H3C 盒式 NGFW 设备出口网关双主模式典型配置举例 Copyright 2016 杭州华三通信技术有限公司版权所有, 保留一切权利非经本公司书面许可, 任何单位和个人不得擅自摘抄复制本文档内容的部分或全部, 并不得以任何形式传播本文档中的信息可能变动, 恕不另行通知 1

Size: px

Start display at page:

俊瑾景
5 years ago
Views:

2 1 简介本文档介绍了 H3C 盒式 NGFW 设备出口网关双主典型配置举例 2 配置前提本文档不严格与具体软硬件版本对应, 如果使用过程中与产品实际情况有差异, 请参考相关产品手册, 或以设备实际情况为准本文档中的配置均是在实验室环境下进行的配置和验证, 配置前设备的所有参数均采用出厂时的缺省配置如果您已经对设备进行了配置, 为了保证配置效果, 请确认现有配置和以下举例中的配置不冲突本文档假设您已了解 IRF LLB 和链路聚合等特性 3 使用限制在 F1000 系列防火墙中, 最优选择相同型号的机型之间建立 IRF 组建 IRF 的两台 F1000 防火墙堆叠必须使用相同的软件版本 F1000 的 IRF 口可以使用前面板的 GE 光口或 GE 电口 4 配置举例 4.1 组网需求如图 1 所示, 两台 F1050 组成 IRF, 内网用户通过防火墙下行链路聚合 HASH 分流到两台设备, 在防火墙上通过链路负载均衡技术选路到电信网络和联通网络, 在 F1050 上配置链路聚合本地优先, 对本地转发流量优先从本设备出, 避免横向流量由于有非对称场景, 所以需要配置会话热备功能 2

3 图 1 NGFW 设备出口网关双主典型配置组网图 4.2 配置思路在两台 F1050 之间建立 IRF 为了防止 IRF 链路故障导致 IRF 分裂, 在网络中产生两个配置冲突的 IRF, 需要启用 MAD 检测功能将 F1050_1 的 GE1/0/4 和 F1050_2 的 GE2/0/4 BFD MAD 检测将 F1050_1 的 GE1/0/6 和 F1050_2 的 GE2/0/6 配置为三层聚合口 F1050_1 的 GE1/0/7 配置为电信网络出接口, 并添加到聚合组 2 中,F1050_2 的 GE2/0/7 配置为联通网络出接口, 同样添加到聚合组 3 中在防火墙上配置链路负载均衡将内网流量负载分担到两条链路中 4.3 使用版本本举例是在 F1050 的 Ess 9316 版本上进行配置和验证的 4.4 配置注意事项 F1050 配置堆叠时注意配置顺序, 保存配置后在激活堆叠口配置 4.5 配置步骤 F1050IRF 的配置步骤 IRF 的配置 ( 两台 F1050 可以通过多个 IRF 口相连接, 如下以 GE1/0/9~GE2/0/9 和 GE1/0/22~ GE2/0/22 为例 ) 3

