目标

介绍负载分担双机热备组网，上下行连接路由器时如何配置IPSec VPN。

组网需求

如所示，公司总部、分支均通过FW接入Internet。总部的FW_C和FW_D以负载分担方式工作，其业务接口都工作在三层，并与上下行路由器之间运行OSPF协议。企业期望分支用户访问总部的流量受IPSec隧道保护，且FW_C处理FW_A发送到总部的流量，FW_D处理FW_B发送到总部的流量。当FW_C或FW_D中一台设备出现故障时，分支发往总部的流量全部切换到另一台运行正常的设备。

配置思路

1. 配置FW_C和FW_D以负载分担方式工作。

1. 在FW_C上创建Tunnel和Tunnel2两个接口，在FW_D上也创建Tunnel和Tunnel2两个接口。两台设备上创建的Tunnel1接口IP地址相同，Tunnel2接口的IP地址相同。其中FW_C上创建的Tunnel1是主接口，用于和FW_A创建主IPSec隧道；FW_D上创建的Tunnel1接口为备接口，用于和FW_A创建备IPSec隧道。同理，FW_D上的Tunnel2接口用于和FW_B建立主IPSec隧道，FW_C上的Tunnel2接口用于和FW_B建立备IPSec隧道。由此，FW_A、FW_B将各有两条IPSec隧道与双机（FW_C和FW_D）相连。双机运行正常时，FW_A、FW_B各自使用主IPSec隧道将流量发往总部。当双机运行异常时，则FW_A或FW_B将会启用备IPSec隧道将流量发往总部。

1. 在FW_C和FW_D上配置路由策略，通过设备状态的变化，改变路由优先级。当双机运行状态正常时，其状态为负载分担状态load-balance，总部返回给FW_A的流量被引到FW_C上处理，总部返回给FW_B的流量被引流到FW_D上处理。假如，双机中FW_C设备出现故障，于是FW_C的设备状态变为Standby，FW_D设备的状态变为Active，总部返回给FW_A和FW_B的流量将全部被引流到FW_D。

1. 在FW_A和FW_B接入Internet的公网接口上应用IPSec策略，分别与FW_C和FW_D建立IPSec隧道。

操作步骤

1. 配置FW_C（总部）的接口IP地址。 配置GE1/0/1接口IP地址，将接口加入Untrust域。 <sysname> system-view [sysname] sysname FW_C [FW_C] interface gigabitethernet 1 / 0 / 1 [FW_C-GigabitEthernet1/0/1] ip address 2.2.2.1 24 [FW_C-GigabitEthernet1/0/1] quit [FW_C] firewall zone untrust [FW_C-zone-untrust] add interface gigabitethernet 1 / 0 / 1 [FW_C-zone-untrust] quit 复制代码 配置GE1/0/2的接口IP地址，并将接口加入相应的安全区域。 [FW_C] interface gigabitethernet 1 / 0 / 2 [FW_C-GigabitEthernet1/0/2] ip address 10.10.0.1 24 [FW_C-GigabitEthernet1/0/2] quit [FW_C] firewall zone dmz [FW_C-zone-dmz] add interface gigabitethernet 1 / 0 / 2 [FW_C-zone-dmz] quit 复制代码 配置GE1/0/3接口IP地址，将接口加入Trust域。 [FW_C] gigabitethernet 1 / 0 / 3 [FW_C-GigabitEthernet1/0/3] ip address 10.3.3.1 24 [FW_C-GigabitEthernet1/0/3] quit [FW_C] firewall zone trust [FW_C-zone-trust] add interface gigabitethernet 1 / 0 / 3 [FW_C-zone-trust] quit 复制代码 配置VGMP组监控上下行业务接口。 [FW_C] hrp track interface GigabitEthernet 1 / 0 / 1 [FW_C] hrp track interface GigabitEthernet 1 / 0 / 3 复制代码 在配置FW_C上配置Tunnel1和Tunnel2两个接口。 [FW_C] interface tunnel 1 [FW_C_Tunnel1] tunnel-protocol ipsec [FW_C_Tunnel1] ip address 2.2.4.1 24 [FW_C_Tunnel1] quit [FW_C] interface tunnel 2 [FW_C_Tunnel2] tunnel-protocol ipsec [FW_C_Tunnel2] ip address 2.2.5.1 24 [FW_C_Tunnel2] quit [FW_C] firewall zone untrust [FW_C-zone-untrust] add interface Tunnel 1 [FW_C-zone-untrust] add interface Tunnel 2 [FW_C-zone-untrust] quit 复制代码

