玩转华为ENSP模拟器系列 | IPSec网关负载分担双机热备,上下行连接路由器

Posted COCOgsta

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了玩转华为ENSP模拟器系列 | IPSec网关负载分担双机热备,上下行连接路由器相关的知识,希望对你有一定的参考价值。

素材来源:华为防火墙配置指南

一边学习一边整理试验笔记,并与大家分享,侵权即删,谢谢支持!

附上汇总贴:玩转华为ENSP模拟器系列 | 合集_COCOgsta的博客-CSDN博客_华为模拟器实验


目标

介绍负载分担双机热备组网,上下行连接路由器时如何配置IPSec VPN。

组网需求

图1所示,公司总部、分支均通过FW接入Internet。总部的FW_C和FW_D以负载分担方式工作,其业务接口都工作在三层,并与上下行路由器之间运行OSPF协议。企业期望分支用户访问总部的流量受IPSec隧道保护,且FW_C处理FW_A发送到总部的流量,FW_D处理FW_B发送到总部的流量。当FW_C或FW_D中一台设备出现故障时,分支发往总部的流量全部切换到另一台运行正常的设备。

配置思路

  1. 配置FW_C和FW_D以负载分担方式工作。
  1. 在FW_C上创建Tunnel和Tunnel2两个接口,在FW_D上也创建Tunnel和Tunnel2两个接口。两台设备上创建的Tunnel1接口IP地址相同,Tunnel2接口的IP地址相同。其中FW_C上创建的Tunnel1是主接口,用于和FW_A创建主IPSec隧道;FW_D上创建的Tunnel1接口为备接口,用于和FW_A创建备IPSec隧道。同理,FW_D上的Tunnel2接口用于和FW_B建立主IPSec隧道,FW_C上的Tunnel2接口用于和FW_B建立备IPSec隧道。由此,FW_A、FW_B将各有两条IPSec隧道与双机(FW_C和FW_D)相连。双机运行正常时,FW_A、FW_B各自使用主IPSec隧道将流量发往总部。当双机运行异常时,则FW_A或FW_B将会启用备IPSec隧道将流量发往总部。
  1. 在FW_C和FW_D上配置路由策略,通过设备状态的变化,改变路由优先级。当双机运行状态正常时,其状态为负载分担状态load-balance,总部返回给FW_A的流量被引到FW_C上处理,总部返回给FW_B的流量被引流到FW_D上处理。假如,双机中FW_C设备出现故障,于是FW_C的设备状态变为Standby,FW_D设备的状态变为Active,总部返回给FW_A和FW_B的流量将全部被引流到FW_D。
  1. 在FW_A和FW_B接入Internet的公网接口上应用IPSec策略,分别与FW_C和FW_D建立IPSec隧道。

操作步骤

  1. 配置FW_C(总部)的接口IP地址。

    1. 配置GE1/0/1接口IP地址,将接口加入Untrust域。
    2. <sysname> system-view
      [sysname] sysname FW_C
      [FW_C] interface gigabitethernet 1 / 0 / 1
      [FW_C-GigabitEthernet1/0/1] ip address 2.2.2.1  24
      [FW_C-GigabitEthernet1/0/1] quit
      [FW_C] firewall zone untrust
      [FW_C-zone-untrust] add interface gigabitethernet 1 / 0 / 1
      [FW_C-zone-untrust] quit
      复制代码
    3. 配置GE1/0/2的接口IP地址,并将接口加入相应的安全区域。
    4. [FW_C] interface gigabitethernet 1 / 0 / 2
      [FW_C-GigabitEthernet1/0/2] ip address 10.10.0.1  24
      [FW_C-GigabitEthernet1/0/2] quit
      [FW_C] firewall zone dmz
      [FW_C-zone-dmz] add interface gigabitethernet 1 / 0 / 2
      [FW_C-zone-dmz] quit
      复制代码
    5. 配置GE1/0/3接口IP地址,将接口加入Trust域。
    6. [FW_C] gigabitethernet 1 / 0 / 3
      [FW_C-GigabitEthernet1/0/3] ip address 10.3.3.1  24
      [FW_C-GigabitEthernet1/0/3] quit
      [FW_C] firewall zone trust
      [FW_C-zone-trust] add interface gigabitethernet 1 / 0 / 3
      [FW_C-zone-trust] quit
      复制代码
    7. 配置VGMP组监控上下行业务接口。
    8. [FW_C] hrp track interface GigabitEthernet  1 / 0 / 1
      [FW_C] hrp track interface GigabitEthernet  1 / 0 / 3
      复制代码
    9. 在配置FW_C上配置Tunnel1和Tunnel2两个接口。
    10. [FW_C] interface tunnel 1
      [FW_C_Tunnel1] tunnel-protocol ipsec
      [FW_C_Tunnel1] ip address 2.2.4.1  24
      [FW_C_Tunnel1] quit
      [FW_C] interface tunnel 2
      [FW_C_Tunnel2] tunnel-protocol ipsec
      [FW_C_Tunnel2] ip address 2.2.5.1  24
      [FW_C_Tunnel2] quit
      [FW_C] firewall zone untrust
      [FW_C-zone-untrust] add interface Tunnel  1
      [FW_C-zone-untrust] add interface Tunnel  2
      [FW_C-zone-untrust] quit
      复制代码
  1. 在FW_C(总部)上配置域间安全策略。

