需求：
sw3的流量
正常：sw1--->FW1--->sw1--->R5
故障：sw2--->FW2--->sw2--->R6
sw4的流量
正常：sw2--->FW2--->sw2--->R6
故障：sw1--->FW1--->sw1--->R5
sw1和sw2是核心层设备，sw3和sw4是汇聚层设备
纯三层设备，ospf实现汇聚到核心的路由配置
sw3基础配置
sw3配置vlan
sw3v b 2 3
sw3int g0/0/3
sw3-GigabitEthernet0/0/3po li t
sw3-GigabitEthernet0/0/3po t a v 2 3
sw3-GigabitEthernet0/0/3int g0/0/4
sw3-GigabitEthernet0/0/4po li t
sw3-GigabitEthernet0/0/4po t a v 2 3
SW3开启生成树
sw3stp region-configuration
sw3-mst-regionregion-name aa
sw3-mst-regioninstance 1 vlan 2
sw3-mst-regioninstance 2 vlan 3
sw3-mst-regionactive region-configuration
sw3作为vlan2的主网关，vlan3的备网关，三点合一，主网关，主根桥，汇聚层设备
sw3stp instance 1 root primary
sw3stp instance 2 root secondary
sw3配置vrrp
sw3interface Vlanif 2
sw3-Vlanif2ip address 192.168.2.1 24
sw3-Vlanif2vrrp vrid 1 virtual-ip 192.168.2.254
sw3-Vlanif2vrrp vrid 1 priority 120 （作为主网关设置优先级为120，默认为100）
sw3-Vlanif2vrrp vrid 1 preempt-mode timer delay 20 （设置抢占延迟为20s，默认立即抢占）
g0/0/1和g0/0/2两个接口都出现故障
----->>>要进行vrrp网关切换：1.主网关主动放弃主动降低优先级 2.出现故障
上行链路监控（同时监控两个接口）
----->当两个接口都出现问题的时候，则直接切换为sw4
sw3-Vlanif2vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15
sw3-Vlanif2vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15
sw3interface Vlanif 3
sw3-Vlanif3ip add 192.168.3.1 24
sw3-Vlanif3vrrp vrid 1 virtual-ip 192.168.3.254
sw4基础配置
sw4配置vlan
sw4v b 2 3
sw4int g0/0/3
sw4-GigabitEthernet0/0/3po li t
sw4-GigabitEthernet0/0/3po t a v 2 3
sw4int g0/0/4
sw4-GigabitEthernet0/0/4po li t
sw4-GigabitEthernet0/0/4po t a v 2 3
配置stp生成树
sw4stp region-configuration
sw4-mst-regionregion-name aa
sw4-mst-regioninstance 1 vlan 2
sw4-mst-regioninstance 2 vlan 3
sw4-mst-regionactive region-configuration
sw4stp instance 1 root secondary
sw4stp instance 2 root primary
sw4interface Vlanif 2
sw4-Vlanif2ip address 192.168.2.2 24
sw4-Vlanif2vrrp vrid 1 virtual-ip 192.168.2.254
sw4interface Vlanif 3
sw4-Vlanif3ip address 192.168.3.2 24
sw4-Vlanif3vrrp vrid 1 virtual-ip 192.168.3.254
sw4-Vlanif3vrrp vrid 1 priority 120
sw4-Vlanif3vrrp vrid 1 preempt-mode timer delay 20
上行链路监控
sw4-Vlanif3vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15
sw4-Vlanif3vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15
sw3和sw4查看vrrp信息
[sw3]display vrrp brief
VRID State Interface Type Virtual IP
----------------------------------------------------------------
1 Master Vlanif2 Normal 192.168.2.254
1 Backup Vlanif3 Normal 192.168.3.254
----------------------------------------------------------------
Total:2 Master:1 Backup:1 Non-active:0
[sw4]display vrrp brief
VRID State Interface Type Virtual IP
----------------------------------------------------------------
1 Backup Vlanif2 Normal 192.168.2.254
1 Master Vlanif3 Normal 192.168.3.254
----------------------------------------------------------------
Total:2 Master:1 Backup:1 Non-active:0sw5配置vlan信息
sw5int g0/0/1
sw5-GigabitEthernet0/0/1po li t
sw5-GigabitEthernet0/0/1po t a v 2 3
sw5-GigabitEthernet0/0/1int g0/0/2
sw5-GigabitEthernet0/0/2po li t
sw5-GigabitEthernet0/0/2po t a v 2 3
