1、深信服防火墙双机原理 深信服防火墙双机相当于VRRP(虚拟路由冗余协议),在VRRP中有两组重要的概念:VRRP路由器和虚拟路由器,主控路由器和备份路由器。VRRP路由器是指运行VRRP的路由器,是物理实体;虚拟路由器是指VRRP协议创建的,是逻辑概念。一组VRRP路由器协同工作,共同构成一台虚拟路由器。该虚拟路由器对外表现为一个具有唯一固定的IP地址和MAC地址的逻辑路由器。处于同一个VRRP组中的路由器具有两种互斥的角色:主控路由器和备份路由器,一个VRRP组中有且只有一台处于主控角色的路由器,可以有一个或者多个处于备份角色的路由器VRRP协议从路由器组中选出一台作为主控路由器,负责ARP解析和转发IP数据包,组中的其他路由器作为备份的角色并处于待命状态,当由于某种原因主控路由器发生故障时,其中的一台备份路由器能在瞬间的时延后升级为主控路由器,由于此切换非常迅速而且不用改变IP地址和MAC地址,故对终端使用者系统是透明的。 2、实验目的 测试VRRP,理解深信服防火墙双机原理。 3、实验拓扑 4、配置步骤 4.1、SW3配置 [Huawei]sysname sw3 创建vlan [sw3]vlan batch 10 20 30 40 加入vlan10 [sw3]inter GigabitEthernet 0/0/1 [sw3-GigabitEthernet0/0/1]port link-type access [sw3-GigabitEthernet0/0/1]port default vlan 10 加入vlan20 [sw3-GigabitEthernet0/0/1]inter gi 0/0/2 [sw3-GigabitEthernet0/0/2]port link-type access [sw3-GigabitEthernet0/0/2]port default vlan 20 加入vlan30 [sw3-GigabitEthernet0/0/2]inter gi 0/0/3 [sw3-GigabitEthernet0/0/3]port link-type access [sw3-GigabitEthernet0/0/3]port default vlan 30 加入vlan40 [sw3-GigabitEthernet0/0/3]inter gi0/0/4 [sw3-GigabitEthernet0/0/4]port link-type access [sw3-GigabitEthernet0/0/4]port default vlan 40 [sw3-GigabitEthernet0/0/4]quit 配置trunk模式 [sw3]inter GigabitEthernet 0/0/6 [sw3-GigabitEthernet0/0/6]port link-type trunk [sw3-GigabitEthernet0/0/6]port trunk allow-pass vlan all [sw3]inter gi 0/0/5 [sw3-GigabitEthernet0/0/5]port link-type trunk [sw3-GigabitEthernet0/0/5]port trunk allow-pass vlan all 4.2、SW2配置 <Huawei>sys 创建vlan [Huawei]vlan batch 10 20 30 40 每个vlan配置ip地址 [Huawei]inter vlan 10 [Huawei-Vlanif10]ip address 192.168.10.253 255.255.255.0 [Huawei-Vlanif10]inter vlan 20 [Huawei-Vlanif20]ip address 192.168.20.253 255.255.255.0 [Huawei-Vlanif20]inter vlan 30 [Huawei-Vlanif30]ip address 192.168.30.253 255.255.255.0 [Huawei-Vlanif30]inter vlan 40 [Huawei-Vlanif40]ip address 192.168.40.253 255.255.255.0 把vlan40加入组,并配置vrrp vrrp配置虚拟IP [Huawei-Vlanif40]vrrp vrid 40 virtual-ip 192.168.40.250 配置优先级 [Huawei-Vlanif40]vrrp vrid 40 priority 150 配置链路跟踪 [Huawei-Vlanif40]vrrp vrid 40 track interface gi0/0/2 reduced 100 相同的操作配置vlan30 [Huawei-Vlanif40]inter vlan 30 [Huawei-Vlanif30]vrrp vrid 30 virtual-ip 192.168.30.250 [Huawei-Vlanif30]vrrp vrid 30 priority 100 [Huawei-Vlanif30]vrrp vrid 30 track interface GigabitEthernet 0/0/2 reduced 100 开启vlan10的vrrp功能 [Huawei-Vlanif30]inter vlan 10 [Huawei-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.250 开启vlan20的vrrp功能 [Huawei-Vlanif10]inter vlan 20 [Huawei-Vlanif20]vrrp vrid 20 virtual-ip 192.168.20.250 将gi0/0/1配置为trunk模式 [Huawei-Vlanif20]inter gi0/0/1 [Huawei-GigabitEthernet0/0/1]port link-type trunk [Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all 4.3、SW1配置 配置vlan10 20的vrrp优先级为150 vlan30 40开启vrrp <Huawei> <Huawei>sys [Huawei]vlan batch 10 20 30 40 [Huawei]inter vlan 10 [Huawei-Vlanif10]ip address 192.168.10.254 255.255.255.0 [Huawei-Vlanif10]inter vlan 20 [Huawei-Vlanif20]ip address 192.168.20.254 255.255.255.0 [Huawei-Vlanif20]inter vlan 30 [Huawei-Vlanif30]ip address 192.168.30.254 255.255.255.0 [Huawei-Vlanif30]inter vlan 40 [Huawei-Vlanif40]ip address 192.168.40.254 255.255.255.0 [Huawei-Vlanif40]quit [Huawei]inte gi 0/0/1 [Huawei-GigabitEthernet0/0/1]port link-type trunk [Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all [Huawei-GigabitEthernet0/0/1]quit [Huawei]inter vlan 10 [Huawei-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.250 [Huawei-Vlanif10]vrrp vrid 10 priority 150 [Huawei-Vlanif10]vrrp vrid 10 track inter gi 0/0/2 reduced 100 [Huawei-Vlanif10]inter vlan 20 [Huawei-Vlanif20]vrrp vrid 20 virtual-ip 192.168.20.250 [Huawei-Vlanif20]vrrp vrid 20 priority 150 [Huawei-Vlanif20]vrrp vrid 20 track inter gi0/0/2 reduced 100 4.4、测试网络 4.5、验证VRRP <sw3>terminal monito <sw3>terminal debugging <sw3>debugging ip icmp <sw3>sys [sw3]info-center console channel monitor |