4 (1) F1050_1 的配置配置成员号和优先级 <F1050_1> system-view [F1050_1] irf member 1 priority 32 配置 F1050_1, 配置 IRF 端口 1/1, 并将它与物理端口 GE1/0/9 和 GE1/0/22 绑定, 并保存配置, 激活 IRF 端口下的配置 [F1050_1] interface GigabitEthernet 1/0/9 [F1050_1-GigabitEthernet1/0/9] shutdown [F1050_1-GigabitEthernet1/0/9] quit [F1050_1] interface GigabitEthernet 1/0/22 [F1050_1-GigabitEthernet1/0/22] shutdown [F1050_1-GigabitEthernet1/0/22] quit [F1050_1] irf-port 1/1 [F1050_1-irf-port1/1] port group interface GigabitEthernet 1/0/9 [F1050_1-irf-port1/1] port group interface GigabitEthernet 1/0/22 [1050_1-irf-port1/1] quit [F1050_1] interface GigabitEthernet 1/0/9 [F1050_1-GigabitEthernet1/0/9] undo shutdown [F1050_1-GigabitEthernet1/0/9] quit [F1050_1] interface GigabitEthernet 1/0/22 [F1050_1-GigabitEthernet1/0/22] undo shutdown [F1050_1-GigabitEthernet1/0/22] quit [F1050_1] save [F1050_1] irf-port-configuration active (2) F1050_2 的配置配置成员号 <F1050_2> system-view [F1050_2] irf member 1 renumber 2 Warning: Renumbering the member ID may result in configuration change or loss. Continue? [Y/N]:y [F1050_2] quit <F1050_2> reboot F1050_2 重新启动后, 登录设备, 设置 IRF 优先级 <F1050_2> system-view [F1050_2] irf member 2 priority 1 配置 IRF 端口 2/2, 并将它与物理端口 GE2/0/9 和 GE2/0/22 绑定, 并保存配置, 激活 IRF 端口下的配置 [F1050_2] interface GigabitEthernet 2/0/9 [F1050_2-GigabitEthernet2/0/9] shutdown [F1050_2-GigabitEthernet2/0/9] quit [F1050_2] interface GigabitEthernet 2/0/22 [F1050_2-GigabitEthernet2/0/22] shutdown [F1050_2-GigabitEthernet2/0/22] quit [F1050_2] irf-port 2/2 [F1050_2-irf-port2/2] port group interface GigabitEthernet 2/0/9 [F1050_2-irf-port2/2] port group interface GigabitEthernet 2/0/22 4

5 [F1050_2-irf-port2/2] quit [F1050_2] interface GigabitEthernet 2/0/9 [F1050_2-GigabitEthernet2/0/9] undo shutdown [F1050_2-GigabitEthernet2/0/9] quit [F1050_2] interface GigabitEthernet 2/0/22 [F1050_2-GigabitEthernet2/0/22] undo shutdown [F1050_2-GigabitEthernet2/0/22] quit [F1050_2] save [F1050_2] irf-port-configuration active F1050 聚合接口配置 F1050 下行配置三层聚合口, 对下行应用流量进行分流到两台设备开启聚合加速功能, 双主模式下需要配置 [F1050_1] link-aggregation global forwarding-acceleration enable F1050_1 的 GE1/0/6 和 F1050_2 的 GE2/0/6 组成聚合口 RAGG1 [F1050_1] interface Route-Aggregation 1 [F1050_1-Route-Aggregation1] quit [F1050_1] interface GigabitEthernet 1/0/6 [F1050_1-GigabitEthernet1/0/6] port link-aggregation group 1 [F1050_1-GigabitEthernet1/0/6] quit [F1050_1] interface GigabitEthernet 2/0/6 [F1050_1-GigabitEthernet2/0/6] port link-aggregation group 1 [F1050_1-GigabitEthernet2/0/6] quit 配置聚合口 BAGG1 IP 地址 [F1050_1] interface Route-Aggregation 1 [F1050_1-Route-Aggregation1] ip address [F1050_1-Route-Aggregation1] quit 将聚合口加入到安全域 trust 中 [F1050_1] security-zone name trust [F1050_1-security-zone-Trust] import interface Route-Aggregation 1 [F1050_1-security-zone-Trust] quit F1050 链路负载均衡配置创建 Link1 和 Link2 所在 isp1 的链路组 lg1, 配置算法为轮转方式 [F1050_1] loadbalance link-group lg1 [F1050_1-lb-lgroup-lg1] predictor round-robin [F1050_1-lb-lgroup-lg1] transparent enable [F1050_1-lb-lgroup-lg1] quit 创建链路 Link1 Link2, 并属于链路组 lg1 [F1050_1] loadbalance link link-1 [F1050_1-lb-link-link-1] router ip // 电信 [F1050_1-lb-link-link-1] link-group lg1 [F1050_1-lb-link-link-1] quit [F1050_1] loadbalance link link-2 [F1050_1-lb-link-link-2] router ip // 联通 5