sw5-GigabitEthernet0/0/2int g0/0/3
sw5-GigabitEthernet0/0/3po li ac
sw5-GigabitEthernet0/0/3po de v 2
sw5-GigabitEthernet0/0/3int g0/0/4
sw5-GigabitEthernet0/0/4po li ac
sw5-GigabitEthernet0/0/4po de v 3
sw5stp region-configuration
sw5-mst-region region-name aa
sw5-mst-region instance 1 vlan 2
sw5-mst-region instance 2 vlan 3
sw5-mst-region active region-configuration
[sw5]display stp brief
MSTID Port Role STP State Protection
0 GigabitEthernet0/0/1 ALTE DISCARDING NONE
0 GigabitEthernet0/0/2 ROOT FORWARDING NONE
0 GigabitEthernet0/0/3 DESI DISCARDING NONE
0 GigabitEthernet0/0/4 DESI DISCARDING NONE
1 GigabitEthernet0/0/1 ROOT FORWARDING NONE （根接口）
1 GigabitEthernet0/0/2 ALTE DISCARDING NONE （被阻塞）
1 GigabitEthernet0/0/3 DESI DISCARDING NONE （指定）
2 GigabitEthernet0/0/1 ALTE DISCARDING NONE （被阻塞）
2 GigabitEthernet0/0/2 ROOT FORWARDING NONE （根接口）
2 GigabitEthernet0/0/4 DESI DISCARDING NONE （指定）sw1--->sw2：VLAN 102 --- 10.10.2.0/24
sw1--->sw3：VLAN 103 --- 10.10.3.0/24
sw1--->sw4：VLAN 104 --- 10.10.4.0/24
sw2--->sw3：VLAN 203 --- 10.20.3.0/24
sw2--->sw4：VLAN 204 ---10.20.4.0/24
交换机和交换机之间用trunk应用于二层设备
四个交换机之间跑的是三层数据，核心点是IP不在VLAN，用vlan是要找一个可以配IP的接口，重点是放通对应vlan传递IP地址即可，所以用access（向上发送报文不带vlan信息）
交换机sw3运行生成树，vlan103在实例0中(默认运行mstp)
四台交换机中都有实例0，默认运行mstp，有一部分信息会被阻塞，因为有环。
两种解决方法：（1）关闭生成树（2）给每一个vlan划一个实例
sw3v b 103 203
sw3int GigabitEthernet 0/0/1
sw3-GigabitEthernet0/0/1po li ac
sw3-GigabitEthernet0/0/1po de v 103
sw3-GigabitEthernet0/0/1undo stp enable
sw3-GigabitEthernet0/0/1int g0/0/2
sw3-GigabitEthernet0/0/2po li ac
sw3-GigabitEthernet0/0/2po de v 203
sw3-GigabitEthernet0/0/2undo stp enable
sw3interface Vlanif 103
sw3-Vlanif103ip address 10.10.3.3 24
sw3interface Vlanif 104
sw3-Vlanif203ip address 10.20.3.3 24
ospf
sw3ospf 1 router-id 3.3.3.3
sw3-ospf-1a 0
sw3-ospf-1-area-0.0.0.0network 10.10.3.3 0.0.0.0
sw3-ospf-1-area-0.0.0.0network 10.20.3.3 0.0.0.0
要干涉选路，所以pc1和pc2网关先不宣告
sw4v b 104 204
sw4int g0/0/1
sw4-GigabitEthernet0/0/1po li ac
sw4-GigabitEthernet0/0/1po de v 204
sw4-GigabitEthernet0/0/1undo stp enable
sw4-GigabitEthernet0/0/1int g0/0/2
sw4-GigabitEthernet0/0/2po li ac
sw4-GigabitEthernet0/0/2po de v 104
sw4-GigabitEthernet0/0/2undo stp enable
sw4interface Vlanif 104
sw4-Vlanif104ip add 10.10.4.4 24
sw4interface Vlanif 204
sw4-Vlanif204ip add 10.20.4.4 24
ospf
sw4ospf 1 router-id 4.4.4.4
sw4-ospf-1a 0
sw4-ospf-1-area-0.0.0.0network 10.10.4.4 0.0.0.0
sw4-ospf-1-area-0.0.0.0network 10.20.4.4 0.0.0.0
sw1和sw2，每一个设备分为两个设备
VRF配置信息：
名称：VRF
RD：100:1
RT：100:1
创建VRF空间
sw1-vpn-instance-VRFroute-distinguisher 100:1
sw1-vpn-instance-VRF-af-ipv4vpn-target 100:1 export-extcommunity
sw1-vpn-instance-VRF-af-ipv4vpn-target 100:1 import-extcommunity
sw1vlan batch 102 103 104
sw1int g0/0/5
sw1-GigabitEthernet0/0/5po li a
sw1-GigabitEthernet0/0/5po de v 103
sw1-GigabitEthernet0/0/5undo stp enable
sw1int g0/0/6
sw1-GigabitEthernet0/0/6po li a
sw1-GigabitEthernet0/0/6po de v 104
sw1-GigabitEthernet0/0/6undo stp enable
物理设备和创建的VRF，sw1的g0/0/1和g0/0/7放在一个区域中，g0/0/2和g0/0/5放在一个区域中，g0/0/2和g0/0/4会放在不同区域中
