转载：(华为配置)防火墙双机热备+BFD联动故障切换实验报告
一、实验拓扑
二、实验内容
（一）实验需求:
某公司通过主防火墙(FW1)与外网进行通信，当主防火墙出现故障时，备份防火墙能够保障正常通信。
（二）基础配置(vlan划分、IP地址配置)
1．ISP
#interface GigabitEthernet0/0/0ip address 100.1.1.1 255.255.255.248#interface LoopBack0ip address 114.114.114.114 255.255.255.252#2．SW-OUT
#vlan batch 2#interface GigabitEthernet0/0/1port link-type accessport default vlan 2#interface GigabitEthernet0/0/2port link-type accessport default vlan 2#interface GigabitEthernet0/0/3port link-type accessport default vlan 2#interface Vlanif2ip address 100.1.1.5 255.255.255.248#3．FW1
#interface GigabitEthernet1/0/0description to_SW-IN_G0/0/1undo shutdownip address 10.1.1.1 255.255.255.248#interface GigabitEthernet1/0/1description to_SW-OUT_G0/0/2undo shutdownip address 100.1.1.2 255.255.255.248#interface GigabitEthernet1/0/2description to_FW2_G1/0/2undo shutdownip address 10.0.12.1 255.255.255.252alias hrp#4．FW2
#interface GigabitEthernet1/0/0description to_SW-IN_G0/0/2undo shutdownip address 10.1.1.3 255.255.255.248#interface GigabitEthernet1/0/1description to_SW-OUT_G0/0/3undo shutdownip address 100.1.1.3 255.255.255.248#interface GigabitEthernet1/0/2description to_FW1_G1/0/2undo shutdownip address 10.0.12.2 255.255.255.252alias hrp#5．SW-IN
#Vlan batch 2 10 20#interface GigabitEthernet0/0/1description to_FW1_G1/0/0port link-type accessport default vlan 2#interface GigabitEthernet0/0/2description to_FW2_G1/0/0port link-type accessport default vlan 2#interface GigabitEthernet0/0/3description to_vlan10port link-type accessport default vlan 10#interface GigabitEthernet0/0/4description to_vlan20port link-type accessport default vlan 20#interface Vlanif2ip address 10.1.1.2 255.255.255.248#interface Vlanif10ip address 172.16.10.254 255.255.255.0#interface Vlanif20ip address 192.168.1.254 255.255.255.0#（三）安全区域划分
1．FW1
#firewall zone trustadd interface GigabitEthernet1/0/0#firewall zone untrustadd interface GigabitEthernet1/0/1#firewall zone dmzadd interface GigabitEthernet1/0/2#2．FW2
#firewall zone trustadd interface GigabitEthernet1/0/0#firewall zone untrustadd interface GigabitEthernet1/0/1#firewall zone dmzadd interface GigabitEthernet1/0/2#（四）VRRP
1．FW1
#interface GigabitEthernet1/0/0vrrp vrid 1 virtual-ip 10.1.1.4 active#interface GigabitEthernet1/0/1vrrp vrid 2 virtual-ip 100.1.1.4 active#2．FW2
#interface GigabitEthernet1/0/0vrrp vrid 1 virtual-ip 10.1.1.4 standby#interface GigabitEthernet1/0/1vrrp vrid 2 virtual-ip 100.1.1.4 standby#（五）配置HRP
1．FW1
#hrp enablehrp interface GigabitEthernet1/0/2 remote 10.0.12.2hrp mirror session enable#2．FW2
#hrp enablehrp interface GigabitEthernet1/0/2 remote 10.0.12.1hrp mirror session enable#（六）配置防火墙安全策略
只需要在FW1上配置，就会同步到FW2
1．FW1
#security-policyrule name t_Usource-zone trustdestination-zone untrustaction permitrule name guanlisource-zone localaction permit#（七）配置防火墙NAT地址池及NAT策略
只需要在FW1上配置，就会同步到FW2
1．FW1
#nat address-group CK_NAT_address 0mode patsection 1 100.1.1.6 100.1.1.6#nat-policyrule name internetsource-zone trustdestination-zone untrustaction source-nat address-group CK_NAT_address#（八）配置指向内外网的双向静态路由
1．SW-OUT
#ip route-static 0.0.0.0 0.0.0.0 100.1.1.1#2．FW1
#ip route-static 0.0.0.0 0.0.0.0 100.1.1.5ip route-static 172.16.10.0 255.255.255.0 10.1.1.2ip route-static 192.168.1.0 255.255.255.0 10.1.1.2#3．FW2
#ip route-static 0.0.0.0 0.0.0.0 100.1.1.5ip route-static 172.16.10.0 255.255.255.0 10.1.1.2ip route-static 192.168.1.0 255.255.255.0 10.1.1.2#4．SW-IN
#ip route-static 0.0.0.0 0.0.0.0 10.1.1.4#（九）上行接口配置BFD联动实现故障快速切换
还可以使用IP-link的icmp报文探测是否存活，但是由于IP-Link探测时间间隔需断网较长时间才恢复正常，所以这里使用BFD。
1．SW-OUT
#bfd#bfd 1 bind peer-ip 100.1.1.2discriminator local 20discriminator remote 10commit#bfd 2 bind peer-ip 100.1.1.3discriminator local 40discriminator remote 30commit#2．FW1
#bfd#bfd 1 bind peer-ip 100.1.1.5discriminator local 10discriminator remote 20commit#hrp enablehrp track interface GigabitEthernet1/0/1hrp track bfd-session 10#3.FW2
#bfd#bfd 1 bind peer-ip 100.1.1.5discriminator local 30discriminator remote 40commit#hrp enablehrp track interface GigabitEthernet1/0/1hrp track bfd-session 30#三、实验结果
（一）PC之间互通
（二）当主防火墙出现故障时，依然能够正常通信
往期推荐
（华为配置篇）华为设备ssh配置脚本
（全网最全面）开学季笔记本电脑验机详细流程及系统优化设置
（华为配置篇）交换机镜像配置
（华为配置篇）IPSec加密GRE通道
（华为配置篇）PPPoe拨号实验、策略路由选路与故障切换
