素材来源：华为防火墙配置指南
一边学习一边整理试验笔记，并与大家分享，侵权即删，谢谢支持！
附上汇总贴：玩转华为ENSP模拟器系列 | 合集_COCOgsta的博客-CSDN博客_华为模拟器实验
目标
介绍负载分担双机热备组网下如何配置IPSec VPN，且VPN隧道之间不备份。
组网需求
如图1所示，公司总部、分支均通过FW接入Internet。总部的FW_B和FW_C以负载分担份方式工作，其业务接口都工作在三层，并与上下行路由器之间运行OSPF协议。企业期望分支用户访问总部的流量受IPSec隧道保护，且FW_B和FW_C可以同时处理分支发往总部的IPSec流量。
配置思路
- 在FW_A接入Internet的两个公网接口上应用IPSec策略，分别与FW_B和FW_C建立IPSec隧道，两条IPSec保护相同的数据流。
- 配置FW_B和FW_C以负载分担方式工作。
操作步骤
-
配置FW_A（分支）。
-
基本配置。
- 配置接口IP地址。
-
<sysname> system-view [sysname] sysname FW_A [FW_A] interface GigabitEthernet 1 / 0 / 1 [FW_A-GigabitEthernet1/0/1] ip address 1.1.1.1 24 [FW_A-GigabitEthernet1/0/1] quit [FW_A] interface gigabitethernet 1 / 0 / 2 [FW_A-GigabitEthernet1/0/2] ip address 1.1.2.1 24 [FW_A-GigabitEthernet1/0/2] quit [FW_A] interface gigabitethernet 1 / 0 / 3 [FW_A-GigabitEthernet1/0/3] ip address 10.1.3.1 24 [FW_A-GigabitEthernet1/0/3] quit 复制代码 - 将接口加入相应安全区域。
-
[FW_A] firewall zone untrust [FW_A-zone-untrust] add interface GigabitEthernet 1 / 0 / 1 [FW_A-zone-untrust] add interface GigabitEthernet 1 / 0 / 2 [FW_A-zone-untrust] quit [FW_A] firewall zone trust [FW_A-zone-trust] add interface gigabitethernet 1 / 0 / 3 [FW_A-zone-trust] quit 复制代码
-
配置防火墙策略。
- 配置Trust域与Untrust域的转发策略，允许封装前和解封后的报文能通过FW_A。
-
[FW_A] security-policy [FW_A-policy-security] rule name 1 [FW_A-policy-security-rule-1] source-zone trust [FW_A-policy-security-rule-1] destination-zone untrust [FW_A-policy-security-rule-1] source-address 10.1.3.0 24 [FW_A-policy-security-rule-1] destination-address 10.1.2.0 24 [FW_A-policy-security-rule-1] action permit [FW_A-policy-security-rule-1] quit [FW_A-policy-security] rule name 2 [FW_A-policy-security-rule-2] source-zone untrust [FW_A-policy-security-rule-2] destination-zone trust [FW_A-policy-security-rule-2] source-address 10.1.2.0 24 [FW_A-policy-security-rule-2] destination-address 10.1.3.0 24 [FW_A-policy-security-rule-2] action permit [FW_A-policy-security-rule-2] quit 复制代码 - 配置Local域与Untrust域的本地策略，允许IKE协商报文能正常通过FW_A。
-
[FW_A-policy-security] rule name 3 [FW_A-policy-security-rule-3] source-zone local [FW_A-policy-security-rule-3] destination-zone untrust [FW_A-policy-security-rule-3] source-address 1.1.0.0 16 [FW_A-policy-security-rule-3] destination-address 2.2.0.0 16 [FW_A-policy-security-rule-3] action permit [FW_A-policy-security-rule-3] quit [FW_A-policy-security] rule name 4 [FW_A-policy-security-rule-4] source-zone untrust [FW_A-policy-security-rule-4] destination-zone local [FW_A-policy-security-rule-4] source-address 2.2.0.0 16 [FW_A-policy-security-rule-4] destination-address 1.1.0.0 16 [FW_A-policy-security-rule-4] action permit [FW_A-policy-security-rule-4] quit [FW_A-policy-security] quit 复制代码
-
配置IP-Link，用于监控FW_A到FW_B、FW_C的链路是否正常。当监控到有链路故障时，IP-Link将会通过调整路由优先级从而使用另一条正常的链路转发流量。
