USG5500 配置路由模式下主备备份方式的双机热备份

浅浅的花香味﹌ 2022-05-26 10:11 833阅读 0赞

## 组网需求： ##

USG5500作为安全设备被部署在业务节点上。其中上下行设备均为交换机，USG5300A，USG5300B分别充当主设备和备用设备，且均工作在路由模式下。  
网络规划如下：

*  需要保护的网段地址为192.168.1.0/24，与USG5300的GigabitEthernet 0/0/1接口相连，部署在Trust区域中。
 *  外部网络与USG5300的GigabitEthernet 0/0/3接口相连，部署在Untrust区域。
 *  两台USG5300的HRP备份通道接口接口GigabitEthernet 0/0/2部署在DMZ区域。

其中各安全区域对应的VRRP组虚拟IP地址如下：

*  信任区域对应的VRRP组虚拟IP为地址10.100.10.1/24
 *  Untrust安全区域对应的VRRP组虚拟IP地址为202.38.10.1/24。
 *  DMZ区域对应的VRRP组虚拟IP地址为10.100.20.1/24。

## 网络拓扑： ##

![20180429114908147][]

## 一、FW1操作步骤： ##

1、配置端口IP

[FW1]interface GigabitEthernet 0/0/1
    [FW1-GigabitEthernet0/0/1] ip address 10.100.10.2 24
    [FW1-GigabitEthernet0/0/1] q
    [FW1]interface GigabitEthernet 0/0/2
    [FW1-GigabitEthernet0/0/2] ip address 10.100.20.2 24
    [FW1-GigabitEthernet0/0/2] q
    [FW1]interface GigabitEthernet 0/0/3
    [FW1-GigabitEthernet0/0/3] ip address 202.38.10.2 24
    [FW1-GigabitEthernet0/0/3] q

2、加入对应安全区域

[FW1]firewall zone trust
    [FW1-zone-trust]add  interface GigabitEthernet 0/0/1
    [FW1-zone-trust] q 
    [FW1]firewall zone dmz
    [FW1-zone-dmz]add  interface GigabitEthernet 0/0/2
    [FW1-zone-dmz] q 
    [FW1]firewall zone untrust
    [FW1-zone-untrust]add  interface GigabitEthernet 0/0/3
    [FW1-zone-untrust] q

3、配置VRRP组的虚拟IP，注意：**在使用模拟器的时候要开启****虚拟MAC地址的功能，要不配置的虚IP就无法ping通**（在配置VRRP组前，要先配置接口IP）

[FW1]interface GigabitEthernet 0/0/1
    [FW1-GigabitEthernet0/0/1] vrrp vrid 1 virtual-ip 10.100.10.1 master
    [FW1-GigabitEthernet0/0/1] vrrp virtual-mac enable
    [FW1-GigabitEthernet0/0/1] q
    [FW1]interface GigabitEthernet 0/0/3
    [FW1-GigabitEthernet0/0/3] vrrp vrid 2 virtual-ip 202.38.10.1 master
    [FW1-GigabitEthernet0/0/3] vrrp virtual-mac enable
    [FW1-GigabitEthernet0/0/3] q
    [FW1]interface GigabitEthernet 0/0/2
    [FW1-GigabitEthernet0/0/2] vrrp vrid 3 virtual-ip 10.100.20.1 master
    [FW1-GigabitEthernet0/0/2] q

4、配置HR备份通道

[FW1] hrp interface GigabitEthernet 0/0/2
    [FW1] hrp enable

## 二、FW2操作步骤 ##

1、配置端口IP

[FW2]interface GigabitEthernet 0/0/1
    [FW2-GigabitEthernet0/0/1] ip address 10.100.10.3 24
    [FW2-interface GigabitEthernet0/0/1]q
    [FW2]interface GigabitEthernet 0/0/2
    [FW2-GigabitEthernet0/0/2] ip address 10.100.20.3 24
    [FW2-interface GigabitEthernet0/0/2]q
    [FW2]interface GigabitEthernet 0/0/3
    [FW2-GigabitEthernet0/0/3] ip address 202.38.10.3 24
    [FW2-interface GigabitEthernet0/0/3]q

