H3C虚拟网关（VRRP）配置实战

​VRRP简介

 

VRRP用来为网关设备提供冗余备份。VRRP将可以承担网关功能的一组设备加入到备份组中，形成一台虚拟路由器，局域网内的主机将此虚拟路由器设置为缺省网关。VRRP根据优先级从备份组中选举出一台网关设备作为Master，负责转发局域网内主机与外部通信的流量，其他网关设备作为Backup。当Master出现故障后，VRRP重新选举新的Master，保证流量转发不会中断。

实验拓扑

 

配置需求

 

1.在 FW1 和 FW2 上配置 VRRP，要求FW1 成为 Vlan10 的主网关，FW2 成为 Vlan20 的主网关；SW1 和 SW2 互为备份。

2.SW1 和 SW2 对上行接口进行监视，如上行接口故障，会触发 VRRP 角色切换。

 

注意事项

 

1.要对虚拟网关设备的上行接口进行监视，当上行设备故障时，会自动降低主设备vrrp的优先级，自动触发角色切换。否则上行链路故障时，vrrp角色不能切换，导致不能访问互联网。

2.为了提高设备利用率，减轻主网关设备的压力，建议针对不同网段，将其主网关均匀分摊在两台vrrp设备上。如本配置中，vlan 10的主网关设备是FW1,vlan 20的主网关设备是FW2。

 

配置步骤

 

1.配置 IP 地址部分略。

2.配置 Vlan 和 Trunk 部分略。

3.在 FW1 的 Vlan10 上配置 VRRP，虚拟 IP 地址为 192.168.10.254/24，优先级为 120，在 Vlan20 上配置 VRRP，虚拟 IP 地址为 192.168.2.254/24，优先级不修改，保持默认值 100。

[FW1]interface Vlan-interface 10
[FW1-Vlan-interface10]vrrp vrid 1 virtual-ip 192.168.1.254
[FW1-Vlan-interface10]vrrp vrid 1 priority 120
[FW1]int Vlan-interface 20
[FW1-Vlan-interface20]vrrp vrid 2 virtual-ip 192.168.2.254

 

4.在 FW2 的 Vlan10 上配置 VRRP，虚拟 IP 地址为 192.168.10.254/24，优先级保持默认值100，在 Vlan20 上配置 VRRP，虚拟 IP 地址为 192.168.2.254/24，优先级修改为 120。

[FW1]interface Vlan-interface 10
[FW1-Vlan-interface10]vrrp vrid 1 virtual-ip 192.168.1.254
[FW1]int Vlan-interface 20
[FW1-Vlan-interface20]vrrp vrid 2 virtual-ip 192.168.2.254
[FW1-Vlan-interface20]vrrp vrid 2 priority 12

5.vrrp配置完成，检查vrrp配置。

[FW1]dis vrrp 
IPv4 Virtual Router Information:  
 Running mode      : Standard
 Total number of virtual routers : 2
 Interface          VRID  State        Running Adver   Auth     Virtual
                                       Pri     Timer   Type        IP
 ---------------------------------------------------------------------
 Vlan10             1     Master       120     100     None     192.168.1.254   
 Vlan20             2     Backup       100     100     None     192.168.2.254

[FW2]dis vrrp
IPv4 Virtual Router Information:  
 Running mode      : Standard
 Total number of virtual routers : 2
 Interface          VRID  State        Running Adver   Auth     Virtual
                                       Pri     Timer   Type        IP
 ---------------------------------------------------------------------
 Vlan10             1     Backup       100     100     None     192.168.1.254   
 Vlan20             2     Master       120     100     None     192.168.2.254

6.配置上行接口监视，使主vrrp上行链路故障时，可以触发vrrp角色可以切换到备设备上。

7.在 FW1 上配置接口监视，监视上行接口 GigabitEthernet1/0/0，并在 Vlan10 接口中调用，优先级降低 30。

[FW1]track 1 interface GigabitEthernet1/0/0
[FW1]int Vlan-interface 10
[FW1-Vlan-interface10]vrrp vrid 1 track 1 priority reduced 30

