转载：(华为配置)防火墙双机热备+BFD联动故障切换实验报告
一、实验拓扑
二、实验内容
（一）实验需求:
某公司通过主防火墙(FW1)与外网进行通信，当主防火墙出现故障时，备份防火墙能够保障正常通信。
（二）基础配置(vlan划分、IP地址配置)
1．ISP
#
interface GigabitEthernet0/0/0
ip address 100.1.1.1 255.255.255.248
#
interface LoopBack0
ip address 114.114.114.114 255.255.255.252
#2．SW-OUT
#
vlan batch 2
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 2
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 2
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 2
#
interface Vlanif2
ip address 100.1.1.5 255.255.255.248
#3．FW1
#
interface GigabitEthernet1/0/0
description to_SW-IN_G0/0/1
undo shutdown
ip address 10.1.1.1 255.255.255.248
#
interface GigabitEthernet1/0/1
description to_SW-OUT_G0/0/2
undo shutdown
ip address 100.1.1.2 255.255.255.248
#
interface GigabitEthernet1/0/2
description to_FW2_G1/0/2
undo shutdown
ip address 10.0.12.1 255.255.255.252
alias hrp
#4．FW2
#
interface GigabitEthernet1/0/0
description to_SW-IN_G0/0/2
undo shutdown
ip address 10.1.1.3 255.255.255.248
#
interface GigabitEthernet1/0/1
description to_SW-OUT_G0/0/3
undo shutdown
ip address 100.1.1.3 255.255.255.248
#
interface GigabitEthernet1/0/2
description to_FW1_G1/0/2
undo shutdown
ip address 10.0.12.2 255.255.255.252
alias hrp
#5．SW-IN
#
Vlan batch 2 10 20
#
interface GigabitEthernet0/0/1
description to_FW1_G1/0/0
port link-type access
port default vlan 2
#
interface GigabitEthernet0/0/2
description to_FW2_G1/0/0
port link-type access
port default vlan 2
#
interface GigabitEthernet0/0/3
description to_vlan10
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/4
description to_vlan20
port link-type access
port default vlan 20
#
interface Vlanif2
ip address 10.1.1.2 255.255.255.248
#
interface Vlanif10
ip address 172.16.10.254 255.255.255.0
#
interface Vlanif20
ip address 192.168.1.254 255.255.255.0
#（三）安全区域划分
1．FW1
#
firewall zone trust
add interface GigabitEthernet1/0/0
#
firewall zone untrust
add interface GigabitEthernet1/0/1
#
firewall zone dmz
add interface GigabitEthernet1/0/2
#2．FW2
#
firewall zone trust
add interface GigabitEthernet1/0/0
#
firewall zone untrust
add interface GigabitEthernet1/0/1
#
firewall zone dmz
add interface GigabitEthernet1/0/2
#（四）VRRP
1．FW1
#
interface GigabitEthernet1/0/0
vrrp vrid 1 virtual-ip 10.1.1.4 active
#
interface GigabitEthernet1/0/1
vrrp vrid 2 virtual-ip 100.1.1.4 active
#2．FW2
#
interface GigabitEthernet1/0/0
vrrp vrid 1 virtual-ip 10.1.1.4 standby
#
interface GigabitEthernet1/0/1
vrrp vrid 2 virtual-ip 100.1.1.4 standby
#（五）配置HRP
1．FW1
#
hrp enable
hrp interface GigabitEthernet1/0/2 remote 10.0.12.2
hrp mirror session enable
#2．FW2
#
hrp enable
hrp interface GigabitEthernet1/0/2 remote 10.0.12.1
hrp mirror session enable
#（六）配置防火墙安全策略
只需要在FW1上配置，就会同步到FW2
1．FW1
#
security-policy
rule name t_U
source-zone trust
destination-zone untrust
action permit
rule name guanli
source-zone local
action permit
#（七）配置防火墙NAT地址池及NAT策略
只需要在FW1上配置，就会同步到FW2
1．FW1
#
nat address-group CK_NAT_address 0
mode pat
section 1 100.1.1.6 100.1.1.6
#
nat-policy
rule name internet
source-zone trust
destination-zone untrust
action source-nat address-group CK_NAT_address
#（八）配置指向内外网的双向静态路由
1．SW-OUT
#
ip route-static 0.0.0.0 0.0.0.0 100.1.1.1
#2．FW1
#
ip route-static 0.0.0.0 0.0.0.0 100.1.1.5
ip route-static 172.16.10.0 255.255.255.0 10.1.1.2
ip route-static 192.168.1.0 255.255.255.0 10.1.1.2
#3．FW2
#
ip route-static 0.0.0.0 0.0.0.0 100.1.1.5
ip route-static 172.16.10.0 255.255.255.0 10.1.1.2
ip route-static 192.168.1.0 255.255.255.0 10.1.1.2
#4．SW-IN
#
ip route-static 0.0.0.0 0.0.0.0 10.1.1.4
#（九）上行接口配置BFD联动实现故障快速切换
还可以使用IP-link的icmp报文探测是否存活，但是由于IP-Link探测时间间隔需断网较长时间才恢复正常，所以这里使用BFD。
1．SW-OUT
#
bfd
#
bfd 1 bind peer-ip 100.1.1.2
discriminator local 20
discriminator remote 10
commit
#
bfd 2 bind peer-ip 100.1.1.3
discriminator local 40
discriminator remote 30
commit
#2．FW1
#
bfd
#
bfd 1 bind peer-ip 100.1.1.5
discriminator local 10
discriminator remote 20
commit
#
hrp enable
hrp track interface GigabitEthernet1/0/1
hrp track bfd-session 10
#3.FW2
#
bfd
#
bfd 1 bind peer-ip 100.1.1.5
discriminator local 30
discriminator remote 40
commit
#
hrp enable
hrp track interface GigabitEthernet1/0/1
hrp track bfd-session 30
#三、实验结果
（一）PC之间互通
（二）当主防火墙出现故障时，依然能够正常通信
往期推荐