2，加入对应安全区域

[FW2]firewall zone trust
    [FW2-zone-trust]add interface GigabitEthernet 0/0/1
    [FW2-zone-trust] q
    [FW2]firewalld zone dmz
    [FW2-zone-dmz]add interface GigabitEthernet 0/0/2
    [FW2-zone-dmz] q
    [FW2]firewalld zone untrust
    [FW2-zone-untrust]add interface GigabitEthernet 0/0/3
    [FW2-zone-untrust] q

3，配置VRRP组的虚拟IP，注意：在使用模拟器的时候要开启虚拟MAC地址的功能，要不配置的虚IP就无法ping通（在配置VRRP组前，要先配置接口IP）

[FW2]interface GigabitEthernet 0/0/1
    [FW2-GigabitEthernet0/0/1] vrrp vrid 1 virtual-ip 10.100.10.1 slave
    [FW2-GigabitEthernet0/0/1] vrrp virtual-mac enable
    [FW2-GigabitEthernet0/0/1] q
    [FW2]interface GigabitEthernet 0/0/3
    [FW2-GigabitEthernet0/0/3] vrrp vrid 2 virtual-ip 202.38.10.1 slave
    [FW2-GigabitEthernet0/0/3] vrrp virtual-mac enable
    [FW2-GigabitEthernet0/0/3] q
    [FW2]interface GigabitEthernet 0/0/2
    [FW2-GigabitEthernet0/0/2] vrrp vrid 3 virtual-ip 10.100.20.1 slave
    [FW2-GigabitEthernet0/0/2] q

4、配置HR备份通道

[FW2] hrp interface GigabitEthernet 0/0/2
    [FW2] hrp enable

5、查看VRRP和HRP状态

HRP_S[FW2]display  hrp  state
     The firewall's config state is: SLAVE
    
     Current state of virtual routers configured as slave:
                 GigabitEthernet0/0/2    vrid   3 : slave
                 GigabitEthernet0/0/3    vrid   2 : slave
                 GigabitEthernet0/0/1    vrid   1 : slave

## 三、FW1配置 ##

1、启动配置命令的自动备份功能，在FW1的域间防火墙策略会自动同步到FW2

HRP_M [FW1] hrp auto-sync config

2、配置turst区域到非信任区域的域间防火墙策略

HRP_M [FW1]policy interzone  trust  untrust  outbound 
    HRP_M [FW1-policy-interzone-trust-untrust-outbound] policy 1
    HRP_M [FW1-policy-interzone-trust-untrust-outbound-1] policy source 192.168.1.0 0.0.0.255
    HRP_M [FW1-policy-interzone-trust-untrust-outbound-1] action  permit 
    HRP_M [FW1-policy-interzone-trust-untrust-outbound-1] return

3、配置信任区域到非信任区域出方向的NAT策略

HRP_M [FW1] nat address-group 1 202.38.10.1 202.38.10.1
    
    HRP_M [FW1] nat-policy interzone trust untrust  outbound 
    HRP_M [FW1-nat-policy-interzone-trust-untrust-outbound] policy 1
    HRP_M [FW1-nat-policy-interzone-trust-untrust-outbound-1] policy source 192.168.1.0 0.0.0.255
    HRP_M [FW1-nat-policy-interzone-trust-untrust-outbound-1] action source-nat 
    HRP_M [FW1-nat-policy-interzone-trust-untrust-outbound-1] address-group 1
    HRP_M [FW1-nat-policy-interzone-trust-untrust-outbound-1] q

4、在FW1和FW2上添加静态路由

HRP_M [FW1] ip route-static 192.168.1.0 24 10.100.10.10
    HRP_M [FW1] ip route-static 0.0.0.0 0.0.0.0 202.38.10.10
    
    HRP_S [FW2] ip route-static 192.168.1.0 24 10.100.10.10
    HRP_S [FW2] ip route-static 0.0.0.0 0.0.0.0 202.38.10.10