1. 在FW_C（总部）上配置域间安全策略。 配置Trust区域和Untrust区域的域间安全策略。 [FW_C] security-policy [FW_C-policy-security] rule name 1 [FW_C-policy-security-rule-1] source-zone untrust [FW_C-policy-security-rule-1] destination-zone trust [FW_C-policy-security-rule-1] source-address 10.1.3.0 24 [FW_C-policy-security-rule-1] source-address 10.1.4.0 24 [FW_C-policy-security-rule-1] destination-address 10.1.2.0 24 [FW_C-policy-security-rule-1] action permit [FW_C-policy-security-rule-1] quit [FW_C-policy-security] rule name 2 [FW_C-policy-security-rule-2] source-zone trust [FW_C-policy-security-rule-2] destination-zone untrust [FW_C-policy-security-rule-2] source-address 10.1.2.0 24 [FW_C-policy-security-rule-2] destination-address 10.1.3.0 24 [FW_C-policy-security-rule-2] destination-address 10.1.4.0 24 [FW_C-policy-security-rule-2] action permit [FW_C-policy-security-rule-2] quit [FW_C-policy-security] rule name 3 [FW_C-policy-security-rule-3] source-zone local dmz [FW_C-policy-security-rule-3] destination-zone local dmz [FW_C-policy-security-rule-3] action permit [FW_C-policy-security-rule-3] quit 复制代码 配置Local域与Untrust域的本地策略，允许IKE协商报文能正常通过FW_C。 [FW_C-policy-security] rule name 4 [FW_C-policy-security-rule-4] source-zone local [FW_C-policy-security-rule-4] destination-zone untrust [FW_C-policy-security-rule-4] source-address 2.2.0.0 16 [FW_C-policy-security-rule-4] destination-address 1.1.0.0 16 [FW_C-policy-security-rule-4] action permit [FW_C-policy-security-rule-4] quit [FW_C-policy-security] rule name 5 [FW_C-policy-security-rule-5] source-zone untrust [FW_C-policy-security-rule-5] destination-zone local [FW_C-policy-security-rule-5] source-address 1.1.0.0 16 [FW_C-policy-security-rule-5] destination-address 2.2.0.0 16 [FW_C-policy-security-rule-5] action permit [FW_C-policy-security-rule-5] quit 复制代码

1. 在FW_C（总部）上配置到FW_A（分支）和FW_B（分支）的静态路由。

[FW_C] ip route- static  10.1.3.0  24 tunnel 1
[FW_C] ip route- static  10.1.4.0  24 tunnel 2
复制代码

1. 在FW_C（总部）上配置运行OSPF动态路由协议。

为了使FW_A发给总部的流量沿FW_A<->Router1<->FW_C<->Router2路径传递；FW_B发给总部的流量沿FW_B<->Router1<->FW_D<->Router2路径传递，则需要在FW_C和FW_D上配置路由策略，从而控制Router1和Router2的路由信息。

根据需求，当FW_C工作在负载分担状态时，Router1要将FW_A的流量发送给FW_C的Tunnel1接口，而不是FW_D的Tunnel1接口。于是FW_C在发布到Tunnel1的路由时，需要将开销值减10；FW_D在发布到Tunnel1的路由时，需要将开销值加10，这样Router1将会根据路由开销，选择将FW_A的流量发送到FW_C。

同时，Router2要将FW_A的反向流量发送给FW_C，而不是FW_D。于是FW_C在发布到FW_A的私网路由（静态路由）时，需要将此路由的开销值减10；FW_D在发布到FW_A的私网路由（静态路由）的路由时，需要将开销值加10，这样Router2将根据路由开销，选择将FW_A的反向流量发送到FW_C。

当FW_D发生故障，FW_C工作在active状态时，FW_C将对外发布的直连路由和静态路由统一减10，FW_D将对外发布的直连路由和静态路由统一加10，这样FW_A和FW_B将全部发送至FW_C处理。

当FW_C发生故障，设备工作在standby状态时，FW_C将对外发布的直连路由和静态路由统一加10，FW_D将对外发布的直连路由和静态路由统一减10，这样FW_A和FW_B将全部发送至FW_D处理。