7.在 FW2 上配置接口监视，监视上行接口 GigabitEthernet1/0/1，并在 Vlan20 接口中调用，优先级降低 30。

[FW2]track 1 interface GigabitEthernet1/0/1
[FW2]int Vlan-interface 20
[FW2-Vlan-interface10]vrrp vrid 2 track 1 priority reduced 30

 

 

配置验证

 

正常情况下财务部访问模拟百度服务器地址的路径为PC1→SW→FW1→R1→百度服务器

[PC1]tracert 1.1.1.2
 1  192.168.1.252 (192.168.1.252)  1.000 ms  0.000 ms  1.000 ms
 2  100.1.1.2 (100.1.1.2)  1.000 ms  0.000 ms  0.000 ms
 3  1.1.1.2 (1.1.1.2)  2.000 ms  1.000 ms  1.000 ms

[PC1]ping 1.1.1.2
Ping 1.1.1.2 (1.1.1.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.1.2: icmp_seq=0 ttl=253 time=3.000 ms
56 bytes from 1.1.1.2: icmp_seq=1 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=2 ttl=253 time=2.000 ms
56 bytes from 1.1.1.2: icmp_seq=3 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=4 ttl=253 time=2.000 ms

当FW1的上行链路或者FW1与SW之间的链路故障时，PC1仍然能访问百度服务器，访问路径为PC1→SW→FW2→R1→百度服务器。本案例模拟FW1的上行链路故障，验证配置

[FW1]int g 1/0/0
[FW1-GigabitEthernet1/0/0]shutdown

查看此时PC1访问百度服务器链路：

[PC1]tracert 1.1.1.2
 1  192.168.1.253 (192.168.1.253)  1.000 ms  0.000 ms  1.000 ms
 2  200.1.1.2 (200.1.1.2)  1.000 ms  1.000 ms  1.000 ms
 3  1.1.1.2 (1.1.1.2)  1.000 ms  1.000 ms  1.000 ms

[PC1]ping 1.1.1.2
Ping 1.1.1.2 (1.1.1.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.1.2: icmp_seq=0 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=1 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=2 ttl=253 time=2.000 ms
56 bytes from 1.1.1.2: icmp_seq=3 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=4 ttl=253 time=2.000 ms

配置完全正常！

 

 

附：

 

1.整体配置

 

R1配置：

sysname R1
#
 ip unreachables enable
 ip ttl-expires enable
#
interface GigabitEthernet0/0
 port link-mode route
 ip address 100.1.1.2 255.255.255.0
#
interface GigabitEthernet0/1
 port link-mode route
 combo enable copper
 ip address 200.1.1.2 255.255.255.0
#
interface GigabitEthernet0/2
 port link-mode route
 combo enable copper
 ip address 1.1.1.1 255.255.255.0

FW1配置：

#
 sysname FW1
#
track 1 interface GigabitEthernet1/0/0
#
 ip unreachables enable
 ip ttl-expires enable
#              
vlan 10
#
vlan 20
#
interface Vlan-interface10
 ip address 192.168.1.252 255.255.255.0
 vrrp vrid 1 virtual-ip 192.168.1.254
 vrrp vrid 1 priority 120
 vrrp vrid 1 track 1 priority reduced 30
#
interface Vlan-interface20
 ip address 192.168.2.252 255.255.255.0
 vrrp vrid 2 virtual-ip 192.168.2.254
#
interface GigabitEthernet1/0/0
 port link-mode route
 ip address 100.1.1.1 255.255.255.0
 nat outbound
#
interface GigabitEthernet1/0/1
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10 20
#
security-zone name Trust
 import interface Vlan-interface10
 import interface Vlan-interface20
 import interface GigabitEthernet1/0/1 vlan 1 to 4094
#
security-zone name DMZ
#
security-zone name Untrust
 import interface GigabitEthernet1/0/0
#
security-zone name Management
#              
zone-pair security source Local destination Local
 packet-filter 3000
#
zone-pair security source Local destination Trust
 packet-filter 3000
#
zone-pair security source Local destination Untrust
 packet-filter 3000
#
zone-pair security source Trust destination Local
 packet-filter 3000
#
zone-pair security source Trust destination Trust
 packet-filter 3000
#
zone-pair security source Trust destination Untrust
 packet-filter 3000
#
zone-pair security source Untrust destination Local
 packet-filter 3000
#              
zone-pair security source Untrust destination Trust
 packet-filter 3000
#
zone-pair security source Untrust destination Untrust
 packet-filter 3000
#
 ip route-static 0.0.0.0 0 100.1.1.2
#
acl advanced 3000
 rule 0 permit ip