g0/0/4配置trunk链路
sw1int g0/0/4
sw1-GigabitEthernet0/0/4po li t
sw1-GigabitEthernet0/0/6po t a v 102
sw1-GigabitEthernet0/0/4undo port trunk allow-pass vlan 1
sw1-GigabitEthernet0/0/4undo stp enable
sw2ip vpn-instance VRF
sw2-vpn-instance-VRFroute-distinguisher 100:1
sw2-vpn-instance-VRF-af-ipv4vpn-target 100:1 both
sw2vlan batch 102 203 204
sw2int g0/0/5
sw2-GigabitEthernet0/0/5po li a
sw2-GigabitEthernet0/0/5po de v 104
sw2int g0/0/6
sw2-GigabitEthernet0/0/6po li a
sw2-GigabitEthernet0/0/6po de v 203
sw2int g0/0/4
sw2-GigabitEthernet0/0/5po li t
sw2-GigabitEthernet0/0/5po t a v 102
sw2-GigabitEthernet0/0/4undo port trunk allow-pass vlan 1
sw2-GigabitEthernet0/0/4undo stp enable
sw1---g0/0/5:103---g0/0/6:104---g0/0/4:102--g0/0/3属于特殊虚拟VRF接口
sw1interface Vlanif 102
sw1-Vlanif102ip binding vpn-instance VRF
sw1-Vlanif102ip address 10.10.2.1 24
sw1interface Vlanif 103
sw1-Vlanif103ip binding vpn-instance VRF
sw1-Vlanif103ip address 10.10.3.1 24
sw1interface Vlanif 104
sw1-Vlanif104ip binding vpn-instance VRF
sw1-Vlanif104ip address 10.10.4.1 24
sw2interface Vlanif 102
sw2-Vlanif102ip binding vpn-instance VRF
sw2-Vlanif102ip address 10.10.2.2 24
sw2interface Vlanif 203
sw2-Vlanif203ip binding vpn-instance VRF
sw2-Vlanif203ip address 10.20.3.2 24
sw2interface Vlanif 204
sw2-Vlanif204ip binding vpn-instance VRF
sw2-Vlanif204ip address 10.20.4.2 24
测试连通性sw3pingsw1
sw3pingsw2
sw1pingsw3不通
原因：sw1路由表中没有10.10.3.0网段，第一个查的是全局路由表，应该查关于VRF的路由表，ping也是
因为是在VRF空间写的，所以ping的时候也要加上VRF空间，才可以ping通
在VRF区域配置ospf进程
sw1ospf 1 router-id 1.1.1.1 vpn-instance VRF
sw1-ospf-1a 0
sw1-ospf-1-area-0.0.0.0network 10.10.2.1 0.0.0.0
sw1-ospf-1-area-0.0.0.0network 10.10.3.1 0.0.0.0
sw1-ospf-1-area-0.0.0.0network 10.10.4.1 0.0.0.0
sw1ospf 1 router-id 2.2.2.2 vpn-instance VRF
sw1-ospf-1a 0
sw1-ospf-1-area-0.0.0.0network 10.10.2.2 0.0.0.0
sw1-ospf-1-area-0.0.0.0network 10.20.2.2 0.0.0.0
sw1-ospf-1-area-0.0.0.0network 10.20.3.2 0.0.0.0
查看邻居表
<sw3>display ospf peer brief
OSPF Process 1 with Router ID 3.3.3.3
Peer Statistic Information
-------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 Vlanif103 1.1.1.1 Full
0.0.0.0 Vlanif203 2.2.2.2 Full
-------------------------------------------------------------------------路由的引导---策略干涉(路由策略，ospf开销值)
上行流量：sw3主流量发给sw1，备份发给sw2（sw4主流量发给sw2，备份发给sw1）
下行流量：sw1访问2.0网关，发给sw3备份发给sw4（3.0发给sw4，备份发给sw3）
回程流量，下行流量（2.0---vlan2---sw3主网关），上行流量缺省走，不用区分
改开销值
sw3interface Vlanif 203
sw3-Vlanif203ospf cost 5
sw4
sw4interface Vlanif 104
sw4-Vlanif104ospf cost 5
ospf干涉路由，域外路由引入的时候干涉
sw3ip ip-prefix aa permit 192.168.3.0 24
sw3ip ip-prefix bb permit 192.168.2.0 24
sw3route-policy aa permit node 10 （3.0改大）
sw3-route-policyapply cost 5
sw3route-policy aa permit node 20 （放通2.0）
sw3-route-policyif-match ip-prefix bb
sw3ospf
sw3-ospf-1import-route direct route-policy aa （宣告直连）
sw4
sw4ip ip-prefix aa permit 192.168.2.0 24
sw4ip ip-prefix bb permit 192.168.3.0 24
sw4route-policy aa permit node 10
sw4-route-policyif-match ip-prefix aa
