VRRP简介
VRRP用来为网关设备提供冗余备份。VRRP将可以承担网关功能的一组设备加入到备份组中,形成一台虚拟路由器,局域网内的主机将此虚拟路由器设置为缺省网关。VRRP根据优先级从备份组中选举出一台网关设备作为Master,负责转发局域网内主机与外部通信的流量,其他网关设备作为Backup。当Master出现故障后,VRRP重新选举新的Master,保证流量转发不会中断。
实验拓扑
配置需求
1.在 FW1 和 FW2 上配置 VRRP,要求FW1 成为 Vlan10 的主网关,FW2 成为 Vlan20 的主网关;SW1 和 SW2 互为备份。
2.SW1 和 SW2 对上行接口进行监视,如上行接口故障,会触发 VRRP 角色切换。
注意事项
1.要对虚拟网关设备的上行接口进行监视,当上行设备故障时,会自动降低主设备vrrp的优先级,自动触发角色切换。否则上行链路故障时,vrrp角色不能切换,导致不能访问互联网。
2.为了提高设备利用率,减轻主网关设备的压力,建议针对不同网段,将其主网关均匀分摊在两台vrrp设备上。如本配置中,vlan 10的主网关设备是FW1,vlan 20的主网关设备是FW2。
配置步骤
1.配置 IP 地址部分略。
2.配置 Vlan 和 Trunk 部分略。
3.在 FW1 的 Vlan10 上配置 VRRP,虚拟 IP 地址为 192.168.10.254/24,优先级为 120,在 Vlan20 上配置 VRRP,虚拟 IP 地址为 192.168.2.254/24,优先级不修改,保持默认值 100。
[FW1]interface Vlan-interface 10
[FW1-Vlan-interface10]vrrp vrid 1 virtual-ip 192.168.1.254
[FW1-Vlan-interface10]vrrp vrid 1 priority 120
[FW1]int Vlan-interface 20
[FW1-Vlan-interface20]vrrp vrid 2 virtual-ip 192.168.2.254
4.在 FW2 的 Vlan10 上配置 VRRP,虚拟 IP 地址为 192.168.10.254/24,优先级保持默认值100,在 Vlan20 上配置 VRRP,虚拟 IP 地址为 192.168.2.254/24,优先级修改为 120。
[FW1]interface Vlan-interface 10
[FW1-Vlan-interface10]vrrp vrid 1 virtual-ip 192.168.1.254
[FW1]int Vlan-interface 20
[FW1-Vlan-interface20]vrrp vrid 2 virtual-ip 192.168.2.254
[FW1-Vlan-interface20]vrrp vrid 2 priority 12
5.vrrp配置完成,检查vrrp配置。
[FW1]dis vrrp
IPv4 Virtual Router Information:
Running mode : Standard
Total number of virtual routers : 2
Interface VRID State Running Adver Auth Virtual
Pri Timer Type IP
---------------------------------------------------------------------
Vlan10 1 Master 120 100 None 192.168.1.254
Vlan20 2 Backup 100 100 None 192.168.2.254
[FW2]dis vrrp
IPv4 Virtual Router Information:
Running mode : Standard
Total number of virtual routers : 2
Interface VRID State Running Adver Auth Virtual
Pri Timer Type IP
---------------------------------------------------------------------
Vlan10 1 Backup 100 100 None 192.168.1.254
Vlan20 2 Master 120 100 None 192.168.2.254
6.配置上行接口监视,使主vrrp上行链路故障时,可以触发vrrp角色可以切换到备设备上。
7.在 FW1 上配置接口监视,监视上行接口 GigabitEthernet1/0/0,并在 Vlan10 接口中调用,优先级降低 30。
[FW1]track 1 interface GigabitEthernet1/0/0
[FW1]int Vlan-interface 10
[FW1-Vlan-interface10]vrrp vrid 1 track 1 priority reduced 30
7.在 FW2 上配置接口监视,监视上行接口 GigabitEthernet1/0/1,并在 Vlan20 接口中调用,优先级降低 30。
[FW2]track 1 interface GigabitEthernet1/0/1 [FW2]int Vlan-interface 20 [FW2-Vlan-interface10]vrrp vrid 2 track 1 priority reduced 30
配置验证
正常情况下财务部访问模拟百度服务器地址的路径为PC1→SW→FW1→R1→百度服务器
[PC1]tracert 1.1.1.2
1 192.168.1.252 (192.168.1.252) 1.000 ms 0.000 ms 1.000 ms
2 100.1.1.2 (100.1.1.2) 1.000 ms 0.000 ms 0.000 ms
3 1.1.1.2 (1.1.1.2) 2.000 ms 1.000 ms 1.000 ms
[PC1]ping 1.1.1.2
Ping 1.1.1.2 (1.1.1.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.1.2: icmp_seq=0 ttl=253 time=3.000 ms
56 bytes from 1.1.1.2: icmp_seq=1 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=2 ttl=253 time=2.000 ms
56 bytes from 1.1.1.2: icmp_seq=3 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=4 ttl=253 time=2.000 ms
当FW1的上行链路或者FW1与SW之间的链路故障时,PC1仍然能访问百度服务器,访问路径为PC1→SW→FW2→R1→百度服务器。本案例模拟FW1的上行链路故障,验证配置
[FW1]int g 1/0/0
[FW1-GigabitEthernet1/0/0]shutdown
查看此时PC1访问百度服务器链路:
[PC1]tracert 1.1.1.2
1 192.168.1.253 (192.168.1.253) 1.000 ms 0.000 ms 1.000 ms
2 200.1.1.2 (200.1.1.2) 1.000 ms 1.000 ms 1.000 ms
3 1.1.1.2 (1.1.1.2) 1.000 ms 1.000 ms 1.000 ms
[PC1]ping 1.1.1.2
Ping 1.1.1.2 (1.1.1.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.1.2: icmp_seq=0 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=1 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=2 ttl=253 time=2.000 ms
56 bytes from 1.1.1.2: icmp_seq=3 ttl=253 time=1.000 ms
56 bytes from 1.1.1.2: icmp_seq=4 ttl=253 time=2.000 ms
配置完全正常!