 

 

FW2配置：

#
 sysname FW2
#
track 1 interface GigabitEthernet1/0/1
#
 ip unreachables enable
 ip ttl-expires enable
#
vlan 1
#              
vlan 10
#
vlan 20
#
interface Vlan-interface10
 ip address 192.168.1.253 255.255.255.0
 vrrp vrid 1 virtual-ip 192.168.1.254
#
interface Vlan-interface20
 ip address 192.168.2.253 255.255.255.0
 vrrp vrid 2 virtual-ip 192.168.2.254
 vrrp vrid 2 priority 120
 vrrp vrid 2 track 1 priority reduced 30
#
interface GigabitEthernet1/0/1
 port link-mode route
 ip address 200.1.1.1 255.255.255.0
 nat outbound
#
interface GigabitEthernet1/0/2
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10 20
#
security-zone name Trust
 import interface Vlan-interface10
 import interface Vlan-interface20
 import interface GigabitEthernet1/0/2 vlan 1 to 4094
#
security-zone name DMZ
#
security-zone name Untrust
 import interface GigabitEthernet1/0/1
#
security-zone name Management
#
zone-pair security source Local destination Local
 packet-filter 3000
#
zone-pair security source Local destination Trust
 packet-filter 3000
#              
zone-pair security source Local destination Untrust
 packet-filter 3000
#
zone-pair security source Trust destination Local
 packet-filter 3000
#
zone-pair security source Trust destination Trust
 packet-filter 3000
#
zone-pair security source Trust destination Untrust
 packet-filter 3000
#
zone-pair security source Untrust destination Local
 packet-filter 3000
#
zone-pair security source Untrust destination Trust
 packet-filter 3000
#
zone-pair security source Untrust destination Untrust
 packet-filter 3000
#
 ip route-static 0.0.0.0 0 200.1.1.2
#
acl advanced 3000
 rule 0 permit ip

SW配置：

#
 sysname SW
#
 ip unreachables enable
 ip ttl-expires enable
#
vlan 10
#
vlan 20        
#
 stp global enable
#
interface GigabitEthernet1/0/1
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10 20
#
interface GigabitEthernet1/0/2
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10 20
#
interface GigabitEthernet1/0/3
 port link-mode bridge
 port access vlan 10
#
interface GigabitEthernet1/0/4
 port link-mode bridge
 port access vlan 2
 

 PC1配置：

#
 sysname PC1
#
 ip unreachables enable
 ip ttl-expires enable
#
interface GigabitEthernet0/0
 port link-mode route
 ip address 192.168.1.10 255.255.255.0
#
 ip route-static 0.0.0.0 0 192.168.1.254

 PC2配置：

#
 sysname PC2
#
 ip unreachables enable
 ip ttl-expires enable
#
interface GigabitEthernet0/1
 port link-mode route
 ip address 192.168.2.10 255.255.255.0
#
 ip route-static 0.0.0.0 0 192.168.2.254

百度服务配置：

#
 sysname PC
#
 ip unreachables enable
 ip ttl-expires enable
#              
interface GigabitEthernet0/0
 port link-mode route
 ip address 1.1.1.2 255.255.255.0
#
 ip route-static 0.0.0.0 0 1.1.1.1
#

 

2. 关注我，获取此次配置工程、更多配置案例、最新影视及常用办公软件