CLI举例：上下行连接路由器（路由引流）
介绍了集群设备，上下行连接路由器的配置举例。
组网需求
如图1所示，上行网络使用BGP，下行网络使用OSPF，多数据中心统一通过路由器R4接入Internet。
希望本数据中心的流量优先由本数据中心FW承担。当某台FW故障时，流量能切换到其他FW上进行。
同时配置路由引流，实现业务组和路由协议联动：当下行流量切换时，路由协议根据业务组的状态调整发布路由的Cost值，使上行流量也同步切换。
数据规划
| 项目 | 数据 | 说明 |
|---|---|---|
| FW_A |
|
|
| FW_B |
|
|
| FW_C |
|
|
操作步骤
- 完成网络基本配置。包括配置接口IP地址、接口加入安全区域和路由。
以下配置需要在每个集群成员上执行。下面给出FW_A上的配置，FW_B/C的配置请参考。
# 配置各接口的IP地址。<FW_A> system-view [FW_A] interface GigabitEthernet 1/0/1 [FW_A-GigabitEthernet1/0/1] ip address 10.1.2.1 24 [FW_A-GigabitEthernet1/0/1] quit [FW_A] interface GigabitEthernet 1/0/2 [FW_A-GigabitEthernet1/0/2] ip address 10.1.1.1 24 [FW_A-GigabitEthernet1/0/2] quit [FW_A] interface Eth-Trunk 1 [FW_A-Eth-Trunk1] ip address 10.1.5.1 24 [FW_A-Eth-Trunk1] trunkport GigabitEthernet 1/0/3 to 1/0/4 [FW_A-Eth-Trunk1] quit [FW_A] interface Eth-Trunk 2 [FW_A-Eth-Trunk2] ip address 10.1.6.1 24 [FW_A-Eth-Trunk2] trunkport GigabitEthernet 1/0/5 to 1/0/6 [FW_A-Eth-Trunk2] quit [FW_A] interface Eth-Trunk 3 [FW_A-Eth-Trunk3] ip address 10.1.7.1 24 [FW_A-Eth-Trunk3] trunkport GigabitEthernet 1/0/7 to 1/0/8 [FW_A-Eth-Trunk3] quit # 将各接口加入相应的安全区域。[FW_A] firewall zone trust [FW_A-zone-trust] add interface GigabitEthernet 1/0/2 [FW_A-zone-trust] quit [FW_A] firewall zone dmz [FW_A-zone-dmz] add interface Eth-Trunk 1 [FW_A-zone-dmz] add interface Eth-Trunk 2 [FW_A-zone-dmz] add interface Eth-Trunk 3 [FW_A-zone-dmz] add interface Tunnel 1 [FW_A-zone-dmz] add interface Tunnel 2 [FW_A-zone-dmz] quit [FW_A] firewall zone untrust [FW_A-zone-untrust] add interface GigabitEthernet 1/0/1 [FW_A-zone-untrust] quit # 配置GRE隧道。[FW_A] interface Tunnel 1 [FW_A-Tunnel1] ip address 10.1.10.1 255.255.255.0 [FW_A-Tunnel1] tunnel-protocol gre [FW_A-Tunnel1] source 10.2.2.1 [FW_A-Tunnel1] destination 10.2.3.2 [FW_A-Tunnel1] quit [FW_A] interface Tunnel 2 [FW_A-Tunnel2] ip address 10.1.11.1 255.255.255.0 [FW_A-Tunnel2] tunnel-protocol gre [FW_A-Tunnel2] source 10.2.2.1 [FW_A-Tunnel2] destination 10.2.4.2 [FW_A-Tunnel2] quit # 配置OSPF，保证路由可达。[FW_A] ospf 1 [FW_A-ospf-1] area 0.0.0.1 [FW_A-ospf-1-area-0.0.0.1] network 10.2.2.0 0.0.0.255 [FW_A-ospf-1-area-0.0.0.1] quit [FW_A-ospf-1] quit [FW_A] ospf 2 [FW_A-ospf-2] area 0.0.0.1 [FW_A-ospf-2-area-0.0.0.1] network 10.1.10.0 0.0.0.255 [FW_A-ospf-2-area-0.0.0.1] quit [FW_A-ospf-2] quit [FW_A] ospf 3 [FW_A-ospf-3] area 0.0.0.1 [FW_A-ospf-3-area-0.0.0.1] network 10.1.11.0 0.0.0.255 [FW_A-ospf-3-area-0.0.0.1] quit [FW_A-ospf-3] quit # 配置BGP，保证路由可达。