防火墙双机热备与NAT Server结合使用

Mario_Ti2024-02-02 20:59

一、NAT Server知识回顾

NAT配置之目的NAT详解https://blog.csdn.net/Mario_Ti/article/details/135175030?spm=1001.2014.3001.5502

二、NAT Server公网地址与虚拟IP地址不在同一网段

1、分析过程

按照双机热备的配置方式开启双机热备之主备模式，在FW1即主用设备配置NAT Server，将内网服务器10.0.0.4转换成公网地址10.10.10.10，且与VRRP备份组2的虚拟IP地址不在同一网段（10.0.1.1），该配置会备份到FW2即备用设备，外网路由器一般情况下会配置一条默认路由下一跳为虚拟IP10.0.1.1。

当外网客户端访问内网服务器的报文到达外网路由器AR4，查看路由表发现下一跳为10.0.1.1，路由器发送广播ARP报文请求10.0.1.1的MAC地址，此时只有VRRP备份组为Master的防火墙会回应虚拟MAC地址，路由器使用虚拟MAC地址作为目的MAC地址封装报文，发送到交换机，交换机根据MAC地址表找到对应的接口发送给FW1即主用设备。

2、配置过程

java 复制代码 
[FW1]interface g1/0/0
[FW1-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.0.0.1 active 
 
//配置VRRP备份组2
[FW1-GigabitEthernet1/0/0]interface g1/0/1
[FW1-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 10.0.1.1 active
 
//配置心跳接口
[FW1-GigabitEthernet1/0/1]interface g1/0/2
[FW1-GigabitEthernet1/0/2]hrp interface g1/0/2 remote 10.10.0.2
[FW1-GigabitEthernet1/0/3]hrp interface g1/0/3 remote 10.10.1.2
 
//划分区域
[FW1]firewall zone name dmz
[FW1-zone-dmz]add interface g1/0/2
[FW1-zone-dmz]add interface g1/0/3
 
//开启双机热备
[FW1]hrp enable
 
 
 
[FW2]interface g1/0/0	
[FW2-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.0.0.1 standby 
 
[FW2-GigabitEthernet1/0/0]interface g1/0/1
[FW2-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 10.0.1.1 standby 
 
[FW2-GigabitEthernet1/0/1]interface g1/0/2
[FW2-GigabitEthernet1/0/2]hrp interface g1/0/2 remote 10.10.0.1
[FW2-GigabitEthernet1/0/3]hrp interface g1/0/3 remote 10.10.1.1
 
[FW2]firewall zone name dmz
[FW2-zone-dmz]add interface g1/0/2
[FW2-zone-dmz]add interface g1/0/3
 
[FW2]hrp enable
java 复制代码 
[AR4]ip route-static 0.0.0.0 0 10.0.1.1

HRP_M[FW1-policy-security-rule-policy1]display this
2024-02-01 09:31:22.160 
#
 rule name policy1
  source-zone untrust
  destination-zone trust
  destination-address 10.0.0.4 mask 255.255.255.255
  service http
  action permit
#
return

HRP_S[FW2]display security-policy rule name policy1
2024-02-01 09:32:23.910 
 (0 times matched)
 rule name policy1
  source-zone untrust
  destination-zone trust
  destination-address 10.0.0.4 mask 255.255.255.255
  service http
  action permit

HRP_M[FW1]display ip routing-table 
2024-02-01 09:33:30.340 
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
         Destinations : 13       Routes : 13       

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        0.0.0.0/0   Static  60   0          RD   10.0.1.4        GigabitEthernet
1/0/1


HRP_S[FW2]display ip routing-table 
2024-02-01 09:34:58.930 
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
         Destinations : 11       Routes : 11       

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        0.0.0.0/0   Static  60   0          RD   10.0.1.4        GigabitEthernet
1/0/1
java 复制代码 
HRP_M[FW1]nat server protocol tcp global 10.10.10.10 9980 inside 10.0.0.4 80

HRP_S[FW2]display nat server 
2024-02-01 09:37:31.140 
Server in private network information:
  Total   1 NAT server(s)
 server name   : 0                      
 id            : 0                      zone          : ---                    
 global-start-addr : 10.10.10.10        global-end-addr   : 10.10.10.10        
 inside-start-addr : 10.0.0.4           inside-end-addr   : 10.0.0.4           
 global-start-port : 9980               global-end-port   : 9980               
 inside-start-port : 80(www)            inside-end-port   : 80                 
 globalvpn     : public                 insidevpn     : public                 
 vsys          : public                 protocol      : tcp                    
 no-revers     : 0                      interface     : ---                    
 unr-route     : 0                      description   : ---                    
 nat-disable   : 0                      

