防火墙双机热备部署

周某人姓周2025-08-13 10:54


复制代码 
MSTP+VRRP架构
sw3为vlan2主网关，vlan3的备网关
SW4为VLAN 3主网关，VLAN 2的备网关
运行MSTP 
实例1 ------ VLAN 2
实例2 ------ VLAN 3
bash 复制代码 
[SW3]vlan batch 2 3
[SW3-GigabitEthernet0/0/3]port link-type trunk 
[SW3-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 3
[SW3-GigabitEthernet0/0/4]port link-type trunk 
[SW3-GigabitEthernet0/0/4]port trunk allow-pass  vlan  2 3
#生成树
[SW3]stp region-configuration 
[SW3-mst-region]region-name aa
#实例1有vlan2
[SW3-mst-region]instance 1 vlan 2
[SW3-mst-region]instance 2 vlan 3
#激活实例
[SW3-mst-region]active region-configuration 
#让SW3做实例1的主根，实例2的备份跟
[SW3]stp instance 1 root primary 
[SW3]stp instance 2 root  secondary 
#vrrp
[SW3]interface  Vlanif 2
[SW3-Vlanif2]ip address  192.168.2.1 24
[SW3-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254
[SW3-Vlanif2]vrrp vrid 1 priority 120
[SW3-Vlanif2]vrrp vrid 1 preempt-mode timer delay 20

#主备切换监控
[SW3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15
[SW3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15

[SW3]interface Vlanif 3
[SW3-Vlanif3]ip address 192.168.3.1 24
[SW3-Vlanif3]vrrp vrid  1 virtual-ip 192.168.3.254

SW4与SW3的差异

bash 复制代码 
[SW4]stp instance 1 root secondary 
[SW4]stp instance 2 root primary
[SW4-Vlanif2]ip address 192.168.2.2 24
[SW4-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254
[SW4-Vlanif3]ip address 192.168.3.2 24
[SW4-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254
[SW4-Vlanif3]vrrp vrid 1 priority 120
[SW4-Vlanif3]vrrp vrid 1 preempt-mode timer delay 20
[SW4-Vlanif3]vrrp vrid 1 track interface  GigabitEthernet 0/0/1 reduced 15
[SW4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15

SW5

bash 复制代码 
[SW5]vlan batch 2 3
[SW5]interface GigabitEthernet 0/0/3
[SW5-GigabitEthernet0/0/3]port link-type access
[SW5-GigabitEthernet0/0/3]port link-type access 
[SW5-GigabitEthernet0/0/3]port default  vlan  2
[SW5-GigabitEthernet0/0/1]port link-type trunk 	
[SW5-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3 
[SW5]stp region-configuration 
[SW5-mst-region]region-name aa
[SW5-mst-region]instance 1 vlan 2
[SW5-mst-region]instance 2 vlan 3
[SW5-mst-region]active  region-configuration 
#查看生成树角色
[SW3]display stp brief

汇聚层到核心路由配置

复制代码 
SW1-SW2：VLAN 102 --- 10.10.2.0/24
SW1-SW3：VLAN 103 --- 10.10.3.0/24
SW1-SW4：VLAN 104 --- 10.10.4.0/24

SW2-SW3：VLAN 203 --- 10.20.3.0/24
SW2-SW4：VLAN 204 --- 10.20.4.0/24
bash 复制代码 
#SW3
[SW3]vlan batch 103 203
[SW3-GigabitEthernet0/0/1]port link-type access 
[SW3-GigabitEthernet0/0/1]port default vlan 103
[SW3-GigabitEthernet0/0/1]undo stp enable 
[SW3-GigabitEthernet0/0/2]port link-type access 
[SW3-GigabitEthernet0/0/2]port default vlan 203
[SW3-GigabitEthernet0/0/2]undo stp enable 
[SW3-Vlanif103]ip address 10.10.3.3 24
[SW3-Vlanif203]ip address 10.20.3.3 24
[SW3]ospf 1 router-id 3.3.3.3
[SW3-ospf-1]a 0