    1. 配置Trust区域和Untrust区域的域间安全策略。
    2. [FW_C] security-policy
      [FW_C-policy-security] rule name 1
      [FW_C-policy-security-rule-1] source-zone untrust
      [FW_C-policy-security-rule-1] destination-zone trust
      [FW_C-policy-security-rule-1] source-address 10.1.3.0  24
      [FW_C-policy-security-rule-1] source-address 10.1.4.0  24
      [FW_C-policy-security-rule-1] destination-address 10.1.2.0  24
      [FW_C-policy-security-rule-1] action permit
      [FW_C-policy-security-rule-1] quit
      [FW_C-policy-security] rule name 2
      [FW_C-policy-security-rule-2] source-zone trust
      [FW_C-policy-security-rule-2] destination-zone untrust
      [FW_C-policy-security-rule-2] source-address 10.1.2.0  24
      [FW_C-policy-security-rule-2] destination-address 10.1.3.0  24
      [FW_C-policy-security-rule-2] destination-address 10.1.4.0  24
      [FW_C-policy-security-rule-2] action permit
      [FW_C-policy-security-rule-2] quit
      [FW_C-policy-security] rule name 3
      [FW_C-policy-security-rule-3] source-zone local dmz
      [FW_C-policy-security-rule-3] destination-zone local dmz
      [FW_C-policy-security-rule-3] action permit
      [FW_C-policy-security-rule-3] quit
      复制代码
    3. 配置Local域与Untrust域的本地策略,允许IKE协商报文能正常通过FW_C。
    4. [FW_C-policy-security] rule name 4
      [FW_C-policy-security-rule-4] source-zone local
      [FW_C-policy-security-rule-4] destination-zone untrust
      [FW_C-policy-security-rule-4] source-address 2.2.0.0  16
      [FW_C-policy-security-rule-4] destination-address 1.1.0.0  16
      [FW_C-policy-security-rule-4] action permit
      [FW_C-policy-security-rule-4] quit
      [FW_C-policy-security] rule name 5
      [FW_C-policy-security-rule-5] source-zone untrust
      [FW_C-policy-security-rule-5] destination-zone local
      [FW_C-policy-security-rule-5] source-address 1.1.0.0  16
      [FW_C-policy-security-rule-5] destination-address 2.2.0.0  16
      [FW_C-policy-security-rule-5] action permit
      [FW_C-policy-security-rule-5] quit
      复制代码
  1. 在FW_C(总部)上配置到FW_A(分支)和FW_B(分支)的静态路由。
[FW_C] ip route- static  10.1.3.0  24 tunnel 1
[FW_C] ip route- static  10.1.4.0  24 tunnel 2
复制代码
  1. 在FW_C(总部)上配置运行OSPF动态路由协议。

为了使FW_A发给总部的流量沿FW_A<->Router1<->FW_C<->Router2路径传递;FW_B发给总部的流量沿FW_B<->Router1<->FW_D<->Router2路径传递,则需要在FW_C和FW_D上配置路由策略,从而控制Router1和Router2的路由信息。

当FW_C和FW_D处于负载分档状态时,FW_C和FW_D都会向Router1发布到Tunnel1接口的直连路由;同时向Router2发布到FW_A的私网路由(静态路由)。为了使不同的流量按照不同的路由转发,则需要对FW_C和FW_D发布的直连路由和静态路由进行路由控制。

