Eudemon1000EU3双机热备配置指导.docx
- 文档编号:22785022
- 上传时间:2023-04-27
- 格式:DOCX
- 页数:17
- 大小:46.24KB
Eudemon1000EU3双机热备配置指导.docx
《Eudemon1000EU3双机热备配置指导.docx》由会员分享,可在线阅读,更多相关《Eudemon1000EU3双机热备配置指导.docx(17页珍藏版)》请在冰豆网上搜索。
Eudemon1000EU3双机热备配置指导
Eudemon1000E-U3双机热备部署方案
一、割接前准备工作
1.1设备登陆
缺省情况下,Eudemon通过Console口登录时的认证方式为AAA,用户名为admin,密码为Admin@123
1.2备份旧的配置文件
#查看启动时加载的配置文件
10:
21:
102014/03/07
Configedstartupsystemsoftware:
flash:
/usg5000.bin
Startupsystemsoftware:
flash:
/usg5000.bin
Nextstartupsystemsoftware:
flash:
/usg5000.bin
Startupsaved-configurationfile:
flash:
/a.cfg
Nextstartupsaved-configurationfile:
flash:
/a.cfg
#备份当前配置(文件名与加载配置文件名不同),防止割接失败时快速恢复
#查看存储的文件信息
10:
26:
542014/03/07
Directoryofflash:
/
0-rw-18224900Jul01200700:
03:
49usg5000.bin
1-rw-339Mar31201016:
54:
49flashinfo.fls
2-rw-771Mar31201016:
55:
15license.txt
7-rw-3523Mar07201408:
15:
41a.cfg
8-rw-3523Mar07201410:
26:
4720140307.cfg
1.3系统管理相关命令
#配置设备下次启动时加载的配置文件
查看配置文件信息
查看设备启动时使用的文件信息
displaystartup
查看存储设备中的文件信息
dir[/all][filename]
查看当前配置文件
displaycurrent-configuration
二、方案概述
Eudemon1000E-U3采用混合模式,两台防火墙配置HRP双机热备;Trust侧通过Ip-link检测GUIP是否可达;Trust与Untrust接口联动;Untrust侧三层口起VRRP,心跳跑在交换机侧,心跳通过Eth-Trunk来保护;VRRP/HRP通过监测Ip-link及接口状态来进行切换。
GU主备板上起BFD(Echo报方方式)检测EudemonTrust侧的实IP,根据BFD状态进行主备切换;主备板到基站侧的默认路由下一跳为EudemonTrust侧的实IP,区别于以往的配置方式(以前方案GU配置默认路由下一跳主备板都是同一个IP)。
CMNET侧两台设备(三层口)之间起VRRP,心跳跑在两台交换机之间.
三、方案部署
3.1设置防火墙模式
#查询防火墙模式
[Eudemon-A]displayfirewallmode
14:
10:
442014/03/07
firewallmodecomposite//混合模式
firewallmodecompositeifreboot
#若不是混合模式,配置混合模式,保存配置重启
[Eudemon-A]firewallmodecomposite
#版本信息
[Eudemon-A]displayversion
14:
16:
432014/03/07
HuaweiVersatileRoutingPlatformSoftware
SoftwareVersion:
Eudemon1000EV100R002C01SPC008(VRP(R)Software,Version3.30)
Copyright(C)2008-2009HuaweiTechnologiesCo.,Ltd.
QuidwayEudemon1000E-U3uptimeis0week,0day,6hours,11minutes
RPU'sVersionInformation:
2048MbytesSDRAM
64MbytesFLASH
128KbytesNVRAM
PCBVersion:
VER.B
RPELogicVersion:
005B
SmallBootROMVersion:
025Oct122009
BigBootROMVersion:
035Sep292009
3.2数据规划
设备
接口
IP地址
虚拟IP地址
Eudemon-A
GigabitEthernet0/0/0
2.2.2.2/24
2.2.2.1/24
GigabitEthernet0/0/3
10.10.216.137/24
/
Eth-Trunk1
15.15.15.2/24
15.15.15.3/24
Eudemon-B
GigabitEthernet0/0/0
2.2.2.4/24
2.2.2.1/24
GigabitEthernet0/0/3
10.10.216.138/24
/
Eth-Trunk1
15.15.15.1/24
15.15.15.3/24
GU
/
10.10.216.38/24
/
CMNET
/
/
2.2.2.10/24
3.3Eudemon-A配置
1.
2.
3.
3.1.
3.2.
3.3.