附:
1.整体配置
R1配置:
sysname R1
#
ip unreachables enable
ip ttl-expires enable
#
interface GigabitEthernet0/0
port link-mode route
ip address 100.1.1.2 255.255.255.0
#
interface GigabitEthernet0/1
port link-mode route
combo enable copper
ip address 200.1.1.2 255.255.255.0
#
interface GigabitEthernet0/2
port link-mode route
combo enable copper
ip address 1.1.1.1 255.255.255.0
FW1配置:
#
sysname FW1
#
track 1 interface GigabitEthernet1/0/0
#
ip unreachables enable
ip ttl-expires enable
#
vlan 10
#
vlan 20
#
interface Vlan-interface10
ip address 192.168.1.252 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.1.254
vrrp vrid 1 priority 120
vrrp vrid 1 track 1 priority reduced 30
#
interface Vlan-interface20
ip address 192.168.2.252 255.255.255.0
vrrp vrid 2 virtual-ip 192.168.2.254
#
interface GigabitEthernet1/0/0
port link-mode route
ip address 100.1.1.1 255.255.255.0
nat outbound
#
interface GigabitEthernet1/0/1
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
#
security-zone name Trust
import interface Vlan-interface10
import interface Vlan-interface20
import interface GigabitEthernet1/0/1 vlan 1 to 4094
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/0
#
security-zone name Management
#
zone-pair security source Local destination Local
packet-filter 3000
#
zone-pair security source Local destination Trust
packet-filter 3000
#
zone-pair security source Local destination Untrust
packet-filter 3000
#
zone-pair security source Trust destination Local
packet-filter 3000
#
zone-pair security source Trust destination Trust
packet-filter 3000
#
zone-pair security source Trust destination Untrust
packet-filter 3000
#
zone-pair security source Untrust destination Local
packet-filter 3000
#
zone-pair security source Untrust destination Trust
packet-filter 3000
#
zone-pair security source Untrust destination Untrust
packet-filter 3000
#
ip route-static 0.0.0.0 0 100.1.1.2
#
acl advanced 3000
rule 0 permit ip
FW2配置:
#
sysname FW2
#
track 1 interface GigabitEthernet1/0/1
#
ip unreachables enable
ip ttl-expires enable
#
vlan 1
#
vlan 10
#
vlan 20
#
interface Vlan-interface10
ip address 192.168.1.253 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.1.254
#
interface Vlan-interface20
ip address 192.168.2.253 255.255.255.0
vrrp vrid 2 virtual-ip 192.168.2.254
vrrp vrid 2 priority 120
vrrp vrid 2 track 1 priority reduced 30
#
interface GigabitEthernet1/0/1
port link-mode route
ip address 200.1.1.1 255.255.255.0
nat outbound
#
interface GigabitEthernet1/0/2
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
#
security-zone name Trust
import interface Vlan-interface10
import interface Vlan-interface20
import interface GigabitEthernet1/0/2 vlan 1 to 4094
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
#
security-zone name Management
#
zone-pair security source Local destination Local
packet-filter 3000
#
zone-pair security source Local destination Trust
packet-filter 3000
#
zone-pair security source Local destination Untrust
packet-filter 3000
#
zone-pair security source Trust destination Local
packet-filter 3000
#
zone-pair security source Trust destination Trust
packet-filter 3000
#
zone-pair security source Trust destination Untrust
packet-filter 3000
#
zone-pair security source Untrust destination Local
packet-filter 3000
#
zone-pair security source Untrust destination Trust
packet-filter 3000
#
zone-pair security source Untrust destination Untrust
packet-filter 3000
#
ip route-static 0.0.0.0 0 200.1.1.2
#
acl advanced 3000
rule 0 permit ip
SW配置:
#
sysname SW
#
ip unreachables enable
ip ttl-expires enable
#
vlan 10
#
vlan 20
#
stp global enable
#
interface GigabitEthernet1/0/1
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
#
interface GigabitEthernet1/0/2
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
#
interface GigabitEthernet1/0/3
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/4
port link-mode bridge
port access vlan 2
PC1配置:
#
sysname PC1
#
ip unreachables enable
ip ttl-expires enable
#
interface GigabitEthernet0/0
port link-mode route
ip address 192.168.1.10 255.255.255.0
#
ip route-static 0.0.0.0 0 192.168.1.254
PC2配置:
#
sysname PC2
#
ip unreachables enable
ip ttl-expires enable
#
interface GigabitEthernet0/1
port link-mode route
ip address 192.168.2.10 255.255.255.0
#
ip route-static 0.0.0.0 0 192.168.2.254
百度服务配置:
#
sysname PC
#
ip unreachables enable
ip ttl-expires enable
#
interface GigabitEthernet0/0
port link-mode route
ip address 1.1.1.2 255.255.255.0
#
ip route-static 0.0.0.0 0 1.1.1.1
#
2. 关注我,获取此次配置工程、更多配置案例、最新影视及常用办公软件