根据需求,当FW_C工作在负载分担状态时,Router1要将FW_A的流量发送给FW_C的Tunnel1接口,而不是FW_D的Tunnel1接口。于是FW_C在发布到Tunnel1的路由时,需要将开销值减10;FW_D在发布到Tunnel1的路由时,需要将开销值加10,这样Router1将会根据路由开销,选择将FW_A的流量发送到FW_C。

同时,Router2要将FW_A的反向流量发送给FW_C,而不是FW_D。于是FW_C在发布到FW_A的私网路由(静态路由)时,需要将此路由的开销值减10;FW_D在发布到FW_A的私网路由(静态路由)的路由时,需要将开销值加10,这样Router2将根据路由开销,选择将FW_A的反向流量发送到FW_C。

当FW_D发生故障,FW_C工作在active状态时,FW_C将对外发布的直连路由和静态路由统一减10,FW_D将对外发布的直连路由和静态路由统一加10,这样FW_A和FW_B将全部发送至FW_C处理。

当FW_C发生故障,设备工作在standby状态时,FW_C将对外发布的直连路由和静态路由统一加10,FW_D将对外发布的直连路由和静态路由统一减10,这样FW_A和FW_B将全部发送至FW_D处理。

[FW_C] ospf 1
[FW_C-ospf-1] import -route direct route-policy rp
[FW_C-ospf-1] import -route static route-policy rp
[FW_C-ospf-1] area 0.0.0.0
[FW_C-ospf-1-area-0.0.0.0] network 10.3.3.0  0.0.0.255
[FW_C-ospf-1-area-0.0.0.0] network 2.2.2.0  0.0.0.255
[FW_C-ospf-1-area-0.0.0.0] quit
[FW_C-ospf-1] quit
[FW_C] route-policy rp permit node 1
[FW_C-route-policy] if -match acl 2000
[FW_C-route-policy] if -match backup-status load-balance
[FW_C-route-policy] apply cost - 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 2
[FW_C-route-policy] if -match acl 2001
[FW_C-route-policy] if -match backup-status load-balance
[FW_C-route-policy] apply cost + 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 3
[FW_C-route-policy] if -match acl 2002
[FW_C-route-policy] if -match backup-status active
[FW_C-route-policy] apply cost - 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 4
[FW_C-route-policy] if -match acl 2002
[FW_C-route-policy] if -match backup-status standby
[FW_C-route-policy] apply cost + 10
[FW_C-route-policy] quit
[FW_C] acl 2000
[FW_C-acl-basic-2000] rule permit source 2.2.4.0  0.0.0.255
[FW_C-acl-basic-2000] rule permit source 10.1.3.0  0.0.0.255
[FW_C-acl-basic-2000] quit
[FW_C] acl 2001
[FW_C-acl-basic-2001] rule permit source 2.2.5.0  0.0.0.255
[FW_C-acl-basic-2001] rule permit source 10.1.4.0  0.0.0.255
[FW_C-acl-basic-2001] quit
[FW_C] acl 2002
[FW_C-acl-basic-2002] rule permit source 2.2.4.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 10.1.3.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 2.2.5.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 10.1.4.0  0.0.0.255
[FW_C-acl-basic-2002] quit
复制代码
  1. 在FW_C(总部)配置IPSec。