sw4-route-policyapply cost 5
sw4-route-policyq
sw4route-policy aa permit node 20
sw4-route-policyif-match ip-prefix bb
sw4-route-policyq
sw4ospf 1
sw4-ospf-1import-route direct route-policy aa
<sw1>display ospf lsdb
OSPF Process 1 with Router ID 1.1.1.1
Link State Database
Area: 0.0.0.0
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 4.4.4.4 4.4.4.4 10 48 80000007 5
Router 2.2.2.2 2.2.2.2 270 48 80000007 1
Router 1.1.1.1 1.1.1.1 269 60 80000008 1
Router 3.3.3.3 3.3.3.3 265 48 80000007 1
Network 10.10.3.3 3.3.3.3 265 32 80000002 0
Network 10.10.4.4 4.4.4.4 266 32 80000002 0
Network 10.10.2.2 2.2.2.2 270 32 80000001 0
Network 10.20.3.3 3.3.3.3 266 32 80000002 0
AS External Database
Type LinkState ID AdvRouter Age Len Sequence Metric
External 192.168.2.0 3.3.3.3 314 36 80000001 1
External 192.168.2.0 4.4.4.4 10 36 80000001 5
External 192.168.3.0 3.3.3.3 314 36 80000001 5
External 192.168.3.0 4.4.4.4 10 36 80000001 1FW1-FW2-SW1-SW2
VRRP备份组1 --- VRRP备份组5
VRRP备份组2 --- VRRP备份组6 --- 402
VRRP备份组3 --- VRRP备份组7 --- 403
VRRP备份组4 --- VRRP备份组8 --- 404
VRRP备份组1，VRF使用，sw1为主，sw2为备
VLAN 401 --- 10.40.1.0/24
sw1：10.40.1.1/24
sw2：10.40.1.2/24
虚拟IP：10.40.1.100
VRRP备份组5，FW使用，FW1为主，FW2为备
VALN 401 --- 10.40.1.0/24
FW1：10.40.1.10/24
FW2：10.40.1.20/24
虚拟IP：10.40.1.200
sw1
sw1vlan batch 401 402
sw1int g0/0/3
sw1-GigabitEthernet0/0/3po li t
sw1-GigabitEthernet0/0/3po t a v 401 402
sw1-GigabitEthernet0/0/3int g0/0/4
sw1-GigabitEthernet0/0/4po li t
sw1-GigabitEthernet0/0/4po t a v 401 402
sw1interface Vlanif 401
sw1-Vlanif401ip binding vpn-instance VRF
sw1-Vlanif401ip address 10.40.1.1 24
sw1-Vlanif401vrrp vrid 1 virtual-ip 10.40.1.100
sw1-Vlanif401vrrp vrid 1 priority 120
sw1-Vlanif401vrrp vrid 1 preempt-mode timer delay 60
sw1-Vlanif401vrrp vrid 1 track interface GigabitEthernet 0/0/3 reduced 30
sw1interface Vlanif 402
sw1-Vlanif402ip binding vpn-instance VRF
sw1-Vlanif402ip address 10.40.2.1 24
sw1-Vlanif402vrrp vrid 2 virtual-ip 10.40.2.100
sw2
sw2vlan batch 401 402
sw2int g0/0/3
sw2-GigabitEthernet0/0/3po li t
sw2-GigabitEthernet0/0/3po t a v 401 402
sw2-GigabitEthernet0/0/3int g0/0/4
sw2-GigabitEthernet0/0/4po li t
sw2-GigabitEthernet0/0/4po t a v 401 402
sw2interface Vlanif 401
sw2-Vlanif401ip binding vpn-instance VRF
sw2-Vlanif401ip address 10.40.1.2 24
sw2-Vlanif401vrrp vrid 1 virtual-ip 10.40.1.100
sw2-Vlanif401q
sw2interface Vlanif 402
sw2-Vlanif402ip binding vpn-instance VRF
sw2-Vlanif402ip address 10.40.2.2 24
sw2-Vlanif402vrrp vrid 2 virtual-ip 10.40.2.100
sw2-Vlanif402vrrp vrid 2 priority 120
sw2-Vlanif402vrrp vrid 2 preempt-mode timer delay 60
sw2-Vlanif402vrrp vrid 2 track interface GigabitEthernet 0/0/3 reduced 30
[sw2]display vrrp brief
VRID State Interface Type Virtual IP
----------------------------------------------------------------
1 Backup Vlanif401 Normal 10.40.1.100
1 Master Vlanif402 Normal 10.40.2.100
----------------------------------------------------------------
Total:2 Master:1 Backup:1 Non-active:0 FW1
