双出口网络链路和设备双冗余案例

1、AR3模拟联通和电信运营商
2、2台防火墙vrrp+hrp双冗余，下联局域网vrrp 10.3.0.3地址，上联两条外线每条外线都分别vrrp虚拟一个地址1.1.1.1.和2.2.2.2.1。
3、防火墙外线地址和运营商给的外线地址不在同一个网段，每条都用vrrp冗余链路，涉及vrrp虚拟地址和接口地址非同网段原理配置（非同网段要带子网掩码）。
4、局域网一台服务器10.3.0.100对外发布web只在电信那条线上对外映射，并且要做源进源出，防止外线 联通用户回不了包，访问不到web服务器。
5、用防火墙ip-link功能对2条外线进行icmp测试，发现不通就自动切换线路。
6、保证局域网用户都能nat上网，两台防火墙上都做nat配置
7、10.0.0.0段用于本机对两台防火墙做web配置管理。
8、核心交换机应该是2台做css，但是模拟器不支持

FW1的配置：

HRP_M[USG6000V1]dis current-configuration
2023-06-05 14:00:41.590 +08:00
!Software Version V500R005C10SPC300

sysname USG6000V1

hrp enable
hrp interface GigabitEthernet1/0/1 remote 10.10.10.2
hrp auto-sync config static-route

update schedule location-sdb weekly Sun 06:23

firewall defend action discard

banner enable

ip-link check enable
ip-link name dianxian
source-ip 1.1.1.1
destination 1.1.1.10 interface GigabitEthernet1/0/0 mode icmp
tx-interval 3
times 2
ip-link name liantong
source-ip 2.2.2.1
destination 2.2.2.10 interface GigabitEthernet1/0/6 mode icmp
tx-interval 3
times 2

l2tp-group default-lns

interface GigabitEthernet0/0/0
undo shutdown
ip binding vpn-instance default
ip address 10.0.0.6 255.255.255.0
alias GE0/METH
service-manage https permit
service-manage ping permit

interface GigabitEthernet1/0/0
undo shutdown
ip address 10.2.0.1 255.255.255.0
vrrp vrid 1 virtual-ip 1.1.1.1 255.255.255.0 active
service-manage ping permit

interface GigabitEthernet1/0/1
undo shutdown
ip address 10.10.10.1 255.255.255.0

interface GigabitEthernet1/0/2
undo shutdown
ip address 10.3.0.1 255.255.255.0
vrrp vrid 2 virtual-ip 10.3.0.3 active
service-manage ping permit

interface GigabitEthernet1/0/3
undo shutdown

interface GigabitEthernet1/0/4
undo shutdown

interface GigabitEthernet1/0/5
undo shutdown

interface GigabitEthernet1/0/6
undo shutdown
ip address 10.0.12.1 255.255.255.0
vrrp vrid 2 virtual-ip 2.2.2.1 255.255.255.0 active
service-manage ping permit

interface Virtual-if0

interface NULL0

firewall zone local
set priority 100

firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/2

firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
add interface GigabitEthernet1/0/6

firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/1

ip route-static 0.0.0.0 0.0.0.0 1.1.1.10 track ip-link dianxian
ip route-static 0.0.0.0 0.0.0.0 2.2.2.10 track ip-link liantong

undo ssh server compatible-ssh1x enable
ssh authentication-type default password
ssh server cipher aes256_ctr aes128_ctr
ssh server hmac sha2_256 sha1
ssh client cipher aes256_ctr aes128_ctr
ssh client hmac sha2_256 sha1

firewall detect ftp

nat server web protocol tcp global 1.1.1.1 www inside 10.3.0.100 www no-reverse
unr-route
nat server web2 protocol tcp global 2.2.2.1 www inside 10.3.0.100 www no-revers
e unr-route

user-interface con 0
authentication-mode aaa
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
user-interface vty 16 20

pki realm default

sa

location

nat address-group group1 0
mode pat
section 0 1.1.1.1 1.1.1.1

nat address-group group2 1
mode pat
section 0 2.2.2.1 2.2.2.1

multi-linkif
mode proportion-of-weight

right-manager server-group

device-classification
device-group pc
device-group mobile-terminal
device-group undefined-group

user-manage server-sync tsm

security-policy
default action permit
rule name dmz_local
rule name trust_to_untrust
source-zone trust
destination-zone untrust
source-address 10.3.0.0 mask 255.255.255.0
action permit

