玩转华为ENSP模拟器系列 | IPSec网关负载分担双机热备，上下行连接路由器

Posted 2022-11-03 COCOgsta

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了玩转华为ENSP模拟器系列 | IPSec网关负载分担双机热备，上下行连接路由器相关的知识，希望对你有一定的参考价值。

素材来源：华为防火墙配置指南

一边学习一边整理试验笔记，并与大家分享，侵权即删，谢谢支持！

附上汇总贴：玩转华为ENSP模拟器系列 | 合集_COCOgsta的博客-CSDN博客_华为模拟器实验

目标

介绍负载分担双机热备组网，上下行连接路由器时如何配置IPSec VPN。

组网需求

如图1所示，公司总部、分支均通过FW接入Internet。总部的FW_C和FW_D以负载分担方式工作，其业务接口都工作在三层，并与上下行路由器之间运行OSPF协议。企业期望分支用户访问总部的流量受IPSec隧道保护，且FW_C处理FW_A发送到总部的流量，FW_D处理FW_B发送到总部的流量。当FW_C或FW_D中一台设备出现故障时，分支发往总部的流量全部切换到另一台运行正常的设备。

配置思路

配置FW_C和FW_D以负载分担方式工作。

在FW_C上创建Tunnel和Tunnel2两个接口，在FW_D上也创建Tunnel和Tunnel2两个接口。两台设备上创建的Tunnel1接口IP地址相同，Tunnel2接口的IP地址相同。其中FW_C上创建的Tunnel1是主接口，用于和FW_A创建主IPSec隧道；FW_D上创建的Tunnel1接口为备接口，用于和FW_A创建备IPSec隧道。同理，FW_D上的Tunnel2接口用于和FW_B建立主IPSec隧道，FW_C上的Tunnel2接口用于和FW_B建立备IPSec隧道。由此，FW_A、FW_B将各有两条IPSec隧道与双机（FW_C和FW_D）相连。双机运行正常时，FW_A、FW_B各自使用主IPSec隧道将流量发往总部。当双机运行异常时，则FW_A或FW_B将会启用备IPSec隧道将流量发往总部。

在FW_C和FW_D上配置路由策略，通过设备状态的变化，改变路由优先级。当双机运行状态正常时，其状态为负载分担状态load-balance，总部返回给FW_A的流量被引到FW_C上处理，总部返回给FW_B的流量被引流到FW_D上处理。假如，双机中FW_C设备出现故障，于是FW_C的设备状态变为Standby，FW_D设备的状态变为Active，总部返回给FW_A和FW_B的流量将全部被引流到FW_D。

在FW_A和FW_B接入Internet的公网接口上应用IPSec策略，分别与FW_C和FW_D建立IPSec隧道。

操作步骤

配置FW_C（总部）的接口IP地址。

配置GE1/0/1接口IP地址，将接口加入Untrust域。

<sysname> system-view
[sysname] sysname FW_C
[FW_C] interface gigabitethernet 1 / 0 / 1
[FW_C-GigabitEthernet1/0/1] ip address 2.2.2.1  24
[FW_C-GigabitEthernet1/0/1] quit
[FW_C] firewall zone untrust
[FW_C-zone-untrust] add interface gigabitethernet 1 / 0 / 1
[FW_C-zone-untrust] quit
复制代码

配置GE1/0/2的接口IP地址，并将接口加入相应的安全区域。

[FW_C] interface gigabitethernet 1 / 0 / 2
[FW_C-GigabitEthernet1/0/2] ip address 10.10.0.1  24
[FW_C-GigabitEthernet1/0/2] quit
[FW_C] firewall zone dmz
[FW_C-zone-dmz] add interface gigabitethernet 1 / 0 / 2
[FW_C-zone-dmz] quit
复制代码

配置GE1/0/3接口IP地址，将接口加入Trust域。

[FW_C] gigabitethernet 1 / 0 / 3
[FW_C-GigabitEthernet1/0/3] ip address 10.3.3.1  24
[FW_C-GigabitEthernet1/0/3] quit
[FW_C] firewall zone trust
[FW_C-zone-trust] add interface gigabitethernet 1 / 0 / 3
[FW_C-zone-trust] quit
复制代码