3.3.1.上、下行接口;Untrust侧VRRP,加入安全区域配置
interfaceGigabitEthernet0/0/0
ipaddress2.2.2.2255.255.255.0
vrrpvrid10virtual-ip2.2.2.1master
#
interfaceGigabitEthernet0/0/3
ipaddress10.10.216.137255.255.255.0
#
firewallzonetrust
addinterfaceGigabitEthernet0/0/3
#
firewallzoneuntrust
addinterfaceGigabitEthernet0/0/0
#
3.3.2.启用HRP及心跳线配置
interfaceEth-Trunk1
#
firewallzonedmz
addinterfaceEth-Trunk1
#
interfaceGigabitEthernet0/0/1
eth-trunk1
#
interfaceGigabitEthernet0/0/2
eth-trunk1
#
interfaceEth-Trunk1
ipaddress15.15.15.2255.255.255.0
vrrpvrid15virtual-ip15.15.15.3master
#
hrpinterfaceEth-Trunk1
hrpenable
#
3.3.3.域间缺省包过滤配置
firewallpacket-filterdefaultpermitinterzonelocaltrustdirectioninbound
firewallpacket-filterdefaultpermitinterzonelocaltrustdirectionoutbound
firewallpacket-filterdefaultpermitinterzonelocaluntrustdirectionoutbound
firewallpacket-filterdefaultpermitinterzonelocaldmzdirectionoutbound
firewallpacket-filterdefaultpermitinterzonetrustuntrustdirectionoutbound
firewallpacket-filterdefaultpermitinterzonetrustdmzdirectionoutbound
firewallpacket-filterdefaultpermitinterzonedmzuntrustdirectionoutbound
3.3.4.NAT功能配置
nataddress-group02.2.2.22.2.2.2
natserverglobal2.2.2.1inside10.10.216.38vrrp10
3.3.5.Trust区域和Untrust区域的域间转发策略配置
#配置ACL
aclnumber3000
descriptiontrust-to-local
rule0permittcpdestination-porteqtelnet
rule1permittcpdestination-porteqssh
rule2permiticmpicmp-typeecho
aclnumber3001
descriptionuntrust-trust
rule0permitudpdestination-porteq4500
rule5permitudpdestination-porteq500
rule10permitudpdestination-porteq3784
rule11permitudpdestination-porteq3785
rule12permitudpdestination-porteq4784
rule13permitudpdestination-porteq30000
rule14permiticmpicmp-typeecho
aclnumber3002
descriptiontrust-untrust
rule0permitipsource10.100.10.00.0.0.255
rule1permiticmpicmp-typeecho
rule2permitipsource10.10.216.00.0.0.255
aclnumber3003
descriptionuntrust-to-local
rule0permitipdestination2.2.2.00.0.0.255
aclnumber3004
descriptiondmz-to-local
rule0permitipdestination15.15.15.00.0.0.255
#
#配置转发策略
firewallinterzonelocaltrust
packet-filter3000inbound
#
firewallinterzonelocaluntrust
packet-filter3003inbound
#
firewallinterzonelocaldmz
packet-filter3004inbound
#
firewallinterzonetrustuntrust
packet-filter3001inbound
packet-filter3002outbound
natoutbound3002address-group0
3.3.6.IP-link、接口联动功能、默认路由配置
#配置IP-link
ip-link2destination10.10.216.38modeicmp
ip-linkcheckenable
#配置接口、VRRP联动
interfaceGigabitEthernet0/0/0
vrrpvrid10ip-link2
link-group1
#
interfaceGigabitEthernet0/0/3
link-group1
#配置默认路由
iproute-static0.0.0.00.0.0.02.2.2.10
3.3.7.AAA用户配置
aaa
local-userrootpasswordsimpleroot@123
local-userrootservice-typewebtelnetssh
local-userrootlevel3
#
sshuserrootauthentication-typepassword
#
user-interfacevty04
authentication-modeaaa
#
3.3.8.查看状态是否正常?