HRP_M[FW1]display firewall server-map 
2024-02-01 09:40:19.930 
 Current Total Server-map : 2
 Type: Nat Server,  ANY -> 10.10.10.10:9980[10.0.0.4:80],  Zone:---,  protocol:t
cp
 Vpn: public -> public

 Type: Nat Server Reverse,  10.0.0.4[10.10.10.10] -> ANY,  Zone:---,  protocol:t
cp
 Vpn: public -> public,  counter: 1

HRP_M[FW1]

在主用设备上配置NAT Server，会备份到备用设备。

java 复制代码 
HRP_M[FW1]display firewall session table 
2024-02-01 09:55:37.760 
 Current Total Sessions : 6
 udp  VPN: public --> public  10.10.0.2:16384 --> 10.10.0.1:18514
 http  VPN: public --> public  1.1.1.2:2056 --> 10.10.10.10:9980[10.0.0.4:80]
java 复制代码 
HRP_M[FW1]ip route-static 10.10.10.10 32 NULL 0
HRP_S[FW2]ip route-static 10.10.10.10 32 NULL 0

开启黑洞路由，在不同网段可以起到防环的效果。

三、NAT Server公网地址与虚拟IP地址在同一网段

1、分析过程

1.1、主备备份

按照双机热备的配置方式开启双机热备之主备模式，在FW1即主用设备配置NAT Server，将内网服务器10.0.0.4转换成公网地址10.0.1.10，且与VRRP备份组2的虚拟IP地址在同一网段（10.0.1.1），该配置会备份到FW2即备用设备。

当外网客户端访问内网服务器的报文到达外网路由器AR4，路由器直接发送广播ARP报文请求10.0.1.1的MAC地址，此时两台防火墙均配置有NAT Server，两台防火墙均会回应自身接口的MAC地址，路由器将会JO里JO气，反复横跳，时而以FW1的接口MAC地址封装报文，时而以FW2的接口MAC地址封装报文，从而影响业务的正常运行。

此时需要启动NAT Server与VRRP备份组绑定，只有VRRP备份组状态为Master的防火墙FW1才会应答路由器的ARP请求。华为USG6000E防火墙会自动将NAT Server与VRRP备份组绑定，若同一网段有多个VRRP备份组，则自动绑定VRID最小的VRRP备份组。

1.2、负载分担

以1.1为前提，需要手动配置NAT Server与VRRP备份组绑定，服务器10.0.0.5对应的NAT Server：10.0.1.20绑定VRRP备份组2，服务器10.0.0.6对应的NAT Server：10.0.1.30绑定VRRP备份组4。

2、配置过程（以负载分担为例）

java 复制代码 
HRP_M[FW1]display current-configuration interface 
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.0.0.2 255.255.255.0
 vrrp vrid 1 virtual-ip 10.0.0.1 active
 vrrp vrid 3 virtual-ip 10.0.0.4 standby
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 10.0.1.2 255.255.255.0
 vrrp vrid 2 virtual-ip 10.0.1.1 active
 vrrp vrid 4 virtual-ip 10.0.1.10 standby
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 10.10.0.1 255.255.255.0
#

HRP_M[FW1-zone-dmz]display this
2024-02-01 11:38:00.770 
#
firewall zone dmz
 set priority 50
 add interface GigabitEthernet1/0/2
#
return

HRP_S[FW2]display current-configuration interface 
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.0.0.3 255.255.255.0
 vrrp vrid 1 virtual-ip 10.0.0.1 standby
 vrrp vrid 3 virtual-ip 10.0.0.4 active
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 10.0.1.3 255.255.255.0
 vrrp vrid 2 virtual-ip 10.0.1.1 standby
 vrrp vrid 4 virtual-ip 10.0.1.10 active
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 10.10.0.2 255.255.255.0
#
java 复制代码 
[FW1-GigabitEthernet1/0/2]hrp interface g1/0/2 remote 10.10.0.2
 
[FW2-GigabitEthernet1/0/2]hrp interface g1/0/2 remote 10.10.0.1
 
[FW1]hrp enable
 
[FW2]hrp enable
java 复制代码 
HRP_M[FW1]display hrp state verbose 
2024-02-01 11:36:20.280 
 Role: active, peer: active
 Running priority: 45000, peer: 45000
 Backup channel usage: 0.00%
 Stable time: 0 days, 0 hours, 0 minutes
 Last state change information: 2024-02-01 11:35:47 HRP core state changed, old_
state = abnormal(standby), new_state = normal, local_priority = 45000, peer_prio
rity = 45000.