配置VGMP组监控上下行业务接口。

[FW_C] hrp track interface GigabitEthernet  1 / 0 / 1
[FW_C] hrp track interface GigabitEthernet  1 / 0 / 3
复制代码

在配置FW_C上配置Tunnel1和Tunnel2两个接口。

[FW_C] interface tunnel 1
[FW_C_Tunnel1] tunnel-protocol ipsec
[FW_C_Tunnel1] ip address 2.2.4.1  24
[FW_C_Tunnel1] quit
[FW_C] interface tunnel 2
[FW_C_Tunnel2] tunnel-protocol ipsec
[FW_C_Tunnel2] ip address 2.2.5.1  24
[FW_C_Tunnel2] quit
[FW_C] firewall zone untrust
[FW_C-zone-untrust] add interface Tunnel  1
[FW_C-zone-untrust] add interface Tunnel  2
[FW_C-zone-untrust] quit
复制代码

在FW_C（总部）上配置域间安全策略。

配置Trust区域和Untrust区域的域间安全策略。

[FW_C] security-policy
[FW_C-policy-security] rule name 1
[FW_C-policy-security-rule-1] source-zone untrust
[FW_C-policy-security-rule-1] destination-zone trust
[FW_C-policy-security-rule-1] source-address 10.1.3.0  24
[FW_C-policy-security-rule-1] source-address 10.1.4.0  24
[FW_C-policy-security-rule-1] destination-address 10.1.2.0  24
[FW_C-policy-security-rule-1] action permit
[FW_C-policy-security-rule-1] quit
[FW_C-policy-security] rule name 2
[FW_C-policy-security-rule-2] source-zone trust
[FW_C-policy-security-rule-2] destination-zone untrust
[FW_C-policy-security-rule-2] source-address 10.1.2.0  24
[FW_C-policy-security-rule-2] destination-address 10.1.3.0  24
[FW_C-policy-security-rule-2] destination-address 10.1.4.0  24
[FW_C-policy-security-rule-2] action permit
[FW_C-policy-security-rule-2] quit
[FW_C-policy-security] rule name 3
[FW_C-policy-security-rule-3] source-zone local dmz
[FW_C-policy-security-rule-3] destination-zone local dmz
[FW_C-policy-security-rule-3] action permit
[FW_C-policy-security-rule-3] quit
复制代码

配置Local域与Untrust域的本地策略，允许IKE协商报文能正常通过FW_C。

[FW_C-policy-security] rule name 4
[FW_C-policy-security-rule-4] source-zone local
[FW_C-policy-security-rule-4] destination-zone untrust
[FW_C-policy-security-rule-4] source-address 2.2.0.0  16
[FW_C-policy-security-rule-4] destination-address 1.1.0.0  16
[FW_C-policy-security-rule-4] action permit
[FW_C-policy-security-rule-4] quit
[FW_C-policy-security] rule name 5
[FW_C-policy-security-rule-5] source-zone untrust
[FW_C-policy-security-rule-5] destination-zone local
[FW_C-policy-security-rule-5] source-address 1.1.0.0  16
[FW_C-policy-security-rule-5] destination-address 2.2.0.0  16
[FW_C-policy-security-rule-5] action permit
[FW_C-policy-security-rule-5] quit
复制代码

在FW_C（总部）上配置到FW_A（分支）和FW_B（分支）的静态路由。

[FW_C] ip route- static  10.1.3.0  24 tunnel 1
[FW_C] ip route- static  10.1.4.0  24 tunnel 2
复制代码

在FW_C（总部）上配置运行OSPF动态路由协议。

为了使FW_A发给总部的流量沿FW_A<->Router1<->FW_C<->Router2路径传递；FW_B发给总部的流量沿FW_B<->Router1<->FW_D<->Router2路径传递，则需要在FW_C和FW_D上配置路由策略，从而控制Router1和Router2的路由信息。

当FW_C和FW_D处于负载分档状态时，FW_C和FW_D都会向Router1发布到Tunnel1接口的直连路由；同时向Router2发布到FW_A的私网路由（静态路由）。为了使不同的流量按照不同的路由转发，则需要对FW_C和FW_D发布的直连路由和静态路由进行路由控制。