    1. 定义到FW_A、FW_B的数据流。
    2. [FW_C] acl 3005
      [FW_C-acl-adv-3005] rule permit ip source 10.1.2.0  0.0.0.255 destination 10.1.3.0  0.0.0.255
      [FW_C-acl-adv-3005] quit
      [FW_C] acl 3006
      [FW_C-acl-adv-3006] rule permit ip source 10.1.2.0  0.0.0.255 destination 10.1.4.0  0.0.0.255
      [FW_C-acl-adv-3006] quit
      复制代码
    3. 配置IPSec安全提议。
    4. [FW_C] ipsec proposal tran1
      [FW_C-ipsec-proposal-tran1] encapsulation-mode tunnel
      [FW_C-ipsec-proposal-tran1] transform esp
      [FW_C-ipsec-proposal-tran1] esp authentication-algorithm sha2- 256
      [FW_C-ipsec-proposal-tran1] esp encryption-algorithm aes- 256
      [FW_C-ipsec-proposal-tran1] quit
      复制代码
    5. 配置IKE安全提议。
    6. [FW_C] ike proposal 10
      [FW_C-ike-proposal-10] authentication-method pre-share
      [FW_C-ike-proposal-10] authentication-algorithm sha2- 256
      [FW_C-ike-proposal-10] quit
      复制代码
    7. 配置IKE Peer。
    8. [FW_C] ike peer ngfw_a
      [FW_C-ike-peer-b] ike-proposal 10
      [FW_C-ike-peer-b] remote-address 1.1.1.1
      [FW_C-ike-peer-b] pre-shared-key Admin @ 123
      [FW_C-ike-peer-b] undo version 2
      [FW_C-ike-peer-b] quit
      [FW_C] ike peer ngfw_b
      [FW_C-ike-peer-c] ike-proposal 10
      [FW_C-ike-peer-c] remote-address 1.1.2.1
      [FW_C-ike-peer-c] pre-shared-key Admin @ 123
      [FW_C-ike-peer-c] undo version 2
      [FW_C-ike-peer-c] quit
      复制代码
    9. 配置两个非模板方式IPSec策略。
    10. [FW_C] ipsec policy map1 10 isakmp
      [FW_C-ipsec-policy-isakmp-map1-10] security acl 3005
      [FW_C-ipsec-policy-isakmp-map1-10] proposal tran1
      [FW_C-ipsec-policy-isakmp-map1-10] ike-peer ngfw_a
      [FW_C-ipsec-policy-isakmp-map1-10] quit
      [FW_C] ipsec policy map2 10 isakmp
      [FW_C-ipsec-policy-isakmp-map2-10] security acl 3006
      [FW_C-ipsec-policy-isakmp-map2-10] proposal tran1
      [FW_C-ipsec-policy-isakmp-map2-10] ike-peer ngfw_b
      [FW_C-ipsec-policy-isakmp-map2-10] quit
      复制代码
    11. 在Tunnel接口上应用IPSec策略。
    12. [FW_C] interface Tunnel  1
      [FW_C-Tunnel1] ipsec policy map1 master
      [FW_C-Tunnel1] quit
      [FW_C] interface Tunnel  2
      [FW_C-Tunnel2] ipsec policy map2 slave
      [FW_C-Tunnel2] quit
      复制代码
  1. 开启FW_C(总部)的双机配置。
[FW_C] hrp interface gigabitethernet 1 / 0 / 2
[FW_C] hrp enable
HRP_M[FW_C] hrp load balance device
HRP_M[FW_C] hrp auto-sync config
HRP_M[FW_C] hrp mirror session enable
复制代码
  1. 配置FW_D(总部)。 FW_D开启双机配置以后,FW_C上配置的ACL、安全策略和IPSec业务都会自动备份到FW_D上。只有接口配置和路由信息不会备份过来,因此需要手工在FW_D上配置。

    1. 配置FW_D的接口IP地址,并将接口加入安全区域。具体配置过程请参见FW_C。
    2. 配置FW_D的路由数据。
    3. [FW_D] ip route- static  10.1.3.0  24 tunnel 1
      [FW_D] ip route- static  10.1.4.0  24 tunnel 2
      [FW_D] ospf 1
      [FW_D-ospf-1] import -route direct route-policy rp
      [FW_D-ospf-1] import -route static route-policy rp
      [FW_D-ospf-1] area 0.0.0.0
      [FW_D-ospf-1-area-0.0.0.0] network 10.3.4.0  0.0.0.255
      [FW_D-ospf-1-area-0.0.0.0] network 2.2.3.0  0.0.0.255
      [FW_D-ospf-1-area-0.0.0.0] quit
      [FW_D-ospf-1] quit
      [FW_D] route-policy rp permit node 1
      [FW_D-route-policy] if -match acl 2000
      [FW_D-route-policy] if -match backup-status load-balance
      [FW_D-route-policy] apply cost + 10
      [FW_D-route-policy] quit
      [FW_D] route-policy rp permit node 2
      [FW_D-route-policy] if -match acl 2001
      [FW_D-route-policy] if -match backup-status load-balance
      [FW_D-route-policy] apply cost - 10
      [FW_D-route-policy] quit
      [FW_D] route-policy rp permit node 3
      [FW_D-route-policy] if -match acl 2002
      [FW_D-route-policy] if -match backup-status active
      [FW_D-route-policy] apply cost - 10
      [FW_D-route-policy] quit
      [FW_D] route-policy rp permit node 4
      [FW_D-route-policy] if -match acl 2002
      [FW_D-route-policy] if -match backup-status standby
      [FW_D-route-policy] apply cost + 10
      [FW_D-route-policy] quit
      复制代码
    4. 在Tunnel接口上应用IPSec策略。
    5. [FW_D] interface Tunnel  1
      [FW_D-Tunnel1] ipsec policy map1 master
      [FW_D-Tunnel1] quit
      [FW_D] interface Tunnel  2
      [FW_D-Tunnel2] ipsec policy map2 slave
      [FW_D-Tunnel2] quit
      复制代码
  1. 开启FW_D(总部)的双机配置。
[FW_D] hrp enable
HRP_S[FW_D] hrp load balance device
HRP_S[FW_D] hrp auto-sync config
HRP_S[FW_D] hrp mirror session enable
复制代码
  1. 配置FW_A(分支)。