## 四、SW1操作步骤 ##

1、划分VLAN并设置IP

[SW1] vlan batch 192 10
    [SW1]interface Vlanif 10
    [SW1-Vlanif10] ip address 10.100.10.10 24
    [SW1-VLANIF10] q
    [SW1]interface Vlanif 192
    [SW1-Vlanif192] ip address 192.168.1.254 24
    [SW1-Vlanif192] q

2、端口加入对应VLAN

[SW1]interface GigabitEthernet 0/0/1
    [SW1-GigabitEthernet0/0/1] port link-type trunk 
    [SW1-GigabitEthernet0/0/1] port trunk pvid vlan 10
    [SW1-GigabitEthernet0/0/1] port trunk allow-pass vlan all 
    [SW1]interface GigabitEthernet 0/0/2
    [SW1-GigabitEthernet0/0/2] port link-type trunk 
    [SW1-GigabitEthernet0/0/2] port trunk pvid vlan 10
    [SW1-GigabitEthernet0/0/2] port trunk allow-pass vlan all 
    
    [SW1]interface GigabitEthernet 0/0/3
    [SW1-GigabitEthernet0/0/3] port link-type access 
    [SW1-GigabitEthernet0/0/3] port default vlan 192
    [SW1-interface GigabitEthernet 0/0/3] q
    [SW1]interface GigabitEthernet 0/0/4
    [SW1-GigabitEthernet0/0/4] port link-type access  
    [SW1-GigabitEthernet0/0/4] port default vlan 192
    [SW1-interface GigabitEthernet 0/0/4] q

3、配置路由

[SW1] ip route-static 0.0.0.0 0.0.0.0 10.100.10.1

## 五、SW2操作步骤 ##

1、划分VLAN并设置IP

[SW2] vlan batch 172 202
    [SW2]interface  Vlanif  172
    [SW2-Vlanif172] ip address  172.16.1.254 24
    [SW2-Vlanif172] q
    [SW2]interface  Vlanif  202	
    [SW2-Vlanif202] ip address  202.38.10.10 24
    [SW2-Vlanif202] q

2、端口加入对应VLAN

[SW2]interface GigabitEthernet 0/0/3
    [SW2-GigabitEthernet0/0/3] port link-type access
    [SW2-GigabitEthernet0/0/3] port default vlan 172
    [SW2-GigabitEthernet0/0/3] q
    
    [SW2]interface GigabitEthernet 0/0/2
    [SW2-GigabitEthernet0/0/2] port link-type trunk
    [SW2-GigabitEthernet0/0/2] port trunk pvid vlan 202
    [SW2-GigabitEthernet0/0/2] port trunk allow-pass vlan all
    [SW2-GigabitEthernet0/0/2] q
    [SW2]interface GigabitEthernet 0/0/1
    [SW2-GigabitEthernet0/0/1] port link-type Trunk
    [SW2-GigabitEthernet0/0/1] port trunk pvid vlan 202
    [SW2-GigabitEthernet0/0/1] port trunk allow-pass vlan all
    [SW2-GigabitEthernet0/0/1] q

3、配置路由

[SW2] ip route-static 0.0.0.0 0.0.0.0 202.38.10.1

4、验证，使用trust区域的192.168.1.10 ping untrust区域的172.16.1.10

然后在FW1使用：显示防火墙会话表就会看到内网IP是使用NAT地址池的IP访问出去的

HRP_M <FW1> display  firewall session table  
    13:00:04 2018/04/29
     当前总会话数：4
      icmp VPN：public  - > public 192.168.1.10:19025[202.38.10.23:2290]--> 172.16.1.1
    0：2048
      icmp VPN：public  - > public 192.168.1.10:19281[202.38.10.23:2291]--> 172.16.1.1
    0：2048
      icmp VPN：public  - > public 192.168.1.11:20561[202.38.10.22:2278]--> 172.16.1.1
    0：2048
      icmp VPN：public  - > public 192.168.1.11:20817 [202.38.10.22:2279]  - > 172.16.1.1
    0：2048

![20180429130505807][]

[20180429114908147]: /images/20220526/c49ac94f5c434b3c9c21a09fa3c50c8e.png
[20180429130505807]: /images/20220526/946d347ac92e44d0a657c332e3c2e393.png