14

authentication-algorithm sha2-512 sha2-384 sha2-256

authentication-method pre-share

integrity-algorithm hmac-sha2-256

prf hmac-sha2-256

#

aaa

authentication-scheme default

authentication-scheme admin_local

authentication-scheme admin_radius_local

authentication-scheme admin_hwtacacs_local

authentication-scheme admin_ad_local

authentication-scheme admin_ldap_local

authentication-scheme admin_radius

authentication-scheme admin_hwtacacs

authentication-scheme admin_ad

authorization-scheme default

accounting-scheme default

domain default

service-type internetaccess ssl-vpn l2tp ike

internet-access mode password

reference user current-domain

manager-user audit-admin

password cipher @%@%r7XGANP;)Qe=ZMJV5-.6Vf|HbnAR<`bU(V|Mpc)FSzXYf|KV@%@%

service-type web terminal

level 15

manager-user api-admin

password cipher @%@%\Rl{.M)s_9Lam):=KvC.$FtC!bm&+|K}X5LLXHPF",JPFtF$@%@%

level 15

manager-user admin

password cipher @%@%Pw)KEC^aV/sZAH4k@BcJ]LcduBenS\arPU.^O2@m4X3,Lcg]@%@%

service-type web terminal

level 15

role system-admin

role device-admin

role device-admin(monitor)

role audit-admin

bind manager-user audit-admin role audit-admin

bind manager-user admin role system-admin

#

l2tp-group default-lns

#

interface GigabitEthernet0/0/0

undo shutdown

ip binding vpn-instance default

ip address 192.168.0.1 255.255.255.0

alias GE0/METH

#

interface GigabitEthernet1/0/0

undo shutdown

ip address 192.168.10.2 255.255.255.0

vrrp vrid 1 virtual-ip 192.168.10.254 standby

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

#

interface GigabitEthernet1/0/1

undo shutdown

ip address 11.1.1.1 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

#

interface GigabitEthernet1/0/2

undo shutdown

ip address 1.1.1.2 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

#

interface GigabitEthernet1/0/3

undo shutdown

#

interface GigabitEthernet1/0/4

undo shutdown

#

interface GigabitEthernet1/0/5

undo shutdown

#

interface GigabitEthernet1/0/6

undo shutdown

#

interface Virtual-if0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet0/0/0