    1. 配置接口IP地址,并将接口加入相应安全区域。

    2. <sysname> system-view
      [sysname] sysname FW_A
      [FW_A] interface gigabitethernet 1 / 0 / 1
      [FW_A-GigabitEthernet1/0/1] ip address 1.1.1.1  24
      [FW_A-GigabitEthernet1/0/1] quit
      [FW_A] interface gigabitethernet 1 / 0 / 2
      [FW_A-GigabitEthernet1/0/2] ip address 10.1.3.1  24
      [FW_A-GigabitEthernet1/0/2] quit
      [FW_A] firewall zone untrust
      [FW_A-zone-untrust] add interface gigabitethernet 1 / 0 / 1
      [FW_A-zone-untrust] quit
      [FW_A] firewall zone trust
      [FW_A-zone-trust] add interface gigabitethernet 1 / 0 / 2
      [FW_A-zone-trust] quit
      复制代码
    3. 配置防火墙策略。

      1. 配置Trust域与Untrust域的转发策略,允许封装前和解封后的报文能通过FW_A。
      2. [FW_A] security-policy
        [FW_A-policy-security] rule name 1
        [FW_A-policy-security-rule-1] source-zone trust
        [FW_A-policy-security-rule-1] destination-zone untrust
        [FW_A-policy-security-rule-1] source-address 10.1.3.0  24
        [FW_A-policy-security-rule-1] destination-address 10.1.2.0  24
        [FW_A-policy-security-rule-1] action permit
        [FW_A-policy-security-rule-1] quit
        [FW_A-policy-security] rule name 2
        [FW_A-policy-security-rule-2] source-zone untrust
        [FW_A-policy-security-rule-2] destination-zone trust
        [FW_A-policy-security-rule-2] source-address 10.1.2.0  24
        [FW_A-policy-security-rule-2] destination-address 10.1.3.0  24
        [FW_A-policy-security-rule-2] action permit
        [FW_A-policy-security-rule-2] quit
        复制代码
      3. 配置Local域与Untrust域的本地策略,允许IKE协商报文能正常通过FW_A。
      4. [FW_A-policy-security] rule name 3
        [FW_A-policy-security-rule-3] source-zone local
        [FW_A-policy-security-rule-3] destination-zone untrust
        [FW_A-policy-security-rule-3] source-address 1.1.0.0  16
        [FW_A-policy-security-rule-3] destination-address 2.2.0.0  16
        [FW_A-policy-security-rule-3] action permit
        [FW_A-policy-security-rule-3] quit
        [FW_A-policy-security] rule name 4
        [FW_A-policy-security-rule-4] source-zone untrust
        [FW_A-policy-security-rule-4] destination-zone local
        [FW_A-policy-security-rule-4] source-address 2.2.0.0  16
        [FW_A-policy-security-rule-4] destination-address 1.1.0.0  16
        [FW_A-policy-security-rule-4] action permit
        [FW_A-policy-security-rule-4] quit
        [FW_A-policy-security] quit
        复制代码
    4. 配置一条缺省路由。假设到公网路由下一跳为1.1.1.2。

    5. [FW_A] ip route- static  0.0.0.0  0.0.0.0  1.1.1.2
      复制代码
    6. 配置访问控制列表,定义需要保护的数据流。

    7. [FW_A] acl 3000 
      [FW_A-acl-adv-3000] rule permit ip source 10.1.3.0  0.0.0.255 destination 10.1.2.0  0.0.0.255
      [FW_A-acl-adv-3000] quit
      复制代码
    8. 配置名称为tran1的IPSec安全提议。

    9. [FW_A] ipsec proposal tran1
      [FW_A-ipsec-proposal-tran1] encapsulation-mode tunnel
      [FW_A-ipsec-proposal-tran1] transform esp
      [FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2- 256
      [FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes- 256
      [FW_A-ipsec-proposal-tran1] quit
      复制代码
    10. 配置序号为10的IKE安全提议。