auth-policy

traffic-policy

policy-based-route
rule name web_80 1
ingress-interface GigabitEthernet1/0/2
source-address 10.3.0.100 mask 255.255.255.255
action pbr egress-interface GigabitEthernet1/0/0 next-hop 1.1.1.10

nat-policy
rule name out
source-zone trust
egress-interface GigabitEthernet1/0/0
source-address 10.3.0.0 mask 255.255.0.0
action source-nat address-group group1
rule name out2
source-zone trust
egress-interface GigabitEthernet1/0/6
source-address 10.3.0.0 mask 255.255.0.0
action source-nat address-group group2

quota-policy

pcp-policy

dns-transparent-policy

rightm-policy

return

FW2配置：

HRP_S[USG6000V1]dis current-configuration
2023-06-05 14:05:41.700 +08:00
!Software Version V500R005C10SPC300

sysname USG6000V1

hrp enable
hrp interface GigabitEthernet1/0/1 remote 10.10.10.1
hrp auto-sync config static-route

ip-link check enable
ip-link name dianxian
source-ip 1.1.1.1
destination 1.1.1.10 interface GigabitEthernet1/0/0 mode icmp
tx-interval 3
times 2
ip-link name liantong
source-ip 2.2.2.1
destination 2.2.2.10 interface GigabitEthernet1/0/6 mode icmp
tx-interval 3
times 2

interface GigabitEthernet0/0/0
undo shutdown
ip binding vpn-instance default
ip address 10.0.0.5 255.255.255.0
alias GE0/METH
service-manage https permit
service-manage ping permit

interface GigabitEthernet1/0/0
undo shutdown
ip address 10.2.0.2 255.255.255.0
vrrp vrid 1 virtual-ip 1.1.1.1 255.255.255.0 standby
service-manage ping permit

interface GigabitEthernet1/0/1
undo shutdown
ip address 10.10.10.2 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/2
undo shutdown
ip address 10.3.0.2 255.255.255.0
vrrp vrid 2 virtual-ip 10.3.0.3 standby
service-manage ping permit

interface GigabitEthernet1/0/3
undo shutdown

interface GigabitEthernet1/0/4
undo shutdown

interface GigabitEthernet1/0/5
undo shutdown

interface GigabitEthernet1/0/6
undo shutdown
ip address 10.0.12.2 255.255.255.0
vrrp vrid 2 virtual-ip 2.2.2.1 255.255.255.0 standby
service-manage ping permit

interface Virtual-if0

interface NULL0

firewall zone local
set priority 100

firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/2

firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
add interface GigabitEthernet1/0/6

firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/1

ip route-static 0.0.0.0 0.0.0.0 1.1.1.10 track ip-link dianxian
ip route-static 0.0.0.0 0.0.0.0 2.2.2.10 track ip-link liantong

nat server web protocol tcp global 1.1.1.1 www inside 10.3.0.100 www no-reverse
unr-route
nat server web2 protocol tcp global 2.2.2.1 www inside 10.3.0.100 www no-revers
e unr-route

nat address-group group1 0
mode pat
section 0 1.1.1.1 1.1.1.1

nat address-group group2 1
mode pat
section 0 2.2.2.1 2.2.2.1

multi-linkif
mode proportion-of-weight

right-manager server-group

device-classification
device-group pc
device-group mobile-terminal
device-group undefined-group

user-manage server-sync tsm

security-policy
default action permit
rule name dmz_local
rule name trust_to_untrust
source-zone trust
destination-zone untrust
source-address 10.3.0.0 mask 255.255.255.0
action permit

auth-policy

traffic-policy

policy-based-route
rule name web_80 1
ingress-interface GigabitEthernet1/0/2
source-address 10.3.0.100 mask 255.255.255.255
action pbr egress-interface GigabitEthernet1/0/0 next-hop 1.1.1.10

nat-policy
rule name out
source-zone trust
egress-interface GigabitEthernet1/0/0
source-address 10.3.0.0 mask 255.255.0.0
action source-nat address-group group1
rule name out2
source-zone trust
egress-interface GigabitEthernet1/0/6
source-address 10.3.0.0 mask 255.255.0.0
action source-nat address-group group2

quota-policy

pcp-policy

dns-transparent-policy

rightm-policy

return

关键配置：
源进源出：


vrrp检测：

ip-link检测配置


nat上外网配置：

对外服务80配置(这里可以考虑只写一条电信的来配置源进源出，多写了一条联通，不过没影响)：

2个防火墙都要有两条默认路由

各接口配置：