add interface GigabitEthernet1/0/0

#

firewall zone untrust

set priority 5

add interface GigabitEthernet1/0/1

#

firewall zone dmz

set priority 50

add interface GigabitEthernet1/0/2

#

ip route-static 0.0.0.0 0.0.0.0 11.1.1.2

#

undo ssh server compatible-ssh1x enable

ssh authentication-type default password

ssh server cipher aes256_ctr aes128_ctr

ssh server hmac sha2_256 sha1

ssh client cipher aes256_ctr aes128_ctr

ssh client hmac sha2_256 sha1

#

firewall detect ftp

#

user-interface con 0

authentication-mode aaa

user-interface vty 0 4

authentication-mode aaa

protocol inbound ssh

user-interface vty 16 20

#

pki realm default

#

sa

#

location

#

multi-linkif

mode proportion-of-weight

#

right-manager server-group

#

device-classification

device-group pc

device-group mobile-terminal

device-group undefined-group

#

user-manage server-sync tsm

#

security-policy

rule name hrp

source-zone dmz

source-zone local

destination-zone dmz

destination-zone local

source-address 1.1.1.0 mask 255.255.255.0

destination-address 1.1.1.0 mask 255.255.255.0

action permit

rule name vrrp

source-zone local

source-zone trust

destination-zone local

destination-zone trust

source-address 192.168.10.0 mask 255.255.255.0

destination-address 192.168.10.0 mask 255.255.255.0

action permit

rule name shangwang

source-zone trust

destination-zone untrust

source-address 192.168.10.0 mask 255.255.255.0

action permit

#

auth-policy

#

traffic-policy

#

policy-based-route

#

nat-policy

rule name wai

source-zone trust

destination-zone untrust

source-address 192.168.10.0 mask 255.255.255.0

action source-nat easy-ip

#

quota-policy

#

pcp-policy

#

dns-transparent-policy

#

rightm-policy

#

return

4 细节讲解

  1. 首先配置防火墙的接口安全域

  1. 配置hrp 先保重hrp 主备正常因为下面的配置策略可以正常同步

  1. 注意防火墙的上下接口 左右一定要对称这是个细节

  1. nat 的时候一定是先放策略，后放nat 安全策略

  1. 验证

5总结

尤其是hrp 的配置

要进行上行链路侦测

查看相关信息

HRP_M<fw2>display firewall session table

2023-02-26 10:39:58.330

Current Total Sessions : 4

icmp VPN: public --> public 192.168.10.3:54443[11.1.1.1:2049] --> 8.8.8.8:204

8

udp VPN: public --> public 1.1.1.1:16384 --> 1.1.1.2:18514

udp VPN: public --> public 1.1.1.1:49152 --> 1.1.1.2:18514

udp VPN: public --> public 1.1.1.2:49152 --> 1.1.1.1:18514

HRP_M<fw2>display vrrp br

HRP_M<fw2>display vrrp brief

2023-02-26 10:40:20.850

Total:1 Master:1 Backup:0 Non-active:0

VRID State Interface Type Virtual IP

----------------------------------------------------------------

1 Master GE1/0/0 Vgmp 192.168.10.254

HRP_M<fw2>

HRP_M<fw2>

HRP_M<fw2>dis

HRP_M<fw2>display hr

HRP_M<fw2>display hrp sta

HRP_M<fw2>display hrp stat

HRP_M<fw2>display hrp state

2023-02-26 10:40:23.920

Role: active, peer: standby (should be "standby-active")

Running priority: 45000, peer: 44998

Backup channel usage: 0.00%

Stable time: 0 days, 0 hours, 0 minutes

Last state change information: 2023-02-26 10:39:35 HRP core state changed, old_

state = normal, new_state = abnormal(active), local_priority = 45000, peer_prior

ity = 44998.