[FW_A] bgp 10 [FW_A-bgp] router-id 1.1.1.1 [FW_A-bgp] peer 10.1.2.2 as-number 10 [FW_A-bgp] ipv4-family unicast [FW_A-bgp-af-ipv4] undo synchronization [FW_A-bgp-af-ipv4] import-route ospf 1 [FW_A-bgp-af-ipv4] import-route ospf 2 [FW_A-bgp-af-ipv4] import-route ospf 3 [FW_A-bgp-af-ipv4] peer 10.1.2.2 enable [FW_A-bgp-af-ipv4] quit [FW_A-bgp] quit - 开启集群功能。
以下配置需要在每个集群成员上执行。# 配置集群协商参数。[FW_A] cluster id 1000 [FW_A] cluster detect-interval 2 [FW_A] cluster timer holding-multiplier 4 [FW_A] cluster timer hello 2 [FW_A] cluster backup node-num 2 [FW_A] cluster preempt delay 70 [FW_A] cluster ip-list node 1 negotiation 10.1.5.1 backup 10.1.6.1 forward 10.1.7.1 [FW_A] cluster ip-list node 2 negotiation 10.1.5.2 backup 10.1.6.2 forward 10.1.7.2 [FW_A] cluster ip-list node 3 negotiation 10.1.5.3 backup 10.1.6.3 forward 10.1.7.3 [FW_A] cluster node bind 1 [FW_A] cluster standby config enable [FW_A] cluster session fast-sync enable [FW_A] cluster enable - 配置业务组，将业务组关联到OSPF进程，实现路由引流。
以下配置请在集群管理主上配置，会自动同步到集群其他成员。C_No1_M[FW_A] business-group 1 C_No1_M[FW_A-business-group-1] node 1 priority 100 C_No1_M[FW_A-business-group-1] node 2 priority 90 C_No1_M[FW_A-business-group-1] node 3 priority 80 C_No1_M[FW_A-business-group-1] bind ospf 1 C_No1_M[FW_A-business-group-1] quit C_No1_M[FW_A] business-group 2 C_No1_M[FW_A-business-group-2] node 1 priority 80 C_No1_M[FW_A-business-group-2] node 2 priority 100 C_No1_M[FW_A-business-group-2] node 3 priority 90 C_No1_M[FW_A-business-group-2] bind ospf 2 C_No1_M[FW_A-business-group-2] quit C_No1_M[FW_A] business-group 3 C_No1_M[FW_A-business-group-3] node 1 priority 90 C_No1_M[FW_A-business-group-3] node 2 priority 80 C_No1_M[FW_A-business-group-3] node 3 priority 100 C_No1_M[FW_A-business-group-3] bind ospf 3 C_No1_M[FW_A-business-group-3] quit - 配置安全策略。
以下配置请在集群管理主上配置，会自动同步到集群其他成员。# 配置安全策略，允许内网用户访问外网。C_No1_M[FW_A] security-policy C_No1_M[FW_A-policy-security] rule name policy_sec1 C_No1_M[FW_A-policy-security-rule-policy_sec1] source-zone trust C_No1_M[FW_A-policy-security-rule-policy_sec1] destination-zone untrust C_No1_M[FW_A-policy-security-rule-policy_sec1] source-address 10.4.0.0 16 C_No1_M[FW_A-policy-security-rule-policy_sec1] action permit C_No1_M[FW_A-policy-security-rule-policy_sec1] quit # 配置安全策略，允许FW与上下行路由器交互OSPF/BGP报文。C_No1_M[FW_A-policy-security] rule name policy_sec2 C_No1_M[FW_A-policy-security-rule-policy_sec2] source-zone local C_No1_M[FW_A-policy-security-rule-policy_sec2] destination-zone trust untrust C_No1_M[FW_A-policy-security-rule-policy_sec2] action permit C_No1_M[FW_A-policy-security-rule-policy_sec2] quit C_No1_M[FW_A-policy-security] rule name policy_sec3 C_No1_M[FW_A-policy-security-rule-policy_sec3] source-zone trust untrust C_No1_M[FW_A-policy-security-rule-policy_sec3] destination-zone local C_No1_M[FW_A-policy-security-rule-policy_sec3] action permit C_No1_M[FW_A-policy-security-rule-policy_sec3] quit # 配置Local和DMZ的域间安全策略，允许封装后的GRE报文通过域间安全策略。