华为防火墙双机热备配置案例(无vrrp)

双机热备配置案例(无vrrp)"/>

华为防火墙双机热备配置案例(无vrrp)

思路：
IP和路由、ospf要两台防火墙单配，hrp不会同步
其它zone和策略会同步，只在master上配就行了

FW_A主要配置：

hrp enable
hrp interface GigabitEthernet1/0/2 remote 172.16.0.2

interface GigabitEthernet1/0/0
undo shutdown
ip address 12.1.1.1 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/1
undo shutdown
ip address 1.1.1.2 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/2
undo shutdown
ip address 172.16.0.1 255.255.255.0
service-manage ping permit

firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/0

firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1

firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/2

ospf 1
default-route-advertise //主备两台都得下发
area 0.0.0.0
network 12.1.1.1 0.0.0.0

ip route-static 0.0.0.0 0.0.0.0 1.1.1.5

security-policy
default action permit

nat-policy //只在主的上配，会自动hrp同步到备
rule name internet
source-zone trust
destination-zone untrust
source-address 10.1.1.0 mask 255.255.255.0
action source-nat easy-ip

FW_B主要配置

hrp enable
hrp standby-device //指定自己为备
hrp interface GigabitEthernet1/0/2 remote 172.16.0.1

interface GigabitEthernet1/0/0
undo shutdown
ip address 11.1.1.1 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/1
undo shutdown
ip address 1.1.1.1 255.255.255.0
service-manage ping permit

interface GigabitEthernet1/0/2
undo shutdown
ip address 172.16.0.2 255.255.255.0
service-manage ping permit

firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/0

firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1

firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/2

ospf 1
default-route-advertise
area 0.0.0.0
network 11.1.1.1 0.0.0.0

ip route-static 0.0.0.0 0.0.0.0 1.1.1.5

security-policy
default action permit

nat-policy
rule name internet
source-zone trust
destination-zone untrust
source-address 10.1.1.0 mask 255.255.255.0
action source-nat easy-ip