6 [F1050_1-lb-link-link-2] link-group lg1 [F1050_1-lb-link-link-2] quit 全局下创建 NAT 地址池地址 [F1050_1] nat outbound address-group 1 [F1050_1-address-group-1] address [F1050_1-address-group-1] quit [F1050_1] nat outbound address-group 2 [F1050_1-address-group-1] address [F1050_1-address-group-1] quit 链路 link-1,link-2 对应接口开启 NAT outbound 分别引用地址池地址 1,2 [F1050_1] interface Route-Aggregation 2 [F1050_1-Route-Aggregation2] nat outbound address-group 1 [F1050_1-Route-Aggregation2] quit [F1050_1] interface Route-Aggregation 3 [F1050_1-Route-Aggregation3] nat outbound address-group 2 [F1050_1-Route-Aggregation2] quit 全局下开启 slot1 NAT 端口负载分担功能在双机热备的负载分担场景下, 开启 NAT 端口负载分担功能后, 两台设备各获得一半端口块资源, 使相同私网 IP 地址在不同的成员设备上独占一定的端口资源, 避免端口分配冲突未开启时, 会有概率出现多个私网地址经 NAT 转换后使用了相同端口, 造成会话冲突 [F1050_1] nat port-load-balance enable slot 1 创建流分类 class-1, 基于应用组 app-1 和 ACL 3001 匹配源 IP 为 /16 网段的 IP 地址的 HTTP 流量 [F1050_1] acl advanced 3001 [F1050_1-acl-ipv4-adv-3001] rule permit ip source [F1050_1-acl-ipv4-adv-3001] quit [F1050_1] app-group app-1 [F1050_1-app-group-app-1] include application http [F1050_1-app-group-app-1] quit [F1050_1] loadbalance class class-1 type link-generic [F1050_1-lbc-link-generic-class-1] match acl 3001 [F1050_1-lbc-link-generic-class-1] match app-group app-1 [F1050_1-lbc-link-generic-class-1] quit 创建流动作 action-1 绑定链路组 lg1 [F1050_1] loadbalance action action-1 type link-generic [F1050_1-lba-link-generic-action-1] link-group lg1 [F1050_1-lba-link-generic-action-1] quit 创建 LB 策略绑定流分类和流动作 [F1050_1] loadbalance policy policy-1 type link-generic [F1050_1-lbp-link-generic-policy-1] class class-1 action action-1 [F1050_1-lbp-link-generic-policy-1] quit 创建虚服务 VS 为全 0 网段, 绑定 LB 策略, 并使能虚服务开启会话热备 [F1050_1] virtual-server vs type link-ip [F1050_1-vs-link-ip-vs] virtual ip address [F1050_1-vs-link-ip-vs] lb-policy policy-1 6