-
[FW_A] ip-link check enable [FW_A] ip-link 1 destination 2.2.2.1 interface gigabitethernet 1 / 0 / 1 mode icmp next-hop 1.1.1.2 复制代码 -
配置两条缺省路由。假设两个公网接口对应的路由下一跳分别为1.1.1.2和1.1.2.2。
-
[FW_A] ip route- static 0.0.0.0 0.0.0.0 1.1.1.2 preference 10 track ip-link 1 [FW_A] ip route- static 0.0.0.0 0.0.0.0 1.1.2.2 preference 20 复制代码 -
配置访问控制列表，定义需要保护的数据流。 在FW_A中需要配置两个IPSec策略，因为两个IPSec策略不能引用同一个ACL，所以这里需要配置两个编号不同，但是规则相同的ACL。
-
[FW_A] acl 3000 [FW_A-acl-adv-3000] rule permit ip source 10.1.3.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 [FW_A-acl-adv-3000] quit [FW_A] acl 3001 [FW_A-acl-adv-3001] rule permit ip source 10.1.3.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 [FW_A-acl-adv-3001] quit 复制代码 -
配置名称为tran1的IPSec安全提议。
-
[FW_A] ipsec proposal tran1 [FW_A-ipsec-proposal-tran1] encapsulation-mode tunnel [FW_A-ipsec-proposal-tran1] transform esp [FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2- 256 [FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes- 256 [FW_A-ipsec-proposal-tran1] quit 复制代码 -
配置序号为10的IKE安全提议。
-
[FW_A] ike proposal 10 [FW_A-ike-proposal-10] authentication-method pre-share [FW_A-ike-proposal-10] authentication-algorithm sha2- 256 [FW_A-ike-proposal-10] quit 复制代码 -
配置IKE Peer。
-
[FW_A] ike peer b [FW_A-ike-peer-b] ike-proposal 10 [FW_A-ike-peer-b] remote-address 2.2.2.1 [FW_A-ike-peer-b] pre-shared-key Admin @ 123 [FW_A-ike-peer-b] undo version 2 [FW_A-ike-peer-b] quit [FW_A] ike peer c [FW_A-ike-peer-c] ike-proposal 10 [FW_A-ike-peer-c] remote-address 2.2.3.1 [FW_A-ike-peer-c] pre-shared-key Admin @ 123 [FW_A-ike-peer-c] undo version 2 [FW_A-ike-peer-c] quit 复制代码 -
配置IPSec安全策略组map1和map2。
-
[FW_A] ipsec policy map1 10 isakmp [FW_A-ipsec-policy-isakmp-map1-10] security acl 3000 [FW_A-ipsec-policy-isakmp-map1-10] proposal tran1 [FW_A-ipsec-policy-isakmp-map1-10] ike-peer b [FW_A-ipsec-policy-isakmp-map1-10] quit [FW_A] ipsec policy map2 10 isakmp [FW_A-ipsec-policy-isakmp-map2-10] security acl 3001 [FW_A-ipsec-policy-isakmp-map2-10] proposal tran1 [FW_A-ipsec-policy-isakmp-map2-10] ike-peer c [FW_A-ipsec-policy-isakmp-map2-10] quit 复制代码 -
在出接口GE1/0/1和GE1/0/2上分别应用安全策略组map1和map2。
-
[FW_A] interface gigabitethernet 1 / 0 / 1 [FW_A-GigabitEthernet1/0/1] ipsec policy map1 [FW_A-GigabitEthernet1/0/1] quit [FW_A] interface gigabitethernet 1 / 0 / 2 [FW_A-GigabitEthernet1/0/2] ipsec policy map2 [FW_A-GigabitEthernet1/0/2] quit 复制代码
-
-
配置FW_B（总部）。
-
配置上下行业务接口。
- 配置接口IP地址。
-
<sysname> system-view [sysname] sysname FW_B [FW_B] interface GigabitEthernet 1 / 0 / 1 [FW_B-GigabitEthernet1/0/1] ip address 2.2.2.1 24 [FW_B-GigabitEthernet1/0/1] quit [FW_B] interface GigabitEthernet 1 / 0 / 2 [FW_B-GigabitEthernet1/0/2] ip address 10.10.0.1 24 [FW_B-GigabitEthernet1/0/2] quit [FW_B] gigabitethernet 1 / 0 / 3 [FW_B-GigabitEthernet1/0/3] ip address 3.3.3.1 24 [FW_B-GigabitEthernet1/0/3] quit 复制代码 - 将接口加入相应安全区域。