认真学习，报效祖国
关注
  • 2
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
华为防火墙双机热备-VGMP
qq_32044265的博客
07-20 4781
VGMP协议是华为公司的私有协议。VGMP协议中定义了VGMP组，FW基于VGMP组实现设备主备状态管理。 每台FW都有一个VGMP组，用户不能删除这个VGMP组，也不能再创建其他的VGMP组。VGMP组有优先级和状态两个属性。VGMP组优先级决定了VGMP组的状态。 FW能根据VGMP组的状态调整VRRP备份组状态、动态路由（OSPF、OSPFv3和BGP）的开销值、VLAN的状态以及接口的状态（镜像模式），从而实现主备备份或负载分担模式的双机热备。.........
华为防火墙双机热备（VGMP+HRP）理论+实操！
CN_TangZheng的博客
02-14 6217
- 平常多个VRRP备份组会存在状态不一致的问题，于是华为防火墙引入了VGMP来实现对VRRP备份组的统一管理，保证多个VRRP备份组状态的一致性。 - VGMP（VRRP Group Management Protocol）组管理协议：由于双机热备导致设备出问题时可能会来回路径不一致，因此，我们将防火墙上的所有VRRP备份组都加入到一个VGMP组中，由VGMP组来集中监控并管理所有的VRRP备份组状态。如果有一个VRRP备份组有状态变化，则全部VRRP备份组进行状态切换，保证各VRRP备份组状态的一致性
2024年Web前端最全华为防火墙USG6000通过WEB图形界面配置案例(1)，真服了
最新发布
2401_84412357的博客
05-05 323
题外话，毕竟我工作多年，深知技术改革和创新的方向，Flutter作为跨平台开发技术、Flutter以其美观、快速、高效、开放等优势迅速俘获人心level high.1.1.2dh group14aaar(g+IYOVqbtq@%@%level 15level 15level 15est description 链路故障检测salocationmode patmode patdescription 外网访问FTP的安全策略nat-policypcp-policyreturn。
华为防火墙中的VGMP/VRRP/HRP
weixin_33851177的博客
10-21 1625
Vgmp VRRP Group Management Protocol由于双机热备导致设备出问题时可能会来回路径不一致，因为主备切换了配置VGMP保证一个组内的VRRP全为master，如果有一个不是，则全部切换至slaveHRP （ Huawei Redundancy Protocol）用于主设备出现问题时，备能快速切换至主，同时保证了主备之间的数据同步防火墙作双机热备...
任务十八：防火墙用户管理
2301_76274559的博客
12-20 892
掌握防火墙免认证用户和密码验证用户的配置过程。
华为设备远程登录配置
A soul tortured by desire
08-28 3734
sys telnet server enable undo telnet enable stelnet ipv4 server enable # aaa local-user 用户名 password irreversible-cipher XXXXXX local-user 用户名 privilege level 15 local-user 用户名 service-type telnet terminal ssh http # ssh user 用户名 ssh user 用户名 authentic.
华为防火墙技术漫谈
05-31
华为防火墙技术漫谈
华为HCIE-Security培训视频教程【共37集】.rar
09-09
12.华为防火墙基础技术－－ASPF技术（1） 13.华为防火墙基础技术－－ASPF技术（2） 14.华为防火墙基础技术－－源NAT（1） 15.华为防火墙基础技术－－源NAT（2） 16.华为防火墙基础技术－－源NAT（3） 17.华为...
华为HCIE-Security培训视频汇总集【共6期90集】.rar
09-15
华为安全HCIE-第三门-防火墙高级技术（17篇） 1_用户认证_用户_认证域_认证策略 2_用户认证_服务器认证方式_单点认证 3_用户认证_接入用户使用场景_本地认证实验 4_用户认证_服务器认证_不同的认证域配置 5_用户...
华为HCIP-Security培训视频教程【共34集】.rar
05-28
09. 3-1.VRRP_VGMP_HRP 10. 3-2.三层双机组网场景与引流分析 11. 3-3.双机热备实验 12. 3-4.双机负载_双机二层组网分析 13. 3-5.双机热备与NAT_双机升级 14. 4-1.智能选路技术 15. 4-2.策略路由_目的ISP选路 16. 4-3...
华为HCNA-Security培训视频教程【共35集】.rar
09-25
35-NAT地址池与VRRP绑定、HRP_Track监测三层业务接口 36-防火墙用户管理简介 37-Windows_2008上配置radius实现防火墙telnet认证 38-上网用户本地认证、radius认证配置 39-上网用户AD认证配置 40-上网用户AD单点...
防火墙双机热备各种场景备配置示例
热门推荐
曹世宏的博客
03-30 1万+
双机热备各场景应用 主备备份和负载分担应用场景： 主备备份和负载分担配置简介： 配置流程： 配置流程图： 三大配置原则： 在双机热备组网中，在配置其他业务之前必须在主备设备上先完成双机热备的所有配置，并保证双机状态正常。 在主备组网中，关键业务在主设备上完成配置即可，备用设备可以同步主设备的配置命令，建议割接前对比主备设备配置文件，保证双机配置一致。 在负载分担组网中，两个设备处于互为主备...
USG6000V 默认配置分析
習慣沉默的博客
03-02 2050
# 软件版本 !Software Version V500R005C10SPC300 # 设备名 sysname USG6000V1 # l2tp domain suffix-separator @ # ipsec sha2 compatible enable # undo telnet server enable undo telnet ipv6 server enable # c...
华为计算机网络--防火墙双机热备及其实验配置
爱学习的JackYang的博客
12-15 2707
华为网络 防火墙 双机热备
防火墙高可靠性
m0_48675050的博客
08-23 654
双机热备、BFD双向转发检测、IP-LINK链路检测、Link-Group逻辑组、ETH-Trunk链路捆绑、Bypass，跨数据中心集群，双主控、业务板备份、数据中心会话同步 双机热备 目的：为了防止单点故障 实现：两台硬件软件相同的FW之间通过一条独立的链路连接，这条链路通常被称之为“心跳线”。两台FW通过心跳线了解对端的健康状况，向对端备份配置和表项（如会话表、IPSec SA等）。当一台FW出现故障时，业务流量能平滑地切换到另一台设备上处理，使业务不中断。 关键技术：vrrp(虚拟路
3-防火墙高可靠性
qianlai22的博客
04-01 2589
1.IP-Link技术 IP-link定义 IP-Link是指FW通过向指定的目的IP周期性地发送探测报文并等待应答，来判断链路是否发生故障。 FW发送探测报文后，在三个探测周期（默认为15s）内未收到响应报文，则认为当前链路发生故障，IP-Link的状态变为Down。随后，FW会进行IP-Link Down相关的后续操作，例如双机热备主备切换等。 当链路从故障中恢复，FW能连续地收到3个响应报文，则认为链路故障已经消除，IP-Link的状态变为Up。也就是说，链路故障恢复后，IP-Link
HRP协议详解
永远是少年
07-30 1万+
今天继续给大家介绍HCIE安全系列相关内容。本文给大家介绍HRP协议的相关理论知识，包括概述、数据备份范围、数据备份方式、备份通道状态和备份通道选择五个方面。 一、HRP协议概述 HRP（Huawei Redundancy Protocol），华为冗余协议，主要用于实现防火墙双机之间动态状态数据和关键配置命令实时备份。 HRP协议功能的实现借助了HRP报文，而HRP报文实际上上是一种VGMP报文，承载在VGMP报文的Data区域。通常而言，HRP协议以VGMP心跳线作为备份通道传输备份数据和命令。 HRP存
华为交换机关闭Telnet、开启SSH服务命令
鹿鸣天涯
10-02 1万+
SecureCRT登录进去后，进入 system view 1.关闭Telnet undo telnet server enable 2.开启SSH stelnet server enable ssh user admin ssh user admin authentication-type password ssh user admin service-type all 3.配置aaa认证用户名和密码 aaa local-user admin password irreversib...
huawei USG防火墙子接口技术的应用案例
weixin_30631587的博客
08-03 1567
网络拓扑： 在中小企业的办公网络的设计中，通常为了安全考虑，需要将不同部门之间的互访的流量经过防火墙中转，同时结合vpn stance将业务进行隔离，在本例中，使用两台USG防火墙做HA作为整个办公网的接入防火墙，企业的互联网接入有电信和联通的两条专线进行接入。 设计要点： 1.两台USG防火墙互联的业务口使用子接口的方式进行互联 通常使用子接口的方式一方面可以节省设备的物理接口。另一...
华为防火墙VRRP双机热备配置及组网.pdf
09-04
华为防火墙VRRP双机热备配置及组网.pdf

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值