7 [F1050_1-vs-link-ip-vs] service enable 开启会话备份此项为必配项, 保证非对称性流量能够转发 [F1050_1-vs-link-ip-vs] connection-sync enable 此项为可选, 有持续性表项情况下配置 [F1050_1-vs-link-ip-vs] sticky-sync enable [F1050_1-vs-link-ip-vs] quit F1050 BFD MAD 配置 [F1050_1] vlan 30 [F1050_1] interface GigabitEthernet 1/0/4 [F1050_1-GigabitEthernet1/0/4] port link-mode bridge [F1050_1-GigabitEthernet1/0/4] port access vlan 30 [F1050_1-GigabitEthernet1/0/4] quit [F1050_1] interface GigabitEthernet 2/0/4 [F1050_1-GigabitEthernet2/0/4] port link-mode bridge [F1050_1-GigabitEthernet2/0/4] port access vlan 30 [F1050_1-GigabitEthernet2/0/4] quit [F1050_1] interface Vlan-interface 30 [ Vlan-interface30] mad ip address member 1 [ Vlan-interface30] mad ip address member 2 [ Vlan-interface30] mad bfd enable [F1050_1-Vlan-interface30] quit [F1050_1] security-zone name trust [F1050_1-security-zone-Trust] import interface Vlan-interface30 [F1050_1-security-zone-Trust] quit 4.6 出接口及安全域及其他配置 (1) GE1/0/7 GE2/0/7 配置 IP 地址并加入安全域 untrust <F1050_1> system-view [F1050_1] interface Route-Aggregation 2 [F1050_1-Route-Aggregation2] ip address [F1050_1-Route-Aggregation2] quit [F1050_1] interface GigabitEthernet 1/0/7 [F1050_1-GigabitEthernet1/0/7] port link-aggregation group 2 [F1050_1-GigabitEthernet1/0/7] quit [F1050_1] interface Route-Aggregation 3 [F1050_1-Route-Aggregation3] ip address [F1050_1-Route-Aggregation3] quit [F1050_1] interface GigabitEthernet 2/0/7 [F1050_1-GigabitEthernet2/0/7] port link-aggregation group 3 [F1050_1-GigabitEthernet2/0/7] quit [F1050_1] security-zone name untrust [F1050_1-security-zone-Untrust] import interface Route-Aggregation 2 [F1050_1-security-zone-Untrust] import interface Route-Aggregation 3 [F1050_1-security-zone-Untrust] quit 7

8 (2) 配置域间策略放行全部 IP [F1050_1] acl advanced 3000 [F1050_1-acl-ipv4-adv-3000] rule permit ip [F1050_1-acl-ipv4-adv-3000] quit [F1050_1] zone-pair security source trust destination untrust [F1050_1-zone-pair-security-Trust-Untrust] packet-filter 3000 [F1050_1-zone-pair-security-Trust-Untrust] quit [F1050_1] zone-pair security source trust destination local [F1050_1-zone-pair-security-Trust-Local] packet-filter 3000 [F1050_1-zone-pair-security-Trust-Local] quit [F1050_1] zone-pair security source untrust destination local [F1050_1-zone-pair-security-Untrust-Local] packet-filter 3000 [F1050_1-zone-pair-security-Untrust-Local] quit [F1050_1] zone-pair security source untrust destination trust [F1050_1-zone-pair-security-Untrust-Trust] packet-filter 3000 [F1050_1-zone-pair-security-Untrust-Trust] quit [F1050_1] zone-pair security source local destination trust [F1050_1-zone-pair-security-Local-Trust] packet-filter 3000 [F1050_1-zone-pair-security-Local-Trust] quit [F1050_1] zone-pair security source local destination untrust [F1050_1-zone-pair-security-Local-Untrust] packet-filter 3000 [F1050_1-zone-pair-security-Local-Untrust] quit (3) 开启链路聚合本地优先 [F1050_1] link-aggregation load-sharing mode local-first (4) 开启会话备份 [F1050_1] session synchronization enable [F1050_1] session synchronization dns http 4.7 验证配置 (1) 查看两台防火墙形成的双机 IRF 信息 <F1050_1> display irf MemberID Role Priority CPU-Mac Description *1 Master 32 50da-00eb-7ba Standby 1 50da-00eb-7bd * indicates the device is the master. + indicates the device through which the user logs in. The bridge MAC of the IRF is: 50da-00eb-7b9f Auto upgrade : yes Mac persistent : 6 min Domain ID : 0 GE1/0/6 S GE2/0/6 S (2) 查看聚合口状态 8