HRP_M[Eudemon-A]displayvrrp
16:
13:
412014/03/07
GigabitEthernet0/0/0|VirtualRouter10
state:
Master
VirtualIP:
2.2.2.1
PriorityRun:
100
PriorityConfig:
100
MasterPriority:
100
Preempt:
YESDelayTime:
0
Timer:
1
AuthType:
NONE
CheckTTL:
YES
Ip-Link2:
Up
Eth-Trunk1|VirtualRouter15
state:
Master
VirtualIP:
15.15.15.3
PriorityRun:
100
PriorityConfig:
100
MasterPriority:
100
Preempt:
YESDelayTime:
0
Timer:
1
AuthType:
NONE
CheckTTL:
YES
HRP_M[Eudemon-A]dishrpstate
16:
13:
472014/03/07
Thefirewall'sconfigstateis:
MASTER
Currentstateofvirtualroutersconfiguredasmaster:
GigabitEthernet0/0/0vrid10:
master
Eth-Trunk1vrid15:
master
(GigabitEthernet0/0/1):
up
(GigabitEthernet0/0/2):
up
HRP_M[Eudemon-A]dishrpint
16:
13:
522014/03/07
Eth-Trunk1:
running
HRP_M[Eudemon-A]disip-link
16:
15:
142014/03/07
numstatetimermodevpn-instanceip-addressinterface-name
2up3icmp10.10.216.38
HRP_M[Eudemon-A]
#查看NAT转换会话
HRP_M[Eudemon-A]displayfirewallsessiontableverbose
16:
20:
082014/03/07
Currenttotalsessions:
7
icmpVPN:
public->public
Zone:
untrust->trustTTL:
00:
00:
20Left:
00:
00:
20
Interface:
G0/0/3Nexthop:
10.10.216.38MAC:
00-00-50-a1-ca-8c
<--packets:
41bytes:
3444-->packets:
41bytes:
3444
2.2.2.1:
44[10.10.216.38:
44]<--2.2.2.11:
44
3.4Eudemon-B配置
3.4.
3.4.1.上、下行接口;Untrust侧VRRP,加入安全区域配置
interfaceGigabitEthernet0/0/0
ipaddress2.2.2.4255.255.255.0
vrrpvrid10virtual-ip2.2.2.1slave
#
interfaceGigabitEthernet0/0/3
ipaddress10.10.216.138255.255.255.0
#
firewallzonetrust
addinterfaceGigabitEthernet0/0/3
#
firewallzoneuntrust
addinterfaceGigabitEthernet0/0/0
#
3.4.2.启用HRP及心跳线配置
interfaceEth-Trunk1
#
firewallzonedmz
addinterfaceEth-Trunk1
#
interfaceGigabitEthernet0/0/1
eth-trunk1
#
interfaceGigabitEthernet0/0/2
eth-trunk1
#
interfaceEth-Trunk1
ipaddress15.15.15.1255.255.255.0
vrrpvrid15virtual-ip15.15.15.3master
#
hrpinterfaceEth-Trunk1
hrpenable
#
3.4.3.域间缺省包过滤配置
firewallpacket-filterdefaultpermitinterzonelocaltrustdirectioninbound
firewallpacket-filterdefaultpermitinterzonelocaltrustdirectionoutbound
firewallpacket-filterdefaultpermitinterzonelocaluntrustdirectionoutbound
firewallpacket-filterdefaultpermitinterzonelocaldmzdirectionoutbound
firewallpacket-filterdefaultpermitinterzonetrustuntrustdirectionoutbound
firewallpacket-filterdefaultpermitinterzonetrustdmzdirectionoutbound
firewallpacket-filterdefaultpermitinterzonedmzuntrustdirectionoutbound
3.4.4.NAT功能配置
nataddress-group02.2.2.42.2.2.4
natserverglobal2.2.2.1inside10.10.216.38vrrp10
3.4.5.Trust区域和Untrust区域的域间转发策略配置
#配置ACL
aclnumber3000
descriptiontrust-to-local
rule0permittcpdestination-porteqtelnet
rule1permittcpdestination-porteqssh
rule2permiticmpicmp-typeecho
aclnumber3001
descriptionuntrust-trust
rule0permitudpdestination-porteq4500
rule5permitudpdestination-porteq500
rule10permitudpdestination-porteq3784
rule11permitudpdestination-porteq3785
rule12permitudpdestination-porteq4784
rule13permitudpdestination-porteq30000
rule14permiticmpicmp-typeecho
aclnumber3002
descriptiontrust-untrust
rule0permitipsource10.100.10.00.0.0.255
rule1permiticmpicmp-typeecho
rule2permitipsource10.10.216.00.0.0.255
aclnumber3003
descriptionuntrust-to-local
rule0permitipdestination2.2.2.00.0.0.255#
aclnumber3004
descriptiondmz-to-local
rule0permitipdestination15.15.15.00.0.0.255
#
#配置转发策略
firewallinterzonelocaltrust
packet-filter3000inbound
#
firewallinterzonelocaluntrust
packet-filter3003inbound
#
firewallinterzonelocaldmz
packet-filter3004inbound
#
firewallinterzonetrustuntrust
packet-filter3001inbound
packet-filter3002outbound
natoutbound3002address-group0
3.4.6.IP-link、接口联动功能、默认路由配置
#配置IP-link
ip-link2destination10.10.216.38m
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- Eudemon1000EU3 双机 配置 指导