? SecPath核心防火墙双机热备典型配置举例
杭州华三通信技术有限公司
www.h3c.com.cn
第26页, 共33页
? SecPath核心防火墙双机热备典型配置举例
3. 验证结果
pc1从server http/ftp、方式get文件，连接不中断；
VRRP状态：
IPv4 Standby Information: Run Method : VIRTUAL-MAC Total number of virtual routers: 2
Interface VRID State Run Adver. Auth Virtual Pri Time Type IP --------------------------------------------------------------------- GE0/2 11 Master 105 1 NONE 11.0.0.1 GE0/3 122 Backup 100 1 NONE 12.0.0.2
[fw02-GigabitEthernet0/3]dis vrrp IPv4 Standby Information: Run Method : VIRTUAL-MAC Total number of virtual routers: 2
Interface VRID State Run Adver. Auth Virtual Pri Time Type IP
杭州华三通信技术有限公司
www.h3c.com.cn
第27页, 共33页
? SecPath核心防火墙双机热备典型配置举例 --------------------------------------------------------------------- GE0/2 11 Backup 100 1 NONE 11.0.0.1 GE0/3 122 Master 105 1 NONE 12.0.0.2
4. 注意事项
?
本配置完成，清除防火墙中所做的配置，以防对其他配置产生影响。
4.3.6 路由模式＋负载分担模式＋支持非对称路径
1. 功能简述（F1000E为例） 通过Vlan虚接口实现三层转发。 2. 典型配置步骤（组网4） (1) 命令行配置：
# F1000E-1: #
version 5.20, Feature 3101 #
sysname fw01 #
undo voice vlan mac-address 00e0-bb00-0000 #
nat address-group 1 12.2.2.1 12.2.2.254 level 1 nat address-group 2 12.2.3.1 12.2.3.254 level 1 #
domain default enable system #
acl number 3000
rule 0 permit ip source 11.0.0.3 0 acl number 3001
rule 0 permit ip source 11.0.0.4 0 # vlan 1 #
domain system
access-limit disable state active idle-cut disable
self-service-url disable #
杭州华三通信技术有限公司
www.h3c.com.cn
第28页, 共33页
user-group system #
local-user h3c
? SecPath核心防火墙双机热备典型配置举例 password cipher G`M^B interface Aux0 async mode flow link-protocol ppp # interface NULL0 # interface GigabitEthernet0/0 port link-mode route ip address 192.168.102.31 255.255.252.0 # interface GigabitEthernet0/2 port link-mode route ip address 11.0.0.11 255.0.0.0 vrrp vrid 11 virtual-ip 11.0.0.1 vrrp vrid 11 priority 105 vrrp vrid 11 track interface GigabitEthernet0/3 vrrp vrid 111 virtual-ip 11.0.0.2 # interface GigabitEthernet0/3 port link-mode route nat outbound 3001 address-group 2 track vrrp 12 nat outbound 3000 address-group 1 track vrrp 122 ip address 12.0.0.11 255.0.0.0 vrrp vrid 12 virtual-ip 12.0.0.1 vrrp vrid 12 priority 105 vrrp vrid 12 track interface GigabitEthernet0/2 vrrp vrid 122 virtual-ip 12.0.0.2 # interface GigabitEthernet1/1 port link-mode route # interface GigabitEthernet1/2 port link-mode route # interface GigabitEthernet1/3 杭州华三通信技术有限公司 www.h3c.com.cn 第29页, 共33页 port link-mode route # interface GigabitEthernet1/4 port link-mode route # interface GigabitEthernet1/5 port link-mode route # interface GigabitEthernet1/6 port link-mode route # interface GigabitEthernet1/7 port link-mode route # ? SecPath核心防火墙双机热备典型配置举例 ip route-static 192.168.96.0 255.255.252.0 192.168.100.254 # arp timer aging 1440 # load xml-configuration # user-interface con 0 idle-timeout 0 0 user-interface aux 0 user-interface vty 0 4 # return F1000E-2: # version 5.20, Feature 3101 # sysname fw02 # undo voice vlan mac-address 00e0-bb00-0000 # ike sa nat-keepalive-timer interval 0 # nat address-group 1 12.2.2.1 12.2.2.254 level 1 nat address-group 2 12.2.3.1 12.2.3.254 level 1 # domain default enable system 杭州华三通信技术有限公司 www.h3c.com.cn 第30页, 共33页