要求防火墙本身是三层上链路由器三层---防火墙流量引导用ospf协议监控直连接口g1/0/0下链交换机二层---防火墙流量引导用arp协议监控vrrp组PC1和PC2都属于vlan2正常pc1/pc2---sw1---FW1---AR1---ISP当出现相关故障时流量切换为FW2走基础配置[r1]dis ip in b Interface IP Address/Mask Physical Protocol GigabitEthernet0/0/0 10.1.2.2/24 up up GigabitEthernet0/0/1 10.1.4.1/24 up up GigabitEthernet0/0/2 12.0.0.1/24 up up NULL0 unassigned up up(s)r1和r2是出口连接运营商设备各自都有一个缺省路由指向运营商都会有一条静态路由[r1]display current-configuration configuration ospf [V200R003C00] # ospf 1 router-id 1.1.1.1 default-route-advertise 目的:下放缺省路由,告诉fw area 0.0.0.0 network 10.1.2.2 0.0.0.0 network 10.1.4.1 0.0.0.0 # return[r2]dis ip in b Interface IP Address/Mask Physical Protocol GigabitEthernet0/0/0 10.1.3.2/24 up up GigabitEthernet0/0/1 10.1.4.2/24 up up GigabitEthernet0/0/2 13.0.0.1/24 up up NULL0 unassigned up up(s)配置NAT[r1]int g0/0/2 [r1-GigabitEthernet0/0/2]dis th [V200R003C00] # interface GigabitEthernet0/0/2 ip address 12.0.0.1 255.255.255.0 nat outbound 2000 # returnFW做双机热备的前提是接口IP配置路由协议[FW1]dis ip in b Interface IP Address/Mask Physical Protocol GigabitEthernet0/0/0 192.168.0.1/24 up up GigabitEthernet1/0/0 10.1.2.1/24 up up GigabitEthernet1/0/1 192.168.2.1/24 up up GigabitEthernet1/0/2 10.1.1.1/30 up up ---g1/0/2心跳线也要配IP地址[FW2]dis ip in b Interface IP Address/Mask Physical Protocol GigabitEthernet0/0/0 192.168.0.2/24 up up GigabitEthernet1/0/0 10.1.3.1/24 up up GigabitEthernet1/0/1 192.168.2.2/24 up up GigabitEthernet1/0/2 10.1.1.2/30 up up[FW1]firewall zone trust[FW1-zone-trust]add int g1/0/1[FW1]firewall zone untrust[FW1-zone-untrust]add int g1/0/0[FW1]firewall zone name hrp[FW1-zone-hrp]set priority 45 设置优先级[FW1-zone-hrp]add int g1/0/2 心跳线[FW2]firewall zone trust[FW2-zone-trust]add int g1/0/1[FW2]firewall zone untrust[FW2-zone-untrust]add int g1/0/0[FW2]firewall zone name hrp[FW2-zone-hrp]set priority 45[FW2-zone-hrp]add int g1/0/2FW也要配置路由FW1配置路由---web界面[FW1]display current-configuration configuration ospf 2026-08-06 04:05:55.430 # ospf 1 router-id 3.3.3.3 spf-schedule-interval millisecond 5000 # return[FW1]display current-configuration configuration ospf 2026-08-06 04:08:23.970 # ospf 1 router-id 3.3.3.3 spf-schedule-interval millisecond 5000 area 0.0.0.0 network 10.1.1.1 0.0.0.0 network 10.1.2.1 0.0.0.0 # returnFW1的g1/0/1接口虽然没有圈到ospf里面但是也要宣告最后web界面查宣告接口FW2配置路由---命令[FW2]ospf 1 router-id 4.4.4.4[FW2-ospf-1]a 0[FW2-ospf-1-area-0.0.0.0]network 10.1.3.1 0.0.0.0[FW2-ospf-1-area-0.0.0.0]network 10.1.1.2 0.0.0.0[FW2-ospf-1-area-0.0.0.0]network 192.168.2.2 0.0.0.0查邻居状态[FW2]display ospf peer brief OSPF Process 1 with Router ID 4.4.4.4 Peer Statistic Information ---------------------------------------------------------------------------- Area Id Interface Neighbor id State 0.0.0.0 GigabitEthernet1/0/0 2.2.2.2 Full 0.0.0.0 GigabitEthernet1/0/1 3.3.3.3 Full 0.0.0.0 GigabitEthernet1/0/2 3.3.3.3 Full ---------------------------------------------------------------------------- Total Peer(s): 3双机热备FW2一样的操作只是运行角色那里选“备份”HRP_M[FW1]display vrrp brief 2026-08-06 04:37:46.880 Total:1 Master:1 Backup:0 Non-active:0 VRID State Interface Type Virtual IP ---------------------------------------------------------------- 1 Master GE1/0/1 Vgmp 192.168.2.254主设备FW1配置安全策略FW2作为备份设备不可以自己配置但是可以查HRP_S[FW2]security-policy Error: The device is in HRP standby state, so this command can not be executed. ---FW2作为备份设备不可以自己配置安全策略 但是可以查 HRP_S[FW2]display security-policy rule all 2026-08-06 04:48:14.970 Total:2 RULE ID RULE NAME STATE ACTION HITS ------------------------------------------------------------------------------- 1 111 enable permit 0 0 default enable deny 0 -------------------------------------------------------------------------------PC1做测试ping100.1.1.1FW2同步FW1信息PC1-t长ping100.1.1.1会丢几个2报文但是还是正常运行HRP_M[FW1]int g1/0/0 (B) 括号里面代表同步到FW2HRP_M[FW1-GigabitEthernet1/0/0]shutdown 没有同步HRP_M[FW1]hrp standby config enable (B)手工批量备份把配置信息备份给备份设备