-
[FW_B] firewall zone untrust [FW_B-zone-untrust] add interface gigabitethernet 1 / 0 / 1 [FW_B-zone-untrust] quit [FW_B] firewall zone trust [FW_B-zone-trust] add interface gigabitethernet 1 / 0 / 3 [FW_B-zone-trust] quit [FW_B] firewall zone dmz [FW_B-zone-dmz] add interface gigabitethernet 1 / 0 / 2 [FW_B-zone-dmz] quit 复制代码 - 配置VGMP组监控上下行业务接口。
-
[FW_B] hrp track interface GigabitEthernet 1 / 0 / 1 [FW_B] hrp track interface GigabitEthernet 1 / 0 / 3 复制代码
-
配置FW_B的域间安全策略。
- 配置Trust域与Untrust域的转发策略，允许封装前和解封后的报文能通过FW_B。
-
[FW_B] security-policy [FW_B-policy-security] rule name 1 [FW_B-policy-security-rule-1] source-zone trust [FW_B-policy-security-rule-1] destination-zone untrust [FW_B-policy-security-rule-1] source-address 10.1.2.0 24 [FW_B-policy-security-rule-1] destination-address 10.1.3.0 24 [FW_B-policy-security-rule-1] action permit [FW_B-policy-security-rule-1] quit [FW_B-policy-security] rule name 2 [FW_B-policy-security-rule-2] source-zone untrust [FW_B-policy-security-rule-2] destination-zone trust [FW_B-policy-security-rule-2] source-address 10.1.3.0 24 [FW_B-policy-security-rule-2] destination-address 10.1.2.0 24 [FW_B-policy-security-rule-2] action permit [FW_B-policy-security-rule-2] quit [FW_B-policy-security] rule name 3 [FW_B-policy-security-rule-3] source-zone local dmz [FW_B-policy-security-rule-3] destination-zone local dmz [FW_B-policy-security-rule-3] action permit [FW_B-policy-security-rule-3] quit 复制代码 - 配置Local域与Untrust域的本地策略，允许IKE协商报文能正常通过FW_B。
-
[FW_B-policy-security] rule name 4 [FW_B-policy-security-rule-4] source-zone local [FW_B-policy-security-rule-4] destination-zone untrust [FW_B-policy-security-rule-4] source-address 2.2.0.0 16 [FW_B-policy-security-rule-4] destination-address 1.1.0.0 16 [FW_B-policy-security-rule-4] action permit [FW_B-policy-security-rule-4] quit [FW_B-policy-security] rule name 5 [FW_B-policy-security-rule-5] source-zone untrust [FW_B-policy-security-rule-5] destination-zone local [FW_B-policy-security-rule-5] source-address 1.1.0.0 16 [FW_B-policy-security-rule-5] destination-address 2.2.0.0 16 [FW_B-policy-security-rule-5] action permit [FW_B-policy-security-rule-5] quit 复制代码
-
配置FW_B到分支、总部的私网路由。假设FW_B到总部的私网路由下一跳为3.3.3.2；FW_B到分支的私网路由下一跳为2.2.2.2。
-
[FW_B] ip route- static 10.1.2.0 255.255.255.0 3.3.3.2 [FW_B] ip route- static 10.1.3.0 255.255.255.0 2.2.2.2 复制代码 -
在FW_B上配置运行OSPF动态路由协议。由于上下路由器也需要获知到总部和分支的私网路由，因此这里还需要将FW_B到总部和分支的静态路由导入到OSPF中，由OSPF将这些静态路由发布给上下路由器。
-
[FW_B] ospf 101 [FW_B-ospf-101] import -route static [FW_B-ospf-101] area 0 [FW_B-ospf-101-area-0.0.0.0] network 2.2.2.0 0.0.0.255 [FW_B-ospf-101-area-0.0.0.0] network 3.3.3.0 0.0.0.255 [FW_B-ospf-101-area-0.0.0.0] quit 复制代码 -
