本文配置目标：华为防火墙双机热备，电信和联通双运营商、固定IP接入，华为核心交换机配置VRRP。
为保护客户隐私，电信和联通的IP地址为虚构，如有雷同，纯属巧合。
真实拓扑图如下所示，电信和联通给的掩码都是29，如果掩码都是30，恐怕不能这么连接。
回来用模拟器还原了配置，注意AR3以及下面的两台交换机，是用来模拟运营商接入的，实际环境中只是两个光猫而已。
一、配置模拟运营商接入的设备
1、路由器的配置：
配置各接口IP，并且宣告进OSPF
interface GigabitEthernet0/0/0
ip address 33.1.1.3 255.255.255.0
interface GigabitEthernet0/0/1
ip address 34.1.1.3 255.255.255.0
interface LoopBack0
ip address 3.3.3.3 255.255.255.255
ospf 1 router-id 3.3.3.3
area 0.0.0.0
network 3.3.3.3 0.0.0.0
network 33.1.1.3 0.0.0.0
network 34.1.1.3 0.0.0.0
2、交换机SW3的配置：
创建VLAN，配置IP，并且宣告进OSPF
vlan batch 33 130 222
interface Vlanif33
ip address 33.1.1.1 255.255.255.0
interface Vlanif222
ip address 222.92.76.1 255.255.255.0
interface GigabitEthernet0/0/1
port link-type access
port default vlan 222
interface GigabitEthernet0/0/2
port link-type access
port default vlan 222
interface GigabitEthernet0/0/3
port link-type access
port default vlan 33
ospf 1 router-id 1.1.1.1
area 0.0.0.0
network 222.92.76.1 0.0.0.0
network 33.1.1.1 0.0.0.0
3、交换机SW4的配置：
vlan batch 34 130
interface Vlanif34
ip address 34.1.1.4 255.255.255.0
interface Vlanif130
ip address 130.1.1.1 255.255.255.0
interface GigabitEthernet0/0/1
port link-type access
port default vlan 130
interface GigabitEthernet0/0/2
port link-type access
port default vlan 130
interface GigabitEthernet0/0/3
port link-type access
port default vlan 34
ospf 1 router-id 4.4.4.4
area 0.0.0.0
network 130.1.1.1 0.0.0.0
network 34.1.1.4 0.0.0.0
二、防火墙的配置
以FW1的配置为例说明
1、配置各接口IP
2、配置NAT策略
电信的NAT策略：
联通的NAT策略：
3、配置上网案例策略：
4、配置IP-LINK，也可以在创建默认的路由顺便创建
5、配置默认路由
电信和联通各有一条默认路由
6、配置通向局域网的回程路由
7、配置FW2，过程略，方法同上；
8、在FW1上配置双机热备（主）
9、在FW2上配置双机热备（备）
三、核心交换机和接入交换机的配置
1、核心交换机CE1的配置
vlan batch 9 to 10
stp enable
Stp mode mstp
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 9 to 10
stp instance 1 root primary
interface Vlanif9
description ith
ip address 192.168.9.1 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.9.254
vrrp vrid 1 priority 120
vrrp vrid 1 preempt timer delay 15
vrrp vrid 1 track interface GE1/0/0 reduce 40
interface Vlanif10
ip address 192.168.10.1 255.255.255.0
vrrp vrid 2 virtual-ip 192.168.10.254
vrrp vrid 2 priority 120
vrrp vrid 2 track interface GE1/0/0 reduce 40
interface GE1/0/0
undo portswitch
undo shutdown
ip address 11.1.1.1 255.255.255.248
interface GE1/0/1
undo shutdown
port link-type trunk
port trunk allow-pass vlan all
interface GE1/0/2
undo shutdown
port link-type trunk
port trunk allow-pass vlan 9 to 10
interface GE1/0/3
undo shutdown
port link-type trunk
port trunk allow-pass vlan 9 to 10
ip route-static 0.0.0.0 0.0.0.0 11.1.1.2 preference 50
ip route-static 0.0.0.0 0.0.0.0 13.1.1.2 preference 70
2、核心交换机CE2的配置
vlan batch 9 to 10
stp enable
Stp mode mstp
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 9 to 10
stp instance 1 root secondary
interface Vlanif9
ip address 192.168.9.2 255.255.255.0
vrrp vrid 1 virtual-ip 192.168.9.254
interface Vlanif10
ip address 192.168.10.2 255.255.255.0
vrrp vrid 2 virtual-ip 192.168.10.254
interface MEth0/0/0
undo shutdown
interface GE1/0/0
undo shutdown
port link-type trunk
port trunk allow-pass vlan 9 to 10
interface GE1/0/1
undo shutdown
port link-type trunk
port trunk allow-pass vlan 9 to 10
interface GE1/0/2
undo shutdown
port link-type trunk
port trunk allow-pass vlan 9 to 10
interface GE1/0/3
undo portswitch
undo shutdown
ip address 13.1.1.1 255.255.255.248
ip route-static 0.0.0.0 0.0.0.0 11.1.1.2 preference 70
ip route-static 0.0.0.0 0.0.0.0 13.1.1.2 preference 50
3、接入交换机SW1的配置：
vlan batch 9 to 10
stp region-configuration
region-name test
revision-level 1
instance 1 vlan 9 to 10
active region-configuration
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan 9 to 10
interface Ethernet0/0/2
port link-type trunk
port trunk allow-pass vlan 9 to 10
interface Ethernet0/0/3
port link-type access
port default vlan 9
stp edged-port enable
interface Ethernet0/0/4
port link-type access
port default vlan 10
stp edged-port enable
4、接入交换机SW2的配置
和SW1的配置非常接近，就不再重复贴出来了。
四、灾难测试
1、模拟VRRP Master交换机故障
如上图所示，停止CE1交换机后，上网流量切换到右边了；
2、模拟防火墙FW1故障
关停防火墙FW1之后，HRP状态切换了，右侧备机切换为激活状态，上网流量切换到FW2上面了，说明配置正确。
特别声明：以上内容(如有图片或视频亦包括在内)为自媒体平台“网易号”用户上传并发布，本平台仅提供信息存储服务。
Notice: The content above (including the pictures and videos if any) is uploaded and posted by a user of NetEase Hao, which is a social media platform and only provides information storage services.
