【eNSP】防火墙双机热备（一次简易的、入门级的配置案例）_ensp 防火墙双活

实验拓扑
基础配置：
接口IP地址
FW1

[FW1]interface GigabitEthernet 1/0/1 //进入接口视图
[FW1-GigabitEthernet1/0/1]ip address 1.1.1.10  255.255.255.0
[FW1]interface GigabitEthernet 1/0/2
[FW1-GigabitEthernet1/0/2]ip address 10.3.0.10 255.255.255.0
[FW1]interface GigabitEthernet 1/0/6
[FW1-GigabitEthernet1/0/6]ip address 10.10.0.1 255.255.255.0
1
2
3
4
5
6

FW2

[FW1]interface GigabitEthernet 1/0/1 //进入接口视图
[FW1-GigabitEthernet1/0/1]ip address 1.1.1.20 255.255.255.0
[FW1]interface GigabitEthernet 1/0/2
[FW1-GigabitEthernet1/0/2]ip address 10.3.0.20 255.255.255.0
[FW1]interface GigabitEthernet 1/0/6
[FW1-GigabitEthernet1/0/6]ip address 10.10.0.2 255.255.255.0
1
2
3
4
5
6

静态默认路由
FW1和FW2

ip route-static 0.0.0.0 0 GigabitEthernet 1/0/1 1.1.1.2
1

安全区域
FW1和FW2

[FW1]firewall zone trust
[FW1]add interface GigabitEthernet1/0/2

[FW1]firewall zone untrust
[FW1] add interface GigabitEthernet1/0/1

[FW1]firewall zone name dmz1
[FW1]set priority 55
[FW1] add interface GigabitEthernet1/0/6
1
2
3
4
5
6
7
8
9

配置VRRP
FW1

[FW1]interface GigabitEthernet1/0/1
[FW1-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 1.1.1.1 active//配置vrid、vip，并设置为主设备
[FW1-GigabitEthernet1/0/1]vrrp virtual-mac enable

[FW1]interface GigabitEthernet1/0/2
[FW1-GigabitEthernet1/0/2] vrrp vrid 1 virtual-ip 10.3.0.3 active
[FW1-GigabitEthernet1/0/2]vrrp virtual-mac enable
1
2
3
4
5
6
7

FW2

[FW1]interface GigabitEthernet1/0/1
[FW1-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 1.1.1.1 standby
[FW1-GigabitEthernet1/0/1]vrrp virtual-mac enable
1
2
3

[FW1]interface GigabitEthernet1/0/2
[FW1-GigabitEthernet1/0/1vrrp vrid 1 virtual-ip 10.3.0.3 standby
[FW1-GigabitEthernet1/0/1vrrp virtual-mac enable
1
2
3

配置同步线、开启hrrp

[FW1]hrp interface GigabitEthernet1/0/6 remote 10.10.0.2
[FW1]hrrp enable
1
2

[FW2]hrp interface GigabitEthernet1/0/6 remote 10.10.0.1
[FW2]hrrp enable
1
2

配置安全策略(+B)

security-policy
 rule name trust_untrust
  source-zone trust
  destination-zone untrust
  source-address 10.3.0.0 mask 255.255.255.0
  action permit
1
2
3
4
5
6

配置nat策略(+B)

nat-policy
 rule name easy_ip
  source-zone trust
  destination-zone untrust
  source-address 10.3.0.0 mask 255.255.255.0
  action source-nat easy-ip
1
2
3
4
5
6

验证结果；
PC1配置

Client1配置

Server配置

结果