FW1vlan batch 401 to 402
FW1int g1/0/0
FW1-GigabitEthernet1/0/0ip address 10.10.10.1 30
FW1int g1/0/2.401
FW1-GigabitEthernet1/0/2.401ip address 10.40.1.10 24
FW1-GigabitEthernet1/0/2.401vlan-type dot1q 401
FW1int g1/0/2.402
FW1-GigabitEthernet1/0/2.402ip address 10.40.2.10 24
FW1-GigabitEthernet1/0/2.402vlan-type dot1q 402
FW1int g1/0/3.403
FW1-GigabitEthernet1/0/3.403ip address 10.40.3.10 24
FW1-GigabitEthernet1/0/3.403vlan-type dot1q 403
FW1int g1/0/3.404
FW1-GigabitEthernet1/0/3.404ip address 10.40.4.10 24
FW1-GigabitEthernet1/0/3.404vlan-type dot1q 404
FW1firewall zone trust
FW1-zone-trustadd interface GigabitEthernet 1/0/2.401
FW1-zone-trustadd interface GigabitEthernet 1/0/2.402
FW1-zone-trustq
FW1firewall zone untrust
FW1-zone-untrustadd interface GigabitEthernet 1/0/3.403
FW1-zone-untrustadd interface GigabitEthernet 1/0/3.404
FW1firewall zone dmz
FW1-zone-dmzadd interface GigabitEthernet 1/0/0
双机热备
FW1interface GigabitEthernet 1/0/2.401
FW1-GigabitEthernet1/0/2.401vrrp vrid 5 virtual-ip 10.40.1.200 active （主用设备）
FW1interface GigabitEthernet 1/0/2.402
FW1-GigabitEthernet1/0/2.402vrrp vrid 6 virtual-ip 10.40.2.200 standby
FW1interface GigabitEthernet 1/0/3.403
FW1-GigabitEthernet1/0/3.403vrrp vrid 7 virtual-ip 10.40.3.200 active
FW1int g1/0/3.404
FW1-GigabitEthernet1/0/3.404vrrp vrid 8 virtual-ip 10.40.4.200 standby
FW1hrp mirror session enable （会话快速备份功能）
FW1hrp interface GigabitEthernet 1/0/0 remote 10.10.10.2 （连接心跳线以及对端IP）
FW1hrp enable （设备启动）
HRP_MFW1ip route-static 0.0.0.0 0 10.40.3.100 （写路由）
HRP_MFW1ip route-static 0.0.0.0 0 10.40.4.100 preference 70 （浮动静态路由）
HRP_MFW1ip route-static 192.168.0.0 16 10.40.1.100
HRP_MFW1ip route-static 192.168.0.0 16 10.40.2.100 preference 70
FW2
FW2vlan batch 401 to 404
FW2int g1/0/0 （心跳线）
FW2-GigabitEthernet1/0/0ip address 10.10.10.2 30
FW2-GigabitEthernet1/0/0int g1/0/2.401
FW2-GigabitEthernet1/0/2.401ip address 10.40.1.20 24
FW2-GigabitEthernet1/0/2.401vlan-type dot1q 401
FW2-GigabitEthernet1/0/2.401int g1/0/2.402
FW2-GigabitEthernet1/0/2.402ip address 10.40.2.20 24
FW2-GigabitEthernet1/0/2.402vlan-type dot1q 402
FW2int g1/0/3.403
FW2-GigabitEthernet1/0/3.403ip address 10.40.3.20 24
FW2-GigabitEthernet1/0/3.403vlan-type dot1q 403
FW2int g1/0/3.404
FW2-GigabitEthernet1/0/3.404ip address 10.40.4.20 24
FW2-GigabitEthernet1/0/3.404vlan-type dot1q 404
FW2firewall zone trust
FW2-zone-trustadd interface GigabitEthernet 1/0/2.401
FW2-zone-trustadd interface GigabitEthernet 1/0/2.402
FW2-zone-trustq
FW2firewall zone untrust
FW2-zone-untrustadd interface GigabitEthernet 1/0/3.403
FW2-zone-untrustadd interface GigabitEthernet 1/0/3.404
FW2-zone-untrustq
FW2firewall zone dmz
FW2-zone-dmzadd interface GigabitEthernet 1/0/0
双机热备
FW2int GigabitEthernet 1/0/2.401
FW2-GigabitEthernet1/0/2.401vrrp vrid 5 virtual-ip 10.40.1.200 standby
FW2-GigabitEthernet1/0/2.401int g1/0/2.402
FW2-GigabitEthernet1/0/2.402vrrp vrid 6 virtual-ip 10.40.2.200 active
FW2-GigabitEthernet1/0/2.402int g1/0/3.403