 Configuration:
 hello interval:              1000ms
 preempt:                     60s
 mirror configuration:        off
 mirror session:              off
 track trunk member:          on
 auto-sync configuration:     on
 auto-sync connection-status: on
 adjust ospf-cost:            on
 adjust ospfv3-cost:          on
 adjust bgp-cost:             on
 nat resource:                off

 Detail information:
           GigabitEthernet1/0/0 vrrp vrid 1: active
           GigabitEthernet1/0/1 vrrp vrid 2: active
           GigabitEthernet1/0/0 vrrp vrid 3: standby
           GigabitEthernet1/0/1 vrrp vrid 4: standby
                                  ospf-cost: +0
                                ospfv3-cost: +0
                                   bgp-cost: +0


HRP_S[FW2]display hrp state verbose 
2024-02-01 11:37:01.310 
 Role: active, peer: active
 Running priority: 45000, peer: 45000
 Backup channel usage: 0.00%
 Stable time: 0 days, 0 hours, 1 minutes
 Last state change information: 2024-02-01 11:35:46 HRP core state changed, old_
state = abnormal(active), new_state = normal, local_priority = 45000, peer_prior
ity = 45000.

 Configuration:
 hello interval:              1000ms
 preempt:                     60s
 mirror configuration:        off
 mirror session:              off
 track trunk member:          on
 auto-sync configuration:     on
 auto-sync connection-status: on
 adjust ospf-cost:            on
 adjust ospfv3-cost:          on
 adjust bgp-cost:             on
 nat resource:                off

 Detail information:
           GigabitEthernet1/0/0 vrrp vrid 1: standby
           GigabitEthernet1/0/1 vrrp vrid 2: standby
           GigabitEthernet1/0/0 vrrp vrid 3: active
           GigabitEthernet1/0/1 vrrp vrid 4: active
                                  ospf-cost: +0
                                ospfv3-cost: +0
                                   bgp-cost: +0
java 复制代码 
HRP_M[FW1-zone-dmz]firewall zone trust
HRP_M[FW1-zone-trust]display this
2024-02-01 11:39:10.900 
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
 add interface GigabitEthernet1/0/0
#
return
HRP_M[FW1-zone-trust]firewall zone untrust
HRP_M[FW1-zone-untrust]display this
2024-02-01 11:39:25.290 
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet1/0/1
#
return

HRP_M[FW1-policy-security-rule-policy1]display this
2024-02-01 11:42:05.470 
#
 rule name policy1
  source-zone untrust
  destination-zone trust
  destination-address 10.0.0.5 mask 255.255.255.255
  destination-address 10.0.0.6 mask 255.255.255.255
  service http
  action permit
#
return

可能是ENSP本身BUG问题，查看了一下以下配置方法，但是无法配置，但理论上配置是没有为你的。

此时配置即可完成，访问服务器10.0.0.5通过FW1，访问服务器10.0.0.6通过FW2，即负载分担。

参考资料：防火墙和VPN技术与实践------李学昭

相关推荐
dessler19 分钟前
Docker-如何启动docker
运维·docker·云原生·容器·eureka
zhy2956319 分钟前
【DOCKER】基于DOCKER的服务之DUFS
运维·docker·容器·dufs
小蜗牛慢慢爬行31 分钟前
有关异步场景的 10 大 Spring Boot 面试问题
java·开发语言·网络·spring boot·后端·spring·面试
秋名山小桃子34 分钟前
Kunlun 2280服务器(ARM)Raid卡磁盘盘符漂移问题解决
运维·服务器
与君共勉1213835 分钟前
Nginx 负载均衡的实现
运维·服务器·nginx·负载均衡
MARIN_shen37 分钟前
Marin说PCB之POC电路layout设计仿真案例---06
网络·单片机·嵌入式硬件·硬件工程·pcb工艺
MZWeiei1 小时前
Zookeeper基本命令解析
大数据·linux·运维·服务器·zookeeper
Arenaschi1 小时前
在Tomcat中部署应用时，如何通过域名访问而不加端口号
运维·服务器
waicsdn_haha1 小时前
Java/JDK下载、安装及环境配置超详细教程【Windows10、macOS和Linux图文详解】
java·运维·服务器·开发语言·windows·后端·jdk
打鱼又晒网1 小时前
linux网络套接字 | 深度解析守护进程 | 实现tcp服务守护进程化
linux·网络协议·计算机网络·tcp
热门推荐
01〔AI 绘画〕Stable Diffusion 之 解决绘制多人或面部很小的人物时面部崩坏问题 篇02ARM学习（31）编译器对overlay方式的支持03玄机平台应急响应—webshell查杀04解决java读取EXCEL数据变成科学计数法的问题05校验 GPT-4 真实性的三个经典问题：快速区分 GPT-3.5 与 GPT-4，并提供免费测试网站06Docker 夺命连环 15 问07DisplayPort AltMode On Type-c协议_Ver2.0(学习笔记)08基于大语言模型（LLM）的合成数据生成、策展和评估的综述09(欧拉)openEuler系统添加网卡文件配置流程、(欧拉)openEuler系统手动配置ipv6地址流程、(欧拉)openEuler系统网络管理说明106个主流的工业3D管道设计软件