根据需求，当FW_C工作在负载分担状态时，Router1要将FW_A的流量发送给FW_C的Tunnel1接口，而不是FW_D的Tunnel1接口。于是FW_C在发布到Tunnel1的路由时，需要将开销值减10；FW_D在发布到Tunnel1的路由时，需要将开销值加10，这样Router1将会根据路由开销，选择将FW_A的流量发送到FW_C。

同时，Router2要将FW_A的反向流量发送给FW_C，而不是FW_D。于是FW_C在发布到FW_A的私网路由（静态路由）时，需要将此路由的开销值减10；FW_D在发布到FW_A的私网路由（静态路由）的路由时，需要将开销值加10，这样Router2将根据路由开销，选择将FW_A的反向流量发送到FW_C。

当FW_D发生故障，FW_C工作在active状态时，FW_C将对外发布的直连路由和静态路由统一减10，FW_D将对外发布的直连路由和静态路由统一加10，这样FW_A和FW_B将全部发送至FW_C处理。

当FW_C发生故障，设备工作在standby状态时，FW_C将对外发布的直连路由和静态路由统一加10，FW_D将对外发布的直连路由和静态路由统一减10，这样FW_A和FW_B将全部发送至FW_D处理。

[FW_C] ospf 1
[FW_C-ospf-1] import -route direct route-policy rp
[FW_C-ospf-1] import -route static route-policy rp
[FW_C-ospf-1] area 0.0.0.0
[FW_C-ospf-1-area-0.0.0.0] network 10.3.3.0  0.0.0.255
[FW_C-ospf-1-area-0.0.0.0] network 2.2.2.0  0.0.0.255
[FW_C-ospf-1-area-0.0.0.0] quit
[FW_C-ospf-1] quit
[FW_C] route-policy rp permit node 1
[FW_C-route-policy] if -match acl 2000
[FW_C-route-policy] if -match backup-status load-balance
[FW_C-route-policy] apply cost - 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 2
[FW_C-route-policy] if -match acl 2001
[FW_C-route-policy] if -match backup-status load-balance
[FW_C-route-policy] apply cost + 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 3
[FW_C-route-policy] if -match acl 2002
[FW_C-route-policy] if -match backup-status active
[FW_C-route-policy] apply cost - 10
[FW_C-route-policy] quit
[FW_C] route-policy rp permit node 4
[FW_C-route-policy] if -match acl 2002
[FW_C-route-policy] if -match backup-status standby
[FW_C-route-policy] apply cost + 10
[FW_C-route-policy] quit
[FW_C] acl 2000
[FW_C-acl-basic-2000] rule permit source 2.2.4.0  0.0.0.255
[FW_C-acl-basic-2000] rule permit source 10.1.3.0  0.0.0.255
[FW_C-acl-basic-2000] quit
[FW_C] acl 2001
[FW_C-acl-basic-2001] rule permit source 2.2.5.0  0.0.0.255
[FW_C-acl-basic-2001] rule permit source 10.1.4.0  0.0.0.255
[FW_C-acl-basic-2001] quit
[FW_C] acl 2002
[FW_C-acl-basic-2002] rule permit source 2.2.4.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 10.1.3.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 2.2.5.0  0.0.0.255
[FW_C-acl-basic-2002] rule permit source 10.1.4.0  0.0.0.255
[FW_C-acl-basic-2002] quit
复制代码

在FW_C（总部）配置IPSec。

定义到FW_A、FW_B的数据流。

[FW_C] acl 3005
[FW_C-acl-adv-3005] rule permit ip source 10.1.2.0  0.0.0.255 destination 10.1.3.0  0.0.0.255
[FW_C-acl-adv-3005] quit
[FW_C] acl 3006
[FW_C-acl-adv-3006] rule permit ip source 10.1.2.0  0.0.0.255 destination 10.1.4.0  0.0.0.255
[FW_C-acl-adv-3006] quit
复制代码

配置IPSec安全提议。

[FW_C] ipsec proposal tran1
[FW_C-ipsec-proposal-tran1] encapsulation-mode tunnel
[FW_C-ipsec-proposal-tran1] transform esp
[FW_C-ipsec-proposal-tran1] esp authