防火墙双击热备实验

FW1配置

<USG6000V1>sys

[USG6000V1]sy FW1

分别进入三个接口，配置IP地址

[FW1]int g1/0/1

[FW1-GigabitEthernet1/0/1]ip add 10.1.2.1 24

[FW1-GigabitEthernet1/0/1]int g1/0/3

[FW1-GigabitEthernet1/0/3]ip add 30.1.1.1 24

[FW1-GigabitEthernet1/0/3]int g1/0/4

[FW1-GigabitEthernet1/0/4]ip add 40.1.1.1 24

[FW1-GigabitEthernet1/0/4]q

将g1/0/1接口加入受信任区域，g1/0/4加入非受信任区域,g1/0/3加入DMZ区域

[FW1]firewall zone trust

[FW1-zone-trust]add int g1/0/1

[FW1-zone-trust]firewall zone untrust

[FW1-zone-untrust]add int g1/0/4

[FW1-zone-trust]firewall zone dmz

[FW1-zone-untrust]add int g1/0/3

[FW1-zone-untrust]q

配置trust区域和untrust区域的域间转发策略

[FW1]security-policy

[FW1-policy-security]rule name permit_sec

[FW1-policy-security-rule-permit_sec]source-zone trust

[FW1-policy-security-rule-permit_sec]destination-zone untrust

[FW1-policy-security-rule-permit_sec]action permit

[FW1-policy-security-rule-permit_sec]q

配置接口g1/0/1的备份组1，并加入到状态为active的VGMP管理组

[FW1]int g1/0/1

[FW1-GigabitEthernet1/0/1]vrrp vrid 1 virtual-ip 10.1.2.3 24 active

配置接口g1/0/4的备份组2，并加入到状态为active的VGMP管理组

[FW1]int g1/0/4

[FW1-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 2.2.2.1 24 active

[FW1-GigabitEthernet1/0/1]q

指定g1/0/3为心跳口

[FW1]hrp int g1/0/3 remote 30.1.1.2

启用hrp备份功能

[FW1]hrp enable

Info: NAT IP detect function is disabled.

HRP_S[FW1]hrp auto-sync //定义双机热备方式为自动备份

HRP_S[FW1]dis hrp state //查看双机热备状态信息

HRP_S[FW1]dis hrp int //查看心跳接口状态信息

FW2配置

<USG6000V1>sys

[USG6000V1]sy FW2

分别进入三个接口，配置IP地址

[FW2]int g1/0/1

[FW2-GigabitEthernet1/0/1]ip add 10.1.2.2 24

[FW2-GigabitEthernet1/0/1]int g1/0/3

[FW2-GigabitEthernet1/0/3]ip add 30.1.1.2 24

[FW2-GigabitEthernet1/0/3]int g1/0/4

[FW2-GigabitEthernet1/0/4]ip add 40.1.1.2 24

[FW2-GigabitEthernet1/0/4]q

将g1/0/1接口加入受信任区域，g1/0/4加入非受信任区域，g1/0/3加入dmz区域

[FW2]firewall zone trust

[FW2-zone-trust]add int g1/0/1

[FW2-zone-trust]firewall zone untrust

[FW2-zone-untrust]add int g1/0/4

[FW2-zone-trust]firewall zone dmz

[FW2-zone-untrust]add int g1/0/3

[FW2-zone-untrust]q

配置trust区域和untrust区域的域间转发策略

[FW2]security-policy

[FW2-policy-security]rule name permit_sec

[FW2-policy-security-rule-permit_sec]source-zone trust

[FW2-policy-security-rule-permit_sec]destination-zone untrust

[FW2-policy-security-rule-permit_sec]action permit

[FW2-policy-security-rule-permit_sec]q

配置接口g1/0/1的备份组1，并加入到状态为standby的VGMP管理组

[FW2]int g1/0/1

[FW2-GigabitEthernet1/0/1]vrrp vrid 1 virtual-ip 10.1.2.3 24 standby

配置接口g1/0/4的备份组2，并加入到状态为standby的VGMP管理组

[FW2]int g1/0/4

[FW2-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 2.2.2.1 24 standby

[FW2-GigabitEthernet1/0/1]q

指定g1/0/3为心跳口

[FW2]hrp int g1/0/3 remote 30.1.1.1

启用hrp备份功能

[FW2]hrp enable

Info: NAT IP detect function is disabled.

HRP_S[FW2]hrp auto-sync //定义双机热备方式为自动备份

HRP_S[FW2]dis hrp state //查看双机热备状态信息

HRP_S[FW2]dis hrp int //查看心跳接口状态信息