LSW1/LSW2sysname LSW1vlan batch 2interface GigabitEthernet0/0/1port link‑type trunkport trunk allow‑pass vlan 2interface GigabitEthernet0/0/2port link‑type trunkport trunk allow‑pass vlan 2interface Ethernet0/0/1port link‑type accessport default vlan 2LSW2 配置相同防火墙 FW1主设备基础配置;sysname FW1interface GigabitEthernet 1/0/2ip address 10.1.1.1 255.255.255.252undo shutdowninterface GigabitEthernet 1/0/0ip address 10.1.2.1 24undo shutdowninterface GigabitEthernet 1/0/1ip address 192.168.0.1 24undo shutdownfirewall zone trustadd interface GigabitEthernet 1/0/1firewall zone untrustadd interface GigabitEthernet 1/0/0hrp enablehrp interface GigabitEthernet 1/0/2 remote 10.1.1.2hrp mode activeinterface GigabitEthernet 1/0/1vrrp vrid 1 virtual‑ip 192.168.2.254 24 activeinterface GigabitEthernet 1/0/0vrrp vrid 2 virtual‑ip 10.1.2.3 24 activeospf 1 router‑id 1.1.1.1area 0network 10.1.1.0 0.0.0.3network 10.1.2.0 0.0.0.255network 192.168.2.0 0.0.0.255security‑policyrule name trust‑to‑untrustsource‑zone trustdestination‑zone untrustaction permit防火墙 FW2备设备配置:sysname FW2interface GigabitEthernet 1/0/2ip address 10.1.1.2 255.255.255.252undo shutdowninterface GigabitEthernet 1/0/0ip address 10.1.3.1 24undo shutdowninterface GigabitEthernet 1/0/1ip address 192.168.0.2 24undo shutdownfirewall zone trustadd interface GigabitEthernet 1/0/1firewall zone untrustadd interface GigabitEthernet 1/0/0hrp enablehrp interface GigabitEthernet 1/0/2 remote 10.1.1.1hrp mode standbyinterface GigabitEthernet 1/0/1vrrp vrid 1 virtual‑ip 192.168.2.254 24 standbyinterface GigabitEthernet 1/0/0vrrp vrid 2 virtual‑ip 10.1.2.3 24 standbyospf 1 router‑id 2.2.2.2area 0network 10.1.1.0 0.0.0.3network 10.1.3.0 0.0.0.255network 192.168.2.0 0.0.0.255security‑policyrule name trust‑to‑untrustsource‑zone trustdestination‑zone untrustaction permitHRP 生效之后主 FW1 的安全策略、NAT 配置自动同步到 FW2 备机不需要重复配置全部策略。外网 AR1、AR2、ISP 路由器配置:以 ISP 路由器为例开启 OSPF宣告外网网段模拟运营商sysname ISPinterface GigabitEthernet0/0/0ip address 12.0.0.1 24interface GigabitEthernet0/0/1ip address 13.0.0.1 24interface LoopBack0ip address 100.1.1.0 24ospf 1 router‑id 3.3.3.3area 0network 12.0.0.0 0.0.0.255network 13.0.0.0 0.0.0.255network 100.1.1.0 0.0.0.255AR1、AR2 接口配置对应网段OSPF 宣告相连网段。PC 主机设置:PC1:IP 地址192.168.2.100子网掩码255.255.255.0网关192.168.2.254PC2:IP 地址192.168.2.200子网掩码255.255.255.0网关192.168.2.254DNS 8.8.8.8实验验证:1、查看 HRP 状态display hrp state2、查看 VRRP 备份组display vrrp brief 双机热备实验
LSW1/LSW2sysname LSW1vlan batch 2interface GigabitEthernet0/0/1port link‑type trunkport trunk allow‑pass vlan 2interface GigabitEthernet0/0/2port link‑type trunkport trunk allow‑pass vlan 2interface Ethernet0/0/1port link‑type accessport default vlan 2LSW2 配置相同防火墙 FW1主设备基础配置;sysname FW1interface GigabitEthernet 1/0/2ip address 10.1.1.1 255.255.255.252undo shutdowninterface GigabitEthernet 1/0/0ip address 10.1.2.1 24undo shutdowninterface GigabitEthernet 1/0/1ip address 192.168.0.1 24undo shutdownfirewall zone trustadd interface GigabitEthernet 1/0/1firewall zone untrustadd interface GigabitEthernet 1/0/0hrp enablehrp interface GigabitEthernet 1/0/2 remote 10.1.1.2hrp mode activeinterface GigabitEthernet 1/0/1vrrp vrid 1 virtual‑ip 192.168.2.254 24 activeinterface GigabitEthernet 1/0/0vrrp vrid 2 virtual‑ip 10.1.2.3 24 activeospf 1 router‑id 1.1.1.1area 0network 10.1.1.0 0.0.0.3network 10.1.2.0 0.0.0.255network 192.168.2.0 0.0.0.255security‑policyrule name trust‑to‑untrustsource‑zone trustdestination‑zone untrustaction permit防火墙 FW2备设备配置:sysname FW2interface GigabitEthernet 1/0/2ip address 10.1.1.2 255.255.255.252undo shutdowninterface GigabitEthernet 1/0/0ip address 10.1.3.1 24undo shutdowninterface GigabitEthernet 1/0/1ip address 192.168.0.2 24undo shutdownfirewall zone trustadd interface GigabitEthernet 1/0/1firewall zone untrustadd interface GigabitEthernet 1/0/0hrp enablehrp interface GigabitEthernet 1/0/2 remote 10.1.1.1hrp mode standbyinterface GigabitEthernet 1/0/1vrrp vrid 1 virtual‑ip 192.168.2.254 24 standbyinterface GigabitEthernet 1/0/0vrrp vrid 2 virtual‑ip 10.1.2.3 24 standbyospf 1 router‑id 2.2.2.2area 0network 10.1.1.0 0.0.0.3network 10.1.3.0 0.0.0.255network 192.168.2.0 0.0.0.255security‑policyrule name trust‑to‑untrustsource‑zone trustdestination‑zone untrustaction permitHRP 生效之后主 FW1 的安全策略、NAT 配置自动同步到 FW2 备机不需要重复配置全部策略。外网 AR1、AR2、ISP 路由器配置:以 ISP 路由器为例开启 OSPF宣告外网网段模拟运营商sysname ISPinterface GigabitEthernet0/0/0ip address 12.0.0.1 24interface GigabitEthernet0/0/1ip address 13.0.0.1 24interface LoopBack0ip address 100.1.1.0 24ospf 1 router‑id 3.3.3.3area 0network 12.0.0.0 0.0.0.255network 13.0.0.0 0.0.0.255network 100.1.1.0 0.0.0.255AR1、AR2 接口配置对应网段OSPF 宣告相连网段。PC 主机设置:PC1:IP 地址192.168.2.100子网掩码255.255.255.0网关192.168.2.254PC2:IP 地址192.168.2.200子网掩码255.255.255.0网关192.168.2.254DNS 8.8.8.8实验验证:1、查看 HRP 状态display hrp state2、查看 VRRP 备份组display vrrp brief