    11. [FW_A] ike proposal 10
      [FW_A-ike-proposal-10] authentication-method pre-share
      [FW_A-ike-proposal-10] authentication-algorithm sha2- 256
      [FW_A-ike-proposal-10] quit
      复制代码
    12. 配置IKE Peer。

    13. [FW_A] ike peer ngfw_c
      [FW_A-ike-peer-c] ike-proposal 10
      [FW_A-ike-peer-c] remote-address 2.2.4.1
      [FW_A-ike-peer-c] pre-shared-key Admin @ 123
      [FW_A-ike-peer-c] undo version 2
      [FW_A-ike-peer-c] quit
      复制代码
    14. 配置IPSec安全策略组map1。

    15. [FW_A] ipsec policy map1 10 isakmp
      [FW_A-ipsec-policy-isakmp-map1-10] security acl 3000
      [FW_A-ipsec-policy-isakmp-map1-10] proposal tran1
      [FW_A-ipsec-policy-isakmp-map1-10] ike-peer ngfw_c
      [FW_A-ipsec-policy-isakmp-map1-10] quit
      复制代码
    16. 在出接口GE1/0/1上应用安全策略组map1。

    17. [FW_A] interface gigabitethernet 1 / 0 / 1
      [FW_A-GigabitEthernet1/0/1] ipsec policy map1
      [FW_A-GigabitEthernet1/0/1] quit
      复制代码
  1. 配置FW_B(分支)。 FW_B与FW_A的配置方法相同,请参考FW_A配置FW_B。

结果验证

  1. 配置完成后,在FW_C上执行display hrp state命令,检查当前HRP的状态,显示以下信息表示HRP建立成功。
[FW_C] display hrp state
 Role: active, peer: active                                                    
 Running priority: 47002, peer: 47002                                         
 Core state: normal, peer: normal                                    
 Backup channel usage: 0.00%                                                    
 Stable time: 0 days, 0 hours, 18 minutes
复制代码
  1. 分别在FW_A、FW_B上执行display ipsec sa命令会显示IPSec安全联盟的建立情况。以FW_A为例,出现以下显示说明IPSec安全联盟建立成功。
<FW_A> display ipsec sa brief
Current ipsec sa num:2

Spu board slot 1, cpu 1 ipsec sa information:                                   
Number of SAs:2                                                              
    Src address   Dst address      SPI        VPN  Protocol     Algorithm       
------------------------------------------------------------------------------- 
    2.2.4.1         1.1.1.1       4001819557        ESP      E:AES-256 A:SHA2-256-128
    1.1.2.1         2.2.4.1       3923280450        ESP      E:AES-256 A:SHA2-256-128
复制代码
  1. 验证双机切换,业务是否正常。

    1. 在FW_A和FW_B运行在正常状态时,分别使用FW_A和FW_B下的用户PC访问总部资源,访问成功则表明配置OK。
    2. DOWN掉FW_C设备,然后观察两个分支是否依然能够正常访问总部资源,如果访问成功,表示流量可以正常从FW_C切换至FW_D设备。
    3. 恢复FW_C设备,然后再DOWN掉FW_D设备,观察两个分支是否依然能够正常访问总部资源,如果访问成功,表示流量可以正常从FW_D切换至FW_C设备。
    4. 如果在上述3个场景下,两个分支均能够正常访问总部资源,则表明该业务场景配置OK。

 

以上是关于玩转华为ENSP模拟器系列 | IPSec网关负载分担双机热备,上下行连接路由器的主要内容,如果未能解决你的问题,请参考以下文章

玩转华为ENSP模拟器系列 | 两个网关之间通过IPSec VdPdNd互联并通过总部IPSec网关进行NAT后上网

玩转华为ENSP模拟器系列 | 两个网关之间通过IPSec VdPdNd互联并通过总部IPSec网关进行NAT后上网

玩转华为ENSP模拟器系列 | 两个网关之间通过IPSec VdPdNd互联并通过各自IPSec网关进行NAT后上网

玩转华为ENSP模拟器系列 | 两个网关之间通过IPSec VdPdNd互联并通过各自IPSec网关进行NAT后上网

玩转华为ENSP模拟器系列 | IPSec网关主备双机热备

玩转华为ENSP模拟器系列 | 两个网关之间配置IPSec VdPdNd主备链路备份