华为防火墙双机热备（link-group和Eth-trunk）

1.配置Trust区域及其互通

[FW1-GigabitEthernet1/0/0]ip add 10.1.1.1 24
[FW1-GigabitEthernet1/0/0]service-manage ping permit
[FW1]firewall zone trust
[FW1-zone-trust]add interface g1/0/0
[FW2-GigabitEthernet1/0/0]ip add 10.1.1.2 24
[FW2-GigabitEthernet1/0/0]service-manage ping permit
[FW2]firewall zone trust
[FW2-zone-trust]add interface g1/0/0
2.配置untrust区域及其互通

[FW1-GigabitEthernet1/0/1]ip add 20.1.10.1 24
[FW1-GigabitEthernet1/0/1]service-manage ping permit
[FW1]firewall zone untrust
[FW1-zone-untrust]add interface g1/0/1
[FW2-GigabitEthernet1/0/2]ip add 20.1.20.2 24
[FW2-GigabitEthernet1/0/2]service-manage ping permit
[FW2]firewall zone untrust
[FW2-zone-untrust]add interface g1/0/2
[AR1-GigabitEthernet0/0/1]ip add 20.1.10.3 24
[AR1-GigabitEthernet0/0/0]ip add 20.1.30.3 24
[AR1]ospf
[AR1-ospf-1]area 0
[AR1-ospf-1-area-0.0.0.0]network 20.1.10.0 0.0.0.255
[AR1-ospf-1-area-0.0.0.0]network 20.1.30.0 0.0.0.255
[AR2-GigabitEthernet0/0/2]ip add 20.1.20.4 24
[AR2-GigabitEthernet0/0/0]ip add 20.1.30.4 24
[AR2]ospf
[AR2-ospf-1]area 0
[AR2-ospf-1-area-0.0.0.0]network 20.1.20.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.0]network 20.1.30.0 0.0.0.255
[AR1-GigabitEthernet0/0/0]vrrp vrid 1 virtual-ip 20.1.30.254
[AR2-GigabitEthernet0/0/0]vrrp vrid 1 virtual-ip 20.1.30.254

3.配置源NAT
[FW1]nat address-group pool1
[FW1-address-group-pool1]section 20.1.10.100 20.1.10.200
[FW1]nat-policy
[FW1-policy-nat]rule name source_nat
[FW1-policy-nat-rule-source_nat]source-zone trust
[FW1-policy-nat-rule-source_nat]destination-zone untrust
[FW1-policy-nat-rule-source_nat]action source-nat address-group pool1
[FW2]nat address-group pool2
[FW2-address-group-pool1]section 20.1.10.100 20.1.10.200
[FW2]nat-policy
[FW2-policy-nat]rule name source_nat
[FW2-policy-nat-rule-source_nat]source-zone trust
[FW2-policy-nat-rule-source_nat]destination-zone untrust
[FW2-policy-nat-rule-source_nat]action source-nat address-group pool2
4.配置Eth-trunk和DMZ区域
[FW1]int Eth-Trunk 12
[FW1-Eth-Trunk12]ip add 12.1.1.1 24
[FW1-GigabitEthernet1/0/3]eth-trunk 12
[FW1-GigabitEthernet1/0/4]eth-trunk 12
[FW1]firewall zone dmz
[FW1-zone-dmz]add interface Eth-Trunk 12

[FW1]hrp enable
HRP_S[FW1]hrp interface Eth-Trunk 12 remote 12.1.1.2
[FW2]int Eth-Trunk 21
[FW2-Eth-Trunk21]ip add 12.1.1.2 24
[FW2-GigabitEthernet1/0/3]eth-trunk 21
[FW2-GigabitEthernet1/0/4]eth-trunk 21
[FW2]firewall zone dmz
[FW2-zone-dmz]add interface Eth-Trunk 21

[FW2]hrp enable
HRP_S[FW2]hrp interface Eth-Trunk 21 remote 12.1.1.1
5.配置双机热备
[FW1-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.1.1.254 active
[FW1-GigabitEthernet1/0/0]vrrp virtual-mac enable

[FW2-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 10.1.1.254 standby
[FW2-GigabitEthernet1/0/0]vrrp virtual-mac enable

6.配置link-group
[FW1-GigabitEthernet1/0/0]link-group 1
[FW1-GigabitEthernet1/0/1]link-group 1
[FW2-GigabitEthernet1/0/0]link-group 1
[FW2-GigabitEthernet1/0/2]link-group 1
7.配置安全策略
[FW1]security-policy
[FW1-policy-security]rule name local_dmz
[FW1-policy-security-rule-local_dmz]source-zone local
[FW1-policy-security-rule-local_dmz]source-zone dmz
[FW1-policy-security-rule-local_dmz]destination-zone local
[FW1-policy-security-rule-local_dmz]destination-zone dmz
[FW1-policy-security-rule-local_dmz]action permit
[FW1-policy-security]rule name trust_untrust
[FW1-policy-security-rule-trust_untrust]source-zone trust
[FW1-policy-security-rule-trust_untrust]destination-zone untrust
[FW1-policy-security-rule-trust_untrust]action permit
[FW2]security-policy
[FW2-policy-security]rule name local_dmz
[FW2-policy-security-rule-local_dmz]source-zone local
[FW2-policy-security-rule-local_dmz]source-zone dmz
[FW2-policy-security-rule-local_dmz]destination-zone local
[FW2-policy-security-rule-local_dmz]destination-zone dmz
[FW2-policy-security-rule-local_dmz]action permit
[FW2-policy-security]rule name trust_untrust
[FW2-policy-security-rule-trust_untrust]source-zone trust
[FW2-policy-security-rule-trust_untrust]destination-zone untrust
[FW2-policy-security-rule-trust_untrust]action permit
8.配置出口默认路由
HRP_M[FW1]ip route-static 0.0.0.0 0.0.0.0 20.1.10.3
HRP_S[FW2]ip route-static 0.0.0.0 0.0.0.0 20.1.20.4
9.验证
PC1 可以ping通 PC2

关闭AR1的g0/0/1口后PC1也可以ping通 PC2