vrrp冗余路由协议实验

Vrrp冗余路由协议

使用防火墙实验

拓扑图

配置交换机

<Quidway>sys

[Quidway]sys sw1

[sw1]vlan 10

[sw1-vlan10]port e1/0/10

[sw1-vlan10]vlan 20

[sw1-vlan20]port e1/0/20

[sw1-vlan20]int e1/0/1

[sw1-Ethernet1/0/1]port link-type trunk

[sw1-Ethernet1/0/1]port trunk permit vlanall

[sw1-Ethernet1/0/1]int e1/0/2

[sw1-Ethernet1/0/2]port link-type trunk

[sw1-Ethernet1/0/2]port trunk permit vlanall

配置fw1

<H3C>sys

[H3C]sys fw1

[fw1]firewall packet-filter default permit

[fw1]undoinsulate

[fw1]int eth0/0.1

[fw1-Ethernet0/0.1]vlan-type dot1q vid 10

[fw1-Ethernet0/0.1]ip add 192.168.10.1 24

[fw1-Ethernet0/0.1]int eth0/0.2

[fw1-Ethernet0/0.2]vlan-type dot1q vid 20

[fw1-Ethernet0/0.2]ip add 192.168.20.1 24

[fw1]firewall zone trust

[fw1-zone-trust]add interface Ethernet0/0

[fw1-zone-trust]add interface eth 0/0.1

[fw1-zone-trust]add interface eth 0/0.2

[fw1-zone-trust]firewall zone untrust

[fw1-zone-untrust]add interface eth0/4

[fw1]ip route 0.0.0.00 192.168.3.2

[fw1]acl number 2000 match-order auto

[fw1-acl-basic-2000]rule 10 permit sourceany

[fw1-acl-basic-2000]int eth0/4

[fw1-Ethernet0/4]nat outbound 2000

[fw1]int eth0/0.1

[fw1-Ethernet0/0.1]vrrp vrid 10 virtual-ip192.168.10.254

[fw1-Ethernet0/0.1]vrrp vrid 10 priority120

[fw1-Ethernet0/0.1]vrrp vrid 10 tracketh0/4 reduced 30

[fw1-Ethernet0/0.1]int eth0/0.2

[fw1-Ethernet0/0.2]vrrp vrid 20 virtual-ip192.168.20.254

配置fw2

<H3C>sys

[H3C]sys fw2

[fw2]undo insulate

[fw2]firewall packet-filter default permit

[fw2]int eth0/0.1

[fw2-Ethernet0/0.1]vlan-type dot1q vid 10

[fw2-Ethernet0/0.1]ip add 192.168.10.2 24

[fw2-Ethernet0/0.1]int eth 0/0.2

[fw2-Ethernet0/0.2]vlan-type dot1q vid 20

[fw2-Ethernet0/0.2]ip add 192.168.20.2 24

[fw2]int eth0/4

[fw2-Ethernet0/4]ip add 192.168.4.1 24

[fw2]firewall zone trust

[fw2-zone-trust]add interface eth0/0.1

[fw2-zone-trust]add interface eth0/0.2

[fw2-zone-untrust]add int

[fw2-zone-untrust]add interface eth0/4

[fw2]ip route 0.0.0.00 192.168.4.2

[fw2]acl number 2000 match-order auto

[fw2-acl-basic-2000]rule 10 permit sourceany

[fw2-acl-basic-2000]int eth 0/4

[fw2-Ethernet0/4]nat outbound 2000

[fw2-Ethernet0/4]int eth0/0.1

[fw2-Ethernet0/0.1]vrrp vrid 10 virtual-ip192.168.10.254

[fw2-Ethernet0/0.1]int eth0/0.2

[fw2-Ethernet0/0.2]vrrp vrid 20 virtual-ip192.168.20.254

[fw2-Ethernet0/0.2]vrrp vrid 20 priority120

[fw2-Ethernet0/0.2]vrrp vrid 20 tracketh0/4 reduce 30

配置isp

[Router]sys isp

[isp]int e0

[isp-Ethernet0]ip add 192.168.3.2 24

[isp-Ethernet0]int e1

[isp-Ethernet1]ip add 192.168.4.2 24

[isp]int async 0

[isp-Async0]ip add 1.1.1.124

[isp-Async0]loopback

在Pc10上ping1.1.1.1