特殊场景:H3C防火墙堆叠主备二层透明配置

场景说明:H3C F1000系列防火墙堆叠,主备使用,上下行连接交换机,交换机为锐捷交换机。流量正常通过左边链路转发,左边上下任意链路故障后,走右边链路。

思路:期初打算双活配置防火墙,在防火墙双活二层透明的配置后会对DPI功能损耗,也就是华为的统一UTM功能,AV、IPS这些功能,因此采用了主备方式,再就是由于上联是锐捷交换机,锐捷交换机不支持LACP下设置最大活动端口数的功能,因此上下联交换机不能配置聚合,锐捷采用REUP功能来实现链路主备,也就是华三这边的Smart-link功能,因此在模拟器中上下联的交换机采用Smart-Link配置。防火墙中聚合配置采用静态聚合。

防火墙配置:

#
 sysname FW-1
#
 irf domain 10
 irf mac-address persistent timer
 irf auto-update enable
 undo irf link-delay
 irf member 1 priority 32
 irf member 2 priority 30
#
vlan 1
#
vlan 10
#
irf-port 1/2
 port group interface GigabitEthernet1/0/1
 port group interface GigabitEthernet1/0/2
#
irf-port 2/1
 port group interface GigabitEthernet2/0/1
 port group interface GigabitEthernet2/0/2
#
collaboration-group 1  //配置接口联动组1,主要针对左边端口
#
collaboration-group 2  //配置接口联动组1,主要针对右边端口
#
interface Bridge-Aggregation1
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 link-aggregation selected-port maximum 1 //配置对上联聚合端口下最大活动端口数量为1
#
interface Bridge-Aggregation2
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 link-aggregation selected-port maximum 1 //配置下联聚合端口下最大活动端口数量为1
#
interface Route-Aggregation1
 mad bfd enable
 mad ip address 1.1.1.1 255.255.255.252 member 1
 mad ip address 1.1.1.2 255.255.255.252 member 2
#
interface NULL0
#
interface GigabitEthernet1/0/0
 port link-mode route
 combo enable copper
 port link-aggregation group 1
#
interface GigabitEthernet2/0/0
 port link-mode route
 combo enable copper
 port link-aggregation group 1
#
interface GigabitEthernet1/0/3
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 combo enable copper
 port collaboration-group 1
 link-aggregation port-priority 4096 //提升接口优先级,让其在聚合中被select
 port link-aggregation group 1
#
interface GigabitEthernet1/0/4
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 combo enable copper
 port collaboration-group 1
 link-aggregation port-priority 4096  //提升接口优先级,让其在聚合中被select
 port link-aggregation group 2
#
interface GigabitEthernet2/0/3
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 combo enable copper
 port collaboration-group 2
 port link-aggregation group 1
#
interface GigabitEthernet2/0/4
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 combo enable copper
 port collaboration-group 2
 port link-aggregation group 2
#
security-zone name Local
#
security-zone name Trust
 import interface Bridge-Aggregation2 vlan 10
#
security-zone name DMZ
#
security-zone name Untrust
 import interface Bridge-Aggregation1 vlan 10
#
security-zone name Management
#
 session synchronization enable
 session synchronization dns http
#
 ip http enable
 ip https enable
#
security-policy ip
 rule 0 name Trust_Untrust_VLAN-10
  action pass
  source-zone Trust
  destination-zone Untrust
#

SW-3/SW-4配置:

#
 sysname SW-3
vlan 1
#
vlan 10
#
 stp global enable
#
smart-link group 1  
 preemption mode role   //开启Smart-link抢占模式
 protected-vlan reference-instance 0 
#
interface NULL0
#
interface Vlan-interface10
 ip address 192.168.10.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 combo enable fiber
 undo stp enable
 port smart-link group 1 primary
#
interface GigabitEthernet1/0/2
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10
 combo enable fiber
 undo stp enable
 port smart-link group 1 secondary
#
return

防火墙聚合口状态:

交换机Smart-link状态:

此时通讯正常,关闭防火墙端口GE1/0/3,将流量由左边切换到右边。

SW-3/SW-4 smart-link状态

此时通讯状态:

此时将GE1/0/3接口恢复,1秒后发生抢占,流量从右边切换到左边。

总结:本次针对特殊场景和特殊需求进行的实验,主要是华三防火墙是个堆叠场景,实际可以通过H3C防火墙新版的HA配置方式来解决该问题,配置可以简单一些。

发表评论

您的电子邮箱地址不会被公开。

此站点使用Akismet来减少垃圾评论。了解我们如何处理您的评论数据