USG双机热备vrrp+hrp配置（上接二层，下接三层的交叉组网模式）

1.配置各接口IP以及vrrp，并加入相应的zone

(写vrid的时候一定要加入掩码比如/24，否则不允许不同网段的vrid存在)

2.给配置vrrp的接口下面启用vrrpvirtual-mac enable

这样vrid才可以ping到，尤其是在ensp中

3.isp1的vrrp为master，而isp2的vrrp为slave

4.暂时打开防火墙的所有通路

firewallpacket-filter default permit all

5.配置域间路由

6.开启双击热备hrpenable

 

(如果已经开启了hrp又想在备墙上面做配置，可以通过开启配置来进行，

即：HRP_S[FW2]hrpslave config enable)

要添加的静态路由：
HRP_M[FW1]ip route-static 192.168.10.0 24 10.1.14.254
HRP_S[FW2]ip route-static 192.168.10.0 24 10.1.14.254
[S1]ip route-static 1.1.1.0 24 10.1.14.100
[S2]ip route-static 10.1.14.0 24 192.168.10.254
[isp1]ip route-static 10.1.18.0 255.255.255.0 1.1.1.1
[isp1]ip route-static 192.168.10.0 24 1.1.1.1
[isp2]ip route-static 10.1.18.0 255.255.255.0 2.2.2.2
[isp2]ip route-static 192.168.10.0 24 2.2.2.2

[FW1]interface GigabitEthernet 0/0/1
[FW1-GigabitEthernet0/0/1]ip address 10.1.11.1 24
[FW1-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 1.1.1.1 24 master
[FW1-GigabitEthernet0/0/1]vrrp virtual-mac enable
因为是在模拟器中，所以要开启MAC，否则会访问不了虚拟的网关地址。
[FW1-GigabitEthernet0/0/1]quit
[FW1]interface GigabitEthernet 0/0/2
[FW1-GigabitEthernet0/0/2]ip address 10.1.12.1 24
[FW1-GigabitEthernet0/0/2]vrrp vrid 2 virtual-ip 2.2.2.2 24 master
[FW1-GigabitEthernet0/0/2]vrrp virtual-mac enable
[FW1-GigabitEthernet0/0/2]quit
[FW1]interface GigabitEthernet 0/0/3
[FW1-GigabitEthernet0/0/3]ip address 10.1.13.1 24
[FW1-GigabitEthernet0/0/3]quit
[FW1]interface GigabitEthernet 0/0/4
[FW1-GigabitEthernet0/0/8]ip address 10.1.14.1 24
[FW1-GigabitEthernet0/0/8]vrrp vrid 3 virtual-ip 10.1.14.100 24 master
[FW1-GigabitEthernet0/0/8]vrrp virtual-mac enable
[FW1-GigabitEthernet0/0/8]quit
[FW1]firewall zone name isp1
[FW1-zone-isp1]set priority 20
[FW1-zone-isp1]add interface GigabitEthernet 0/0/1
[FW1-zone-isp1]quit
[FW1]firewall zone name isp2
[FW1-zone-isp2]set priority 15
[FW1-zone-isp2]add interface GigabitEthernet 0/0/2
[FW1-zone-isp2]quit
[FW1]firewall zone dmz
[FW1-zone-dmz]add interface GigabitEthernet 0/0/3
[FW1-zone-dmz]quit
[FW1]firewall zone trust
[FW1-zone-trust]add interface GigabitEthernet 0/0/4
[FW1-zone-trust]quit
[FW1]ip-link check enable
[FW1]ip-link 1 destination 1.1.1.10 mode icmp
[FW1]ip-link 2 destination 2.2.2.10 mode icmp
[FW1]hrp track ip-link 1 master
[FW1]hrp track ip-link 2 master
[FW1]firewall packet-filter default permit all
[FW1]hrp interface GigabitEthernet 0/0/3
[FW1]hrp preempt delay 10   #配置10秒后抢占
[FW1]hrp enable

HRP_M[FW1]ip route-static 192.168.10.0 24 10.1.14.254
HRP_M[FW1]ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/1 1.1.1.10 track ip-link 1
HRP_M[FW1]ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/2 2.2.2.10 preference 80
通过静态路由的preference值确定主备路由，路由的preference值越大优先级越低，preference值缺省为60