9 <F1050_1> display link-aggregation verbose Route-Aggregation 1 Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing Port Status: S -- Selected, U -- Unselected, I -- Individual Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation, D -- Synchronization, E -- Collecting, F -- Distributing, G -- Defaulted, H -- Expired Aggregate Interface: Route-Aggregation1 Aggregation Mode: Static Loadsharing Type: Shar Port Status Priority Oper-Key GE1/0/6 S GE2/0/6 S (3) 查看 LLB 虚服务状态 <F1050_1> display virtual-server name vs Virtual server: vs Description: Type: LINK-IP State: Active VPN instance: Virtual IPv4 address: /0 Virtual IPv6 address: -- Port: 0 Primary link group: Backup link group: Sticky: LB policy: policy-1 LB limit-policy: Connection limit: -- Rate limit: Connections: -- Bandwidth: -- Inbound bandwidth: -- Outbound bandwidth: -- Connection synchronization: Enabled Sticky synchronization: Disabled Bandwidth busy protection: Disabled Interface bandwidth statistics: Disabled Route advertisement: Disabled 4.8 配置文件 sysname F1050_1 irf mac-address persistent timer irf auto-update enable 9

10 undo irf link-delay irf member 1 priority 32 irf member 2 priority 1 irf-port 1/1 port group interface GigabitEthernet1/0/9 port group interface GigabitEthernet1/0/22 irf-port 2/2 port group interface GigabitEthernet2/0/9 port group interface GigabitEthernet2/0/22 link-aggregation global forwarding-acceleration enable interface Route-Aggregation1 ip address interface Route-Aggregation2 ip address nat outbound address-group 1 interface Route-Aggregation3 ip address nat outbound address-group 2 interface Vlan-interface30 mad bfd enable mad ip address member 1 mad ip address member 2 interface GigabitEthernet1/0/4 port link-mode access port access vlan 30 interface GigabitEthernet1/0/6 port link-aggregation group 1 interface GigabitEthernet1/0/7 port link-aggregation group 2 interface GigabitEthernet2/0/6 port link-aggregation group 1 interface GigabitEthernet2/0/4 port link-mode access port access vlan 30 interface GigabitEthernet2/0/7 port link-aggregation group 3 10

11 security-zone name Trust import interface Route-Aggregation1 import interface Vlan-interface30 security-zone name Local security-zone name Untrust import interface Route-Aggregation 2 import interface Route-Aggregation 3 zone-pair security source Local destination Trust packet-filter 3000 zone-pair security source Local destination Untrust packet-filter 3000 zone-pair security source Trust destination Local packet-filter 3000 zone-pair security source Trust destination Untrust packet-filter 3000 zone-pair security source Untrust destination Local packet-filter 3000 zone-pair security source Untrust destination Trust packet-filter 3000 nat port-load-balance enable slot 1 session synchronization enable session synchronization dns http acl advanced 3000 rule 0 permit ip acl advanced 3001 rule 0 permit ip source domain system domain default enable system app-group app-1 description "User-defined application group" include application http loadbalance link-group lg1 11

12 transparent enable loadbalance class class-1 type link-generic match 1 acl 3001 match 2 app-group app-1 loadbalance action action-1 type link-generic link-group lg1 loadbalance policy policy-1 type link-generic class class-1 action action-1 virtual-server vs type link-ip virtual ip address lb-policy policy-1 service enable connection-sync enable loadbalance link link-1 router ip link-group lg1 loadbalance link link-2 router ip link-group lg1 5 相关资料 H3C 防火墙产品配置指导 (V7) 中的虚拟化技术配置指导 H3C 防火墙产品命令参考 (V7) 中的虚拟化技术命令参考 H3C 防火墙产品配置指导 (V7) 中的可靠性配置指导 H3C 防火墙产品命令参考 (V7) 中的可靠性命令参考 12

目录 1 IPv6 快速转发 IPv6 快速转发配置命令 display ipv6 fast-forwarding aging-time display ipv6 fast-forwarding cache ipv6 fas

目录 1 IPv6 快速转发 IPv6 快速转发配置命令 display ipv6 fast-forwarding aging-time display ipv6 fast-forwarding cache ipv6 fas 目录 1 IPv6 快速转发 1-1 1.1 IPv6 快速转发配置命令 1-1 1.1.1 display ipv6 fast-forwarding aging-time 1-1 1.1.2 display ipv6 fast-forwarding cache 1-1 1.1.3 ipv6 fast-forwarding aging-time 1-3 1.1.4 ipv6 fast-forwarding