华为防火墙配置手册web（网络防火墙双机热备）
华为防火墙配置手册web（网络防火墙双机热备）ip address 10.1.1.2 255.255.255.0interface GigabitEthernet0/0/0sysname R1interface loo 0ip address 1.1.1.1 32
企业网络对安全性要求很高，为了确保网络的安全可靠运行，FW部署双机热备是一个重要方法。
拓扑说明：R1模拟出口路由器 Lo0 模拟外网 FW1和FW2部署VGMP组双机热备
R2模拟内网设备
基础配置
sysname R1
interface loo 0
ip address 1.1.1.1 32
interface GigabitEthernet0/0/0
ip address 10.1.1.2 255.255.255.0
ospf network-type p2p
interface GigabitEthernet0/0/1
ip address 30.1.1.2 255.255.255.0
ospf network-type p2p
ospf 1
silent-interface Ethernet0/0/0
area 0.0.0.0
network 1.1.1.1 0.0.0.0
network 10.1.1.2 0.0.0.0
network 30.1.1.2 0.0.0.0
sysname R2
interface GigabitEthernet0/0/0
ip address 20.1.1.1 255.255.255.0
ip route-static 0.0.0.0 0.0.0.0 20.1.1.254
防火墙配置
sysname FW1
interface GigabitEthernet1/0/0
ip address 20.1.1.252 255.255.255.0
interface GigabitEthernet1/0/1
ip address 10.1.1.1 255.255.255.0
ospf network-type p2p
interface GigabitEthernet1/0/6
ip address 100.100.100.1 255.255.255.0
firewall zone trust
add interface GigabitEthernet1/0/0
firewall zone untrust
add interface GigabitEthernet1/0/1
firewall zone name hrp
set priority 10
add interface GigabitEthernet1/0/6
security-policy
default action permit
y
ospf 1
silent-interface GigabitEthernet1/0/0
area 0.0.0.0
network 10.1.1.1 0.0.0.0
network 20.1.1.252 0.0.0.0
//基础配置
hrp enable
hrp adjust ospf-cost enable
hrp interface GigabitEthernet1/0/6 remote 100.100.100.2
hrp track interface GigabitEthernet1/0/1
interface GigabitEthernet1/0/0
VRRP vrid 1 virtual-ip 20.1.1.254 active
//配置HRP和VGMP组
sysname FW2
interface GigabitEthernet1/0/0
ip address 20.1.1.253 255.255.255.0
interface GigabitEthernet1/0/1
ip address 30.1.1.1 255.255.255.0
ospf network-type p2p
interface GigabitEthernet1/0/6
ip address 100.100.100.2 255.255.255.0
firewall zone trust
add interface GigabitEthernet1/0/0
firewall zone untrust
add interface GigabitEthernet1/0/1
firewall zone name hrp
set priority 10
add interface GigabitEthernet1/0/6
security-policy
default action permit
y
ospf 1
silent-interface GigabitEthernet1/0/0
area 0.0.0.0
network 30.1.1.1 0.0.0.0
network 20.1.1.253 0.0.0.0
hrp enable
hrp adjust ospf-cost enable
hrp interface GigabitEthernet1/0/6 remote 100.100.100.1
hrp track interface GigabitEthernet1/0/1
interface GigabitEthernet1/0/0
vrrp vrid 1 virtual-ip 20.1.1.254 standby
检查配置结果
可以看到FW1是HRP_M FW2 是HRP_S VRRP 状态正常
在R2上测试1.1.1.1的连通性
关闭R1的G0/0/0可以看到FW2切换到HRP_M 状态
在R2测试1.1.1.1的连通性正常，路径自动切换
实验成功。
注：本实验采用ENSP模拟器