C_No1_M[FW_A-policy-security] rule name policy2 C_No1_M[FW_A-policy-security-rule-policy2] source-zone local dmz C_No1_M[FW_A-policy-security-rule-policy2] destination-zone dmz local C_No1_M[FW_A-policy-security-rule-policy2] action permit C_No1_M[FW_A-policy-security-rule-policy2] quit C_No1_M[FW_A-policy-security] quit - 配置路由器R1，具体配置命令请参考路由器的相关文档。
R1上接口IP等基础配置略。R2/R3上的配置与R1类似，请参考以下配置。# 配置GRE隧道。Tunnel 1和FW_B建立GRE隧道；Tunnel 2和FW_C建立GRE隧道。<R1> system-view [R1] interface Tunnel 1 [R1-Tunnel1] ip address 10.1.12.2 24 [R1-Tunnel1] tunnel-protocol gre [R1-Tunnel1] source 10.2.2.2 [R1-Tunnel1] destination 10.2.3.1 [R1-Tunnel1] quit [R1] interface Tunnel 2 [R1-Tunnel2] ip address 10.1.14.2 24 [R1-Tunnel2] tunnel-protocol gre [R1-Tunnel2] source 10.2.2.2 [R1-Tunnel2] destination 10.2.4.1 [R1-Tunnel2] quit # 配置OSPF。[R1] ospf 1 [R1-ospf-1] import-route static type 1 [R1-ospf-1] area 0.0.0.1 [R1-ospf-1-area-0.0.0.1] network 10.2.2.0 0.0.0.255 [R1-ospf-1-area-0.0.0.1] quit [R1-ospf-1] area 0.0.0.2 [R1-ospf-1-area-0.0.0.2] network 10.1.12.0 0.0.0.255 [R1-ospf-1-area-0.0.0.2] quit [R1-ospf-1] area 0.0.0.3 [R1-ospf-1-area-0.0.0.3] network 10.1.14.0 0.0.0.255 [R1-ospf-1-area-0.0.0.3] quit [R1-ospf-1] quit - 配置路由器R4。具体配置命令请参考路由器的相关文档。
R4上接口IP等基础配置略。<R4> system-view [R4] bgp 10 [R4-bgp] router-id 4.4.4.4 [R4-bgp] peer 10.1.2.1 as-number 10 [R4-bgp] peer 10.1.3.1 as-number 10 [R4-bgp] peer 10.1.4.1 as-number 10 [R4-bgp] quit
结果验证
-
在集群管理主上执行display cluster negotiation status命令，查看集群协商的状态信息。 C_No1_M<FW_A> display cluster negotiation statusID status health version join leave ------------------------------------------------------------ 3 slave 10000 A 2018/02/20 16:56:14 NA 2 slave 10000 A 2018/02/20 16:56:17 NA 1* master 10000 A 2018/02/20 16:55:32 NA 以上信息表示集群1000已经建立，存在3个成员，版本一致，健康度均是10000。在管理主上执行display business-group brief命令，检查业务组信息。C_No1_M<FW_A> display business-group brief TotalBG:3 Master:1 Slave:2 Invalid:0 Init:0 BGID State TopThree IP_num Pre_Preempt next_master ------------------------------------------------------------------------------- 1 master 1 2 3 0 NO - 2 slave 2 3 1 0 NO - 3 slave 3 1 2 0 NO - -
以上信息表示：FW_A作为业务组1的主设备；作为业务组2、3的备设备；每个业务组的排序符合预期。
- 在R4上查看路由表，正常情况下去DC1的下一跳地址是10.1.2.1。当FW_A故障后，通往DC1的下一跳地址变成10.1.3.1，即通过FW_B转发。
配置脚本
本例中，集群成员上的配置基本一致。主要差异在：接口IP和本设备对应集群节点ID。