FW2-GigabitEthernet1/0/3.403vrrp vrid 7 virtual-ip 10.40.3.200 standby
FW2-GigabitEthernet1/0/3.403int g1/0/3.404
FW2-GigabitEthernet1/0/3.404vrrp vrid 8 virtual-ip 10.40.4.200 active
FW2-GigabitEthernet1/0/3.404q
FW2hrp mirror session enable
FW2hrp interface GigabitEthernet 1/0/0 remote 10.10.10.1
FW2hrp enable
HRP_SFW2ip route-static 0.0.0.0 0 10.40.4.100
HRP_SFW2ip route-static 0.0.0.0 0 10.40.3.100 preference 70
HRP_SFW2ip route-static 192.168.0.0 16 10.40.2.100
HRP_SFW2ip route-static 192.168.0.0 16 10.40.1.100 preference 70
HRP_M[FW1]display vrrp brief
2026-08-09 11:29:19.740
Total:4 Master:2 Backup:2 Non-active:0
VRID State Interface Type Virtual IP
----------------------------------------------------------------
5 Master GE1/0/2.401 Vgmp 10.40.1.200
6 Backup GE1/0/2.402 Vgmp 10.40.2.200
7 Master GE1/0/3.403 Vgmp 10.40.3.200
8 Backup GE1/0/3.404 Vgmp 10.40.4.200
HRP_M[FW1]
HRP_S[FW2]display vrrp brief
2026-08-09 11:31:30.370
Total:4 Master:2 Backup:2 Non-active:0
VRID State Interface Type Virtual IP
----------------------------------------------------------------
5 Backup GE1/0/2.401 Vgmp 10.40.1.200
6 Master GE1/0/2.402 Vgmp 10.40.2.200
7 Backup GE1/0/3.403 Vgmp 10.40.3.200
8 Master GE1/0/3.404 Vgmp 10.40.4.200
HRP_S[FW2]安全策略（FW1主设备写）
HRP_MFW1security-policy (+B)
HRP_MFW1-policy-securityrule name t_to_un (+B)
HRP_MFW1-policy-security-rule-t_to_unsource-zone trust (+B)
HRP_MFW1-policy-security-rule-t_to_undestination-zone untrust (+B)
HRP_MFW1-policy-security-rule-t_to_unsource-address 192.168.0.0 16 (+B)
HRP_MFW1-policy-security-rule-t_to_unaction permit (+B)
HRP_MFW1-policy-security-rule-t_to_unq
sw1与sw2配置
配置vlan 403 404
sw1配置vlan 403 404
sw1vlan batch 403 404
sw1int g0/0/1
sw1-GigabitEthernet0/0/1po li t
sw1-GigabitEthernet0/0/1po t a v 403 404
sw1int g0/0/2
sw1-GigabitEthernet0/0/2po li t
sw1-GigabitEthernet0/0/2po t a v 403 404
sw1interface Vlanif 403
sw1-Vlanif403ip address 10.40.3.1 24
sw1-Vlanif403vrrp vrid 3 virtual-ip 10.40.3.100
sw1-Vlanif403vrrp vrid 3 priority 120
sw1-Vlanif403vrrp vrid 3 preempt-mode timer delay 60
sw1-Vlanif403vrrp vrid 3 track interface GigabitEthernet 0/0/1 reduced 30
sw1interface Vlanif 404
sw1-Vlanif404ip address 10.40.4.1 24
sw1-Vlanif404vrrp vrid 4 virtual-ip 10.40.4.100
sw2配置vlan 403 404
sw2vlan batch 403 404
sw2int g0/0/1
sw2-GigabitEthernet0/0/1po li t
sw2-GigabitEthernet0/0/1po t a v 403 404
sw2-GigabitEthernet0/0/1int g0/0/2
sw2-GigabitEthernet0/0/2po t a v 403 404
sw2interface Vlanif 403
sw2-Vlanif403ip address 10.40.3.2 24
sw2-Vlanif403vrrp vrid 3 virtual-ip 10.40.3.100
sw2-Vlanif403q
sw2interface Vlanif 404
sw2-Vlanif404ip address 10.40.4.2 24
sw2-Vlanif404vrrp vrid 4 virtual-ip 10.40.4.100
sw2-Vlanif404vrrp vrid 4 priority 120
sw2-Vlanif404vrrp vrid 4 preempt-mode timer delay 60
sw2-Vlanif404vrrp vrid 4 track interface GigabitEthernet 0/0/1 reduced 30
sw1和sw2查vrrp
[sw1]display vrrp brief
VRID State Interface Type Virtual IP
----------------------------------------------------------------