[SW3-ospf-1-area-0.0.0.0]network 10.10.3.3 0.0.0.0
[SW3-ospf-1-area-0.0.0.0]network 10.20.3.3 0.0.0.0

#SW4
[SW4]vlan batch 104 204
[SW4-GigabitEthernet0/0/1]port link-type access 
[SW4-GigabitEthernet0/0/1]port default vlan 204
[SW4-GigabitEthernet0/0/1]undo stp enable 
[SW4-GigabitEthernet0/0/2]port link-type access
[SW4-GigabitEthernet0/0/2]undo stp enable


[SW4-GigabitEthernet0/0/2]port link-type access
[SW4-GigabitEthernet0/0/2]port default vlan 104
[SW4-GigabitEthernet0/0/2]undo stp enable 
[SW4-Vlanif104]ip address 10.10.4.4 24
[SW4-Vlanif204]ip address 10.20.4.4 24
[SW4]ospf 1 router-id 4.4.4.4
[SW4-ospf-1]area 0
[SW4-ospf-1-area-0.0.0.0]network 10.10.4.4 0.0.0.0
[SW4-ospf-1-area-0.0.0.0]network 10.20.4.4 0.0.0.0
复制代码 
	因为SW1和SW2需要被分割为两台设备，分别与上下行链路设备连接，故需要先创建VRF空间
其中GE0/0/3---GE0/0/6接口属于该VRF空间

VRF空间配置
	名称：VRF
	RD：100:1
	RT：100:1
bash 复制代码 
[SW1]ip vpn-instance VRF
[SW1-vpn-instance-VRF]route-distinguisher 100:1
[SW1-vpn-instance-VRF]route-distinguisher 100:1
#SW2同样此配置
[SW1]vlan batch 102 103 104
[SW1-GigabitEthernet0/0/5]port link-type access 
[SW1-GigabitEthernet0/0/5]port default vlan 103
[SW1-GigabitEthernet0/0/5]undo stp enable 
[SW1-GigabitEthernet0/0/6]port link-type access
[SW1-GigabitEthernet0/0/6]port default vlan 104
[SW1-GigabitEthernet0/0/6]undo stp enable 

[SW1-GigabitEthernet0/0/4]port link-type trunk 
[SW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 102
[SW1-GigabitEthernet0/0/4]undo  port trunk allow-pass vlan 1
[SW1-GigabitEthernet0/0/4]undo stp enable 

[SW2]vlan  batch 102 203 204
[SW2-GigabitEthernet0/0/5]port link-type access 
[SW2-GigabitEthernet0/0/5]port default vlan 204
[SW2-GigabitEthernet0/0/5]undo stp enable
[SW2-GigabitEthernet0/0/6]port link-type access
[SW2-GigabitEthernet0/0/6]port default vlan 203
[SW2-GigabitEthernet0/0/6]undo stp enable
#删去access配置
SW2-GigabitEthernet0/0/4]undo port default vlan
	
[SW2-GigabitEthernet0/0/4]port trunk allow-pass vlan 
[SW2-GigabitEthernet0/0/4]port trunk allow-pass vlan 102
[SW2-GigabitEthernet0/0/4]undo  port trunk allow-pass vlan 1

#将该接口绑定到名称为VRF的vpn空间
[SW1-Vlanif102]ip binding vpn-instance VRF  
[SW1-Vlanif102]ip address 10.10.2.1 24
[SW1-Vlanif103]ip binding vpn-instance VRF
[SW1-Vlanif103]ip address 10.10.3.1 24
[SW1-Vlanif104]ip binding vpn-instance VRF
[SW1-Vlanif104]ip address 10.10.4.1 24

[SW2-Vlanif102]ip binding vpn-instance VRF
[SW2-Vlanif102]ip address 10.10.2.2 24
[SW2-Vlanif203]ip binding vpn-instance VRF
[SW2-Vlanif203]ip address 10.20.3.2 24
[SW2-Vlanif204]ip binding vpn-instance VRF
[SW2-Vlanif204]ip address 10.20.4.2 24
#将ospf1与VRF空间绑定
[SW1]ospf 1 router-id 1.1.1.1 vpn-instance VRF
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 10.10.2.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.10.3.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.10.4.1 0.0.0.0
#sw2也宣告