[FW2]interface GigabitEthernet 0/0/1
[FW2-GigabitEthernet0/0/1]ip address 10.1.11.2 24
[FW2-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 1.1.1.1 24 slave
[FW2-GigabitEthernet0/0/1]vrrp virtual-mac enable
[FW2-GigabitEthernet0/0/1]quit
[FW2]interface GigabitEthernet 0/0/2
[FW2-GigabitEthernet0/0/2]ip address 10.1.12.2 24
[FW2-GigabitEthernet0/0/2]vrrp vrid 2 virtual-ip 2.2.2.2 24 slave
[FW2-GigabitEthernet0/0/2]vrrp virtual-mac enable
[FW2-GigabitEthernet0/0/2]quit
[FW2]interface GigabitEthernet 0/0/3
[FW2-GigabitEthernet0/0/3]ip address 10.1.13.2 24
[FW2-GigabitEthernet0/0/3]quit
[FW2]interface GigabitEthernet 0/0/4
[FW2-GigabitEthernet0/0/8]ip address 10.1.14.2 24
[FW2-GigabitEthernet0/0/8]vrrp vrid 3 virtual-ip 10.1.14.100 24 slave
[FW2-GigabitEthernet0/0/8]vrrp virtual-mac enable
[FW2-GigabitEthernet0/0/8]quit
[FW2]firewall zone name isp1
[FW2-zone-isp1]set priority 20
[FW2-zone-isp1]add interface GigabitEthernet 0/0/1
[FW2]firewall zone name isp2
[FW2-zone-isp2]set priority 15
[FW2-zone-isp2]add interface GigabitEthernet 0/0/2
[FW2-zone-isp2]quit
[FW2]firewall zone dmz
[FW2-zone-dmz]add interface GigabitEthernet 0/0/3
[FW2-zone-dmz]quit
[FW2]firewall zone trust
[FW2-zone-trust]add interface GigabitEthernet 0/0/4
[FW2-zone-trust]quit
[FW2]ip-link check enable
[FW2]ip-link 1 destination 1.1.1.10 mode icmp
[FW2]ip-link 2 destination 2.2.2.10 mode icmp
[FW2]hrp track ip-link 1 slave
[FW2]hrp track ip-link 2 slave
[FW2]firewall packet-filter default permit all
[FW2]hrp interface GigabitEthernet 0/0/3
[FW2]hrp enable
HRP_S[FW2]ip route-static 192.168.10.0 24 10.1.14.254
HRP_S[FW2]ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/1 1.1.1.10 track ip-link 1
HRP_S[FW2]ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/0/2 2.2.2.10 preference 80

[isp1]interface Ethernet 0/0/0    
[isp1-Ethernet0/0/0]ip address 1.1.1.10 24
[isp1-Ethernet0/0/0]quit    
[isp1]ip route-static 10.1.18.0 255.255.255.0 1.1.1.1
[isp1]ip route-static 192.168.10.0 24 1.1.1.1
[isp2]interface Ethernet 0/0/0
[isp2-Ethernet0/0/0]ip address 2.2.2.10 24
[isp2-Ethernet0/0/0]quit
[isp2]ip route-static 10.1.18.0 255.255.255.0 2.2.2.2
[isp2]ip route-static 192.168.10.0 24 2.2.2.2

[S1]vlan batch 2 3
[S1]interface vlan 1
[S1-vlan2]ip address 10.1.14.254 24
[S1]interface vlan 2
[S1-vlan2]ip address 192.168.10.254 24
[S1]interface Eth-Trunk 1
[S1-Eth-Trunk1]port link-type trunk     
[S1-Eth-Trunk1]port trunk allow-pass vlan all
[S1-Eth-Trunk1]mode manual load-balance
[S1-Eth-Trunk1]trunkport GigabitEthernet 0/0/3
[S1-Eth-Trunk1]trunkport GigabitEthernet 0/0/4

[S1]interface Eth-Trunk 2
[S1-Eth-Trunk2]port link-type trunk     
[S1-Eth-Trunk2]port trunk allow-pass vlan all
[S1-Eth-Trunk2]mode manual load-balance
[S1-Eth-Trunk2]trunkport GigabitEthernet 0/0/5
[S1-Eth-Trunk2]trunkport GigabitEthernet 0/0/6
[S1]ip route-static 1.1.1.0 255.255.255.0 10.1.14.100

[S1]ip route-static 2.2.2.0 255.255.255.0 10.1.14.100

[S2]vlan 2
[S2]interface Ethernet 0/0/1
[S2]port link-type access
[S2]port default vlan 2
[S2]interface Eth-trunk 2
[S2]port link-type trunk
[S2-Eth-Trunk2]port trunk allow-pass vlan all
[S2-Eth-Trunk2]mode manual load-balance
[S2-Eth-Trunk2]trunkport GigabitEthernet 0/0/1
[S2-Eth-Trunk2]trunkport GigabitEthernet 0/0/2
[S2]ip route-static 10.1.14.0 24 192.168.10.254

[S3]interface Eth-trunk 1
[S3]port link-type trunk
[S3-Eth-Trunk1]port trunk allow-pass vlan all
[S3-Eth-Trunk1]mode manual load-balance
[S3-Eth-Trunk1]trunkport GigabitEthernet 0/0/1
[S3-Eth-Trunk1]trunkport GigabitEthernet 0/0/2

PC(192.168.10.10/24):

Pc的IP地址为192.168.10.10 255.255.255.0 192.168.10.254

网关一定要为三层vlan的IP地址来作为PC的网关。

1.不使用3个公网地址也可以实现，不过得将两个物理口和虚拟出来的vrrp地址放在同一网段。

2.使ISP的一端用路由器代替即可，路由的wan口为公网地址，lan口为跟虚拟地址在同一网段的私网地址：

例如：

3.之所以要配置10.1.6.254和10.1.6.100的两个地址是因为R1下来的回程路由需要由10.1.6.100来作为网关，而10.1.6.254却是作为到公网的网关（如果直接将10.1.6.100的虚拟地址作为路由的lan口地址，则不能进行正常转发。）