1 Master Vlanif401 Normal 10.40.1.100
2 Backup Vlanif402 Normal 10.40.2.100
3 Master Vlanif403 Normal 10.40.3.100
4 Backup Vlanif404 Normal 10.40.4.100
----------------------------------------------------------------
Total:4 Master:2 Backup:2 Non-active:0
[sw2]display vrrp brief
VRID State Interface Type Virtual IP
----------------------------------------------------------------
1 Backup Vlanif401 Normal 10.40.1.100
2 Master Vlanif402 Normal 10.40.2.100
3 Backup Vlanif403 Normal 10.40.3.100
4 Master Vlanif404 Normal 10.40.4.100
----------------------------------------------------------------
Total:4 Master:2 Backup:2 Non-active:0 配置VRF路由
sw1配置VRF路由
sw1ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200
sw1ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 preference 70
sw2配置VRF路由
sw2ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200
sw2ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200 preference 70
路由配置
sw1
sw1ip route-static 192.168.0.0 16 10.40.3.200
sw1ip route-static 192.168.0.0 16 10.40.4.200 preference 70
sw2
sw2ip route-static 192.168.0.0 16 10.40.4.200
sw2ip route-static 192.168.0.0 16 10.40.3.200 preference 70
FW激活物理接口
FW1和FW2都是物理接口g1/0/2和g1/0/3激活一样的
HRP_MFW1int g1/0/2 (+B)
HRP_MFW1-GigabitEthernet1/0/2ip address 1.1.1.1 24
HRP_MFW1-GigabitEthernet1/0/2undo ip address 1.1.1.1 24
HRP_MFW1int g1/0/3 (+B)
HRP_MFW1-GigabitEthernet1/0/3ip address 1.1.1.1 24
HRP_MFW1-GigabitEthernet1/0/3undo ip address 1.1.1.1 24
分析sw1-sw2-R5-R6
sw1-sw2，VALN 201 --- 10.20.1.0/24
sw1-R5，VLAN 105 --- 10.10.5.0/24
sw2-R6，VLAN 206 --- 10.20.6.0/24
R5-R6，10.56.0.0/24
配置vlan 201 105 206
sw1配置201 105
sw1vlan batch 201 105
sw1int g0/0/7
sw1-GigabitEthernet0/0/7po li a
sw1-GigabitEthernet0/0/7po de v 105
sw1-GigabitEthernet0/0/7undo stp enable
sw1int g0/0/2
sw1-GigabitEthernet0/0/2po t a v 201
sw1-GigabitEthernet0/0/2undo stp enable
sw1interface Vlanif 105
sw1-Vlanif105ip address 10.10.5.1 24
sw1interface Vlanif 201
sw1-Vlanif201ip address 10.20.1.1 24
sw1ospf 2 router-id 1.1.1.1
sw1-ospf-2a 0
sw1-ospf-2-area-0.0.0.0network 10.10.5.1 0.0.0.0
sw1-ospf-2-area-0.0.0.0network 10.20.1.1 0.0.0.0
sw2配置201 206
sw2vlan batch 201 206
sw2int g0/0/7
sw2-GigabitEthernet0/0/7po li a
sw2-GigabitEthernet0/0/7po de v 206
sw2-GigabitEthernet0/0/7undo stp enable
sw2int g0/0/2
sw2-GigabitEthernet0/0/2po t a v 201
sw2-GigabitEthernet0/0/2undo stp enable
sw2interface Vlanif 201
sw2-Vlanif201ip address 10.20.1.2 24
sw2interface Vlanif 206
sw2-Vlanif206ip address 10.20.6.2 24
sw2ospf 2 router-id 2.2.2.2
sw2-ospf-2a 0
sw2-ospf-2-area-0.0.0.0network 10.20.6.2 0.0.0.0
sw2-ospf-2-area-0.0.0.0network 10.20.1.2 0.0.0.0
R5R6路由器配置
R5接口0/0/0和0/0/1配IP以及ospf
r5int g0/0/0
r5-GigabitEthernet0/0/0ip address 10.10.5.5 24
r5-GigabitEthernet0/0/0int g0/0/1
r5-GigabitEthernet0/0/1ip address 10.56.0.5 24
r5ospf 1 router-id 5.5.5.5
r5-ospf-1a 0
r5-ospf-1-area-0.0.0.0network 10.56.0.5 0.0.0.0
r5-ospf-1-area-0.0.0.0network 10.10.5.5 0.0.0.0
R6接口0/0/0和0/0/1配IP以及ospf
r6int g0/0/0