下面配置文件以FW_A为例，差异部分会加粗显示，请注意替换。
#
cluster id 1000
cluster detect-interval 2
cluster timer holding-multiplier 4
cluster timer hello 2
cluster backup node-num 2
cluster preempt delay 70
cluster standby config enable
cluster session fast-sync enable
cluster preempt
cluster ip-list node 1 negotiation 10.1.5.1 backup 10.1.6.1 forward 10.1.7.1
cluster ip-list node 2 negotiation 10.1.5.2 backup 10.1.6.2 forward 10.1.7.2
cluster ip-list node 3 negotiation 10.1.5.3 backup 10.1.6.3 forward 10.1.7.3
cluster node bind 1
cluster enable
#business-group 1node 1 priority 100node 2 priority 90node 3 priority 80bind ospf 1business-group 2node 1 priority 80node 2 priority 100node 3 priority 90bind ospf 2business-group 3node 1 priority 90node 2 priority 80node 3 priority 100bind ospf 3
#
ospf 1area 0.0.0.1network 10.2.2.0 0.0.0.255
#
ospf 2area 0.0.0.1network 10.1.10.0 0.0.0.255
#
ospf 3area 0.0.0.1network 10.1.11.0 0.0.0.255
#
bgp 10router-id 1.1.1.1peer 10.1.2.2 as-number 10ipv4-family unicastundo synchronizationimport-route ospf 1import-route ospf 2import-route ospf 3peer 10.1.2.2 enable
#
firewall zone trustset priority 85add interface GigabitEthernet 1/0/2
#
firewall zone untrustset priority 5add interface GigabitEthernet 1/0/1
#
firewall zone dmzset priority 50add interface Eth-Trunk1add interface Eth-Trunk2add interface Eth-Trunk3add interface Tunnel1add interface Tunnel2
#
interface GigabitEthernet 1/0/1ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet 1/0/2ip address 10.2.2.1 255.255.255.0
#
interface GigabitEthernet 1/0/3eth-trunk 1
#
interface GigabitEthernet 1/0/4eth-trunk 1
#
interface GigabitEthernet 1/0/5eth-trunk 2
#
interface GigabitEthernet 1/0/6eth-trunk 2
#
interface GigabitEthernet 1/0/7eth-trunk 3
#
interface GigabitEthernet 1/0/8eth-trunk 3
#
interface Eth-Trunk1ip address 10.1.5.1 255.255.255.0
#
interface Eth-Trunk2ip address 10.1.6.1 255.255.255.0
#
interface Eth-Trunk3ip address 10.1.7.1 255.255.255.0
#
interface Tunnel1ip address 10.1.10.1 255.255.255.0tunnel-protocol gresource 10.2.2.1destination 10.2.3.2
#
interface Tunnel2ip address 10.1.11.1 255.255.255.0tunnel-protocol gresource 10.2.2.1destination 10.2.4.2
#
security-policyrule name policy_sec1source-zone trustdestination-zone untrustsource-address 10.4.0.0 16action permitrule name policy_sec2source-zone localdestination-zone localdestination-zone untrustaction permit rule name policy_sec3source-zone untrustsource-zone trustdestination-zone localaction permitrule name policy2source-zone localsource-zone dmzdestination-zone localdestination-zone dmzaction permit
#