[FW_C] ospf 1
[FW_C-ospf-1] import -route direct route-policy rp
[FW_C-ospf-1] import -route static route-policy rp
[FW_C-ospf-1] area 0.0.0.0
[FW_C-ospf-1-area-0.0.0.0] network 10.3.3.0  0.0.0.255
[FW_C-ospf-1-area-0.0.0.0] network 2.2.2.0  0.0.0.255
[FW_C-ospf-1-area-0.0.0.0] quit
[FW_C-ospf-1] quit
[FW_C] route-policy rp permit node 1
[FW_C-route-policy] if -match acl 2000
[FW_C-route-policy] if -match backup-status load-balance
[FW_C-route-policy] apply cost - 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 2
[FW_C-route-policy] if -match acl 2001
[FW_C-route-policy] if -match backup-status load-balance
[FW_C-route-policy] apply cost + 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 3
[FW_C-route-policy] if -match acl 2002
[FW_C-route-policy] if -match backup-status active
[FW_C-route-policy] apply cost - 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 4
[FW_C-route-policy] if -match acl 2002
[FW_C-route-policy] if -match backup-status standby
[FW_C-route-policy] apply cost + 10
[FW_C-route-policy] quit
[FW_C] acl 2000
[FW_C-acl-basic-2000] rule permit source 2.2.4.0  0.0.0.255
[FW_C-acl-basic-2000] rule permit source 10.1.3.0  0.0.0.255
[FW_C-acl-basic-2000] quit
[FW_C] acl 2001
[FW_C-acl-basic-2001] rule permit source 2.2.5.0  0.0.0.255
[FW_C-acl-basic-2001] rule permit source 10.1.4.0  0.0.0.255
[FW_C-acl-basic-2001] quit
[FW_C] acl 2002
[FW_C-acl-basic-2002] rule permit source 2.2.4.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 10.1.3.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 2.2.5.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 10.1.4.0  0.0.0.255
[FW_C-acl-basic-2002] quit
复制代码

1. 在FW_C（总部）配置IPSec。 定义到FW_A、FW_B的数据流。 [FW_C] acl 3005 [FW_C-acl-adv-3005] rule permit ip source 10.1.2.0 0.0.0.255 destination 10.1.3.0 0.0.0.255 [FW_C-acl-adv-3005] quit [FW_C] acl 3006 [FW_C-acl-adv-3006] rule permit ip source 10.1.2.0 0.0.0.255 destination 10.1.4.0 0.0.0.255 [FW_C-acl-adv-3006] quit 复制代码 配置IPSec安全提议。 [FW_C] ipsec proposal tran1 [FW_C-ipsec-proposal-tran1] encapsulation-mode tunnel [FW_C-ipsec-proposal-tran1] transform esp [FW_C-ipsec-proposal-tran1] esp authentication-algorithm sha2- 256 [FW_C-ipsec-proposal-tran1] esp encryption-algorithm aes- 256 [FW_C-ipsec-proposal-tran1] quit 复制代码 配置IKE安全提议。 [FW_C] ike proposal 10 [FW_C-ike-proposal-10] authentication-method pre-share [FW_C-ike-proposal-10] authentication-algorithm sha2- 256 [FW_C-ike-proposal-10] quit 复制代码 配置IKE Peer。 [FW_C] ike peer ngfw_a [FW_C-ike-peer-b] ike-proposal 10 [FW_C-ike-peer-b] remote-address 1.1.1.1 [FW_C-ike-peer-b] pre-shared-key Admin @ 123 [FW_C-ike-peer-b] undo version 2 [FW_C-ike-peer-b] quit [FW_C] ike peer ngfw_b [FW_C-ike-peer-c] ike-proposal 10 [FW_C-ike-peer-c] remote-address 1.1.2.1 [FW_C-ike-peer-c] pre-shared-key Admin @ 123 [FW_C-ike-peer-c] undo version 2 [FW_C-ike-peer-c] quit 复制代码 配置两个非模板方式IPSec策略。 [FW_C] ipsec policy map1 10 isakmp [FW_C-ipsec-policy-isakmp-map1-10] security acl 3005 [FW_C-ipsec-policy-isakmp-map1-10] proposal tran1 [FW_C-ipsec-policy-isakmp-map1-10] ike-peer ngfw_a [FW_C-ipsec-policy-isakmp-map1-10] quit [FW_C] ipsec policy map2 10 isakmp [FW_C-ipsec-policy-isakmp-map2-10] security acl 3006 [FW_C-ipsec-policy-isakmp-map2-10] proposal tran1 [FW_C-ipsec-policy-isakmp-map2-10] ike-peer ngfw_b [FW_C-ipsec-policy-isakmp-map2-10] quit 复制代码 在Tunnel接口上应用IPSec策略。 [FW_C] interface Tunnel 1 [FW_C-Tunnel1] ipsec policy map1 master [FW_C-Tunnel1] quit [FW_C] interface Tunnel 2 [FW_C-Tunnel2] ipsec policy map2 slave [FW_C-Tunnel2] quit 复制代码