配置访问控制列表，定义需要保护的数据流。
-
[FW_B] acl 3000 [FW_B-acl-adv-3000] rule permit ip source 10.1.2.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 [FW_B-acl-adv-3001] quit 复制代码 -
配置名称为tran1的IPSec安全提议。
-
[FW_B] ipsec proposal tran1 [FW_B-ipsec-proposal-tran1] encapsulation-mode tunnel [FW_B-ipsec-proposal-tran1] transform esp [FW_B-ipsec-proposal-tran1] esp authentication-algorithm sha2- 256 [FW_B-ipsec-proposal-tran1] esp encryption-algorithm aes- 256 [FW_B-ipsec-proposal-tran1] quit 复制代码 -
配置序号为10的IKE安全提议。
-
[FW_B] ike proposal 10 [FW_B-ike-proposal-10] authentication-method pre-share [FW_B-ike-proposal-10] authentication-algorithm sha2- 256 [FW_B-ike-proposal-10] quit 复制代码 -
配置IKE Peer。
-
[FW_B] ike peer a [FW_B-ike-peer-a] ike-proposal 10 [FW_B-ike-peer-a] pre-shared-key Admin @ 123 [FW_B-ike-peer-a] undo version 2 复制代码 -
配置名称为map_temp序号为1的IPSec安全策略模板。
-
[FW_B] ipsec policy-template map_temp 1 [FW_B-ipsec-policy-isakmp-map1-1] security acl 3000 [FW_B-ipsec-policy-isakmp-map1-1] proposal tran1 [FW_B-ipsec-policy-isakmp-map1-1] ike-peer a [FW_B-ipsec-policy-isakmp-map1-1] quit 复制代码 -
在IPSec安全策略map1中引用安全策略模板map_temp。
-
[FW_B] ipsec policy map1 10 isakmp template map_temp 复制代码 -
在接口GE1/0/1上应用安全策略map1。
-
[FW_B] interface gigabitethernet 1 / 0 / 1 [FW_B-GigabitEthernet1/0/1] ipsec policy map1 alone [FW_B-GigabitEthernet1/0/1] quit 复制代码 -
开启FW_B的双机配置。
-
[FW_B] hrp interface gigabitethernet 1 / 0 / 2 [FW_B] hrp enable HRP_M[FW_B] hrp load balance device HRP_M[FW_B] hrp mirror session enable HRP_M[FW_B] hrp auto-sync config 复制代码
-
- 配置FW_C（总部）。 请依照FW_B，配置FW_C的接口地址、安全策略和路由数据，并启用FW_C的双机配置。FW_B和FW_C双机启用以后，由于FW_B接口下的IPSec策略配置是不会自动备份到FW_C设备，所以还需要手工在FW_C的GE1/0/1接口下执行ipsec policy map1 alone命令。
- 配置路由器。 在路由器上配置OSPF，具体配置命令请参考路由器的相关文档。
结果验证
- 配置完成后，在FW_B上执行display hrp state命令，检查当前HRP的状态，显示以下信息表示HRP建立成功。
HRP_M[FW_B] display hrp state
Role: active, peer: active
Running priority: 47002, peer: 47002
Core state: normal, peer: normal
Backup channel usage: 0.00%
Stable time: 0 days, 0 hours, 18 minutes
复制代码- 在FW_A上执行display ipsec sa brief命令会显示IPSec安全联盟的建立情况。从下述内容可以看出，FW_A已经分别与FW_B、FW_C成功建立了两条IPSec隧道。
<FW_A> display ipsec sa
Current ipsec sa num:4
Spu board slot 1, cpu 1 ipsec sa information:
Number of SAs:4
Src address Dst address SPI VPN Protocol Algorithm
-------------------------------------------------------------------------------
2.2.2.1 1.1.1.1 4001819557 ESP E:AES-256 A:SHA2-256-128
1.1.1.1 2.2.2.1 3923280450 ESP E:AES-256 A:SHA2-256-128
2.2.3.1 1.1.1.1 4249128694 ESP E:AES-256 A:SHA2-256-128
1.1.1.1 2.2.3.1 787858613 ESP E:AES-256 A:SHA2-256-128
复制代码- 使用分支的PC访问总部资源，访问成功。然后Down掉FW_B设备，观察分支用户是否能成功访问总部资源。如果分支依然可以成功访问总部资源，则说明此时用户流量已经成功切换至FW_C设备，说明配置OK。如果访问失败，请根据本例检查配置是否正确。