[SW3-Vlanif203]ospf cost 5  #sw4同理
复制代码 
SW1:
去往192.168.2.0/24，发送给SW3，备份为SW4
去往192.168.3.0/24，发送给SW4，备份为SW3
bash 复制代码 
[SW3]ip ip-prefix aa permit 192.168.3.0 24
[SW3]ip ip-prefix bb permit 192.168.2.0 24

[SW3]route-policy aa permit node 10
[SW3-route-policy]if-match ip-prefix aa
[SW3-route-policy]apply  cost 5
[sw3]route-policy aa permit node 20
[sw3-route-policy]if-match ip-prefix bb
[sw3-ospf-1]import-route direct route-policy aa

VRF交换机与防火墙

bash 复制代码 
[SW1]vlan batch 401 402
[SW1-GigabitEthernet0/0/3]port link-type trunk 
[SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 401 402
[SW1-GigabitEthernet0/0/4]port link-type trunk
[SW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 401 402
[SW1-Vlanif401]ip binding vpn-instance VRF
[SW1-Vlanif401]ip address 10.40.1.1 24
[SW1-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100
[SW1-Vlanif401]vrrp vrid 1 priority 120
[SW1-Vlanif401]vrrp vrid 1 preempt-mode timer delay 60
[SW1-Vlanif401]vrrp vrid 1 track interface GigabitEthernet 0/0/3 reduced 30
[SW1-Vlanif402]ip  binding  vpn-instance VRF
[SW1-Vlanif402]ip address 10.40.2.1 24
[SW1-Vlanif402]vrrp vrid 2 virtual-ip 10.40.2.100
#SW2同理
相关推荐
188号安全攻城狮1 小时前
【PWN】HappyNewYearCTF_8_ret2csu
linux·汇编·安全·网络安全·系统安全
啥都想学点1 小时前
kali 基础介绍(Command and Control、Exfiltration)
安全·网络安全
Magnum Lehar1 小时前
macos信息采集器appledataharvester-3
macos·网络安全·系统安全
浩浩测试一下2 小时前
WAF绕过之编码绕过特性篇
计算机网络·web安全·网络安全·网络攻击模型·安全威胁分析·安全架构
Magnum Lehar5 小时前
macos的信息采集器appledataHarvester-2
macos·网络安全·系统安全
枷锁—sha8 小时前
【CTFshow-pwn系列】06_前置基础【pwn 035】详解：利用 SIGSEGV 信号处理机制
java·开发语言·安全·网络安全·信号处理
勒索病毒前线8 小时前
深度硬核｜.xr勒索病毒逆向分析与数据救援实战指南（附IOCs排查脚本）
网络安全·黑客攻击·勒索病毒·网络攻击溯源·.xr后缀病毒
五五六六05248 小时前
adb server is out of date. killing...问题的解决
网络安全·adb
汤愈韬9 小时前
DHCP Server服务器拒绝攻击、DHCP Server服务器拒绝攻击防范、端口安全
网络协议·网络安全·security
刘婉晴18 小时前
【kali渗透测试】暴力破解
网络安全·渗透测试
热门推荐
01GitHub 镜像站点02Clawdbot 中文汉化版 接入微信、飞书03OpenCode 入门教程：介绍 · 安装 · 配置第三方 API (如 Claude)042026美赛A题智能手机电池续航时间预测的连续时间数学模型052025 年大语言模型发展回顾：关键突破、意外转折与 2026 年展望06【Milvus】向量数据库pymilvus使用教程072026数学建模美赛题目特点与选题建议，常用四大模型汇总08Claude Code + GLM4.7 避坑指南：解决 Unable to connect to Anthropic services09Claude Code Skills 实用使用手册10Linux下V2Ray安装配置指南