r6-GigabitEthernet0/0/0ip address 10.20.6.6 24
r6-GigabitEthernet0/0/0int g0/0/1
r6-GigabitEthernet0/0/1ip address 10.56.0.6 24
r6ospf 1 router-id 6.6.6.6
r6-ospf-1a 0
r6-ospf-1-area-0.0.0.0network 10.56.0.6 0.0.0.0
r6-ospf-1-area-0.0.0.0network 10.20.6.6 0.0.0.0
R5接口0/0/2配置以及开启acl
r5int g0/0/2
r5-GigabitEthernet0/0/2ip address 12.0.0.5 24
r5ip route-static 0.0.0.0 0 12.0.0.100
r5ospf 1
r5-ospf-1default-route-advertise
r5acl 2000
r5-acl-basic-2000rule permit source 192.168.0.0 0.0.255.255
r5int g0/0/2
r5-GigabitEthernet0/0/2nat outbound 2000
R6接口0/0/2配置以及开启acl
r6int g0/0/2
r6-GigabitEthernet0/0/2ip address 13.0.0.6 24
r6ip route-static 0.0.0.0 0 13.0.0.100
r6ospf 1
r6-ospf-1default-route-advertise
r6acl 2000
r6-acl-basic-2000rule permit source 192.168.0.0 0.0.255.255
r6int g0/0/2
r6-GigabitEthernet0/0/2nat outbound 2000
ISP配置
ISPint g0/0/0
ISP-GigabitEthernet0/0/0ip address 12.0.0.100 24
ISPint g0/0/1
ISP-GigabitEthernet0/0/1ip address 13.0.0.100 24
ISPinterface LoopBack 0
ISP-LoopBack0ip address 100.1.1.1 24
sw1和sw2将自身静态路由注入OSPF 2进程
sw1ospf 2
sw1-ospf-2import-route static
sw2ospf 2
sw2-ospf-2import-route static
sw1查VRF路由表
<sw1>display ip routing-table vpn-instance VRF
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: VRF
Destinations : 16 Routes : 16
Destination/Mask Proto Pre Cost Flags NextHop Interface
0.0.0.0/0 Static 60 0 RD 10.40.1.200 Vlanif401
10.10.2.0/24 Direct 0 0 D 10.10.2.1 Vlanif102
10.10.2.1/32 Direct 0 0 D 127.0.0.1 Vlanif102
10.10.3.0/24 Direct 0 0 D 10.10.3.1 Vlanif103
10.10.3.1/32 Direct 0 0 D 127.0.0.1 Vlanif103
10.10.4.0/24 Direct 0 0 D 10.10.4.1 Vlanif104
10.10.4.1/32 Direct 0 0 D 127.0.0.1 Vlanif104
10.20.3.0/24 OSPF 10 2 D 10.10.2.2 Vlanif102
10.20.4.0/24 OSPF 10 2 D 10.10.4.4 Vlanif104
10.40.1.0/24 Direct 0 0 D 10.40.1.1 Vlanif401
10.40.1.1/32 Direct 0 0 D 127.0.0.1 Vlanif401
10.40.1.100/32 Direct 0 0 D 127.0.0.1 Vlanif401
10.40.2.0/24 Direct 0 0 D 10.40.2.1 Vlanif402
10.40.2.1/32 Direct 0 0 D 127.0.0.1 Vlanif402
192.168.2.0/24 O_ASE 150 1 D 10.10.3.3 Vlanif103
192.168.3.0/24 O_ASE 150 1 D 10.10.4.4 Vlanif104sw1和sw2将自身静态路由注入OSPF 2进程
sw1ospf 1
sw1-ospf-1default-route-advertise
sw2ospf 1
sw2-ospf-1default-route-advertise
sw3有了缺省路由
<sw3>display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 15 Routes : 15
Destination/Mask Proto Pre Cost Flags NextHop Interface
0.0.0.0/0 O_ASE 150 1 D 10.10.3.1 Vlanif103
10.10.2.0/24 OSPF 10 2 D 10.10.3.1 Vlanif103
10.10.3.0/24 Direct 0 0 D 10.10.3.3 Vlanif103
10.10.3.3/32 Direct 0 0 D 127.0.0.1 Vlanif103
10.10.4.0/24 OSPF 10 2 D 10.10.3.1 Vlanif103
10.20.3.0/24 Direct 0 0 D 10.20.3.3 Vlanif203
10.20.3.3/32 Direct 0 0 D 127.0.0.1 Vlanif203
10.20.4.0/24 OSPF 10 3 D 10.10.3.1 Vlanif103
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
192.168.2.0/24 Direct 0 0 D 192.168.2.1 Vlanif2
192.168.2.1/32 Direct 0 0 D 127.0.0.1 Vlanif2
192.168.2.254/32 Direct 0 0 D 127.0.0.1 Vlanif2
192.168.3.0/24 Direct 0 0 D 192.168.3.1 Vlanif3
192.168.3.1/32 Direct 0 0 D 127.0.0.1 Vlanif3