1. 开启FW_C（总部）的双机配置。

[FW_C] hrp interface gigabitethernet 1 / 0 / 2
[FW_C] hrp enable
HRP_M[FW_C] hrp load balance device
HRP_M[FW_C] hrp auto-sync config
HRP_M[FW_C] hrp mirror session enable
复制代码

1. 配置FW_D（总部）。 FW_D开启双机配置以后，FW_C上配置的ACL、安全策略和IPSec业务都会自动备份到FW_D上。只有接口配置和路由信息不会备份过来，因此需要手工在FW_D上配置。 配置FW_D的接口IP地址，并将接口加入安全区域。具体配置过程请参见FW_C。 配置FW_D的路由数据。 [FW_D] ip route- static 10.1.3.0 24 tunnel 1 [FW_D] ip route- static 10.1.4.0 24 tunnel 2 [FW_D] ospf 1 [FW_D-ospf-1] import -route direct route-policy rp [FW_D-ospf-1] import -route static route-policy rp [FW_D-ospf-1] area 0.0.0.0 [FW_D-ospf-1-area-0.0.0.0] network 10.3.4.0 0.0.0.255 [FW_D-ospf-1-area-0.0.0.0] network 2.2.3.0 0.0.0.255 [FW_D-ospf-1-area-0.0.0.0] quit [FW_D-ospf-1] quit [FW_D] route-policy rp permit node 1 [FW_D-route-policy] if -match acl 2000 [FW_D-route-policy] if -match backup-status load-balance [FW_D-route-policy] apply cost + 10 [FW_D-route-policy] quit [FW_D] route-policy rp permit node 2 [FW_D-route-policy] if -match acl 2001 [FW_D-route-policy] if -match backup-status load-balance [FW_D-route-policy] apply cost - 10 [FW_D-route-policy] quit [FW_D] route-policy rp permit node 3 [FW_D-route-policy] if -match acl 2002 [FW_D-route-policy] if -match backup-status active [FW_D-route-policy] apply cost - 10 [FW_D-route-policy] quit [FW_D] route-policy rp permit node 4 [FW_D-route-policy] if -match acl 2002 [FW_D-route-policy] if -match backup-status standby [FW_D-route-policy] apply cost + 10 [FW_D-route-policy] quit 复制代码 在Tunnel接口上应用IPSec策略。 [FW_D] interface Tunnel 1 [FW_D-Tunnel1] ipsec policy map1 master [FW_D-Tunnel1] quit [FW_D] interface Tunnel 2 [FW_D-Tunnel2] ipsec policy map2 slave [FW_D-Tunnel2] quit 复制代码

1. 开启FW_D（总部）的双机配置。

[FW_D] hrp enable
HRP_S[FW_D] hrp load balance device
HRP_S[FW_D] hrp auto-sync config
HRP_S[FW_D] hrp mirror session enable
复制代码

1. 配置FW_B（分支）。 FW_B与FW_A的配置方法相同，请参考FW_A配置FW_B。

结果验证

1. 配置完成后，在FW_C上执行display hrp state命令，检查当前HRP的状态，显示以下信息表示HRP建立成功。

[FW_C] display hrp state
 Role: active, peer: active                                                    
 Running priority: 47002, peer: 47002                                         
 Core state: normal, peer: normal                                    
 Backup channel usage: 0.00%                                                    
 Stable time: 0 days, 0 hours, 18 minutes
复制代码

1. 分别在FW_A、FW_B上执行display ipsec sa命令会显示IPSec安全联盟的建立情况。以FW_A为例，出现以下显示说明IPSec安全联盟建立成功。

<FW_A> display ipsec sa brief
Current ipsec sa num:2

Spu board slot 1, cpu 1 ipsec sa information:                                   
Number of SAs:2                                                              
    Src address   Dst address      SPI        VPN  Protocol     Algorithm       
------------------------------------------------------------------------------- 
    2.2.4.1         1.1.1.1       4001819557        ESP      E:AES-256 A:SHA2-256-128
    1.1.2.1         2.2.4.1       3923280450        ESP      E:AES-256 A:SHA2-256-128
复制代码

1. 验证双机切换，业务是否正常。 在FW_A和FW_B运行在正常状态时，分别使用FW_A和FW_B下的用户PC访问总部资源，访问成功则表明配置OK。 DOWN掉FW_C设备，然后观察两个分支是否依然能够正常访问总部资源，如果访问成功，表示流量可以正常从FW_C切换至FW_D设备。 恢复FW_C设备，然后再DOWN掉FW_D设备，观察两个分支是否依然能够正常访问总部资源，如果访问成功，表示流量可以正常从FW_D切换至FW_C设备。 如果在上述3个场景下，两个分支均能够正常访问总部资源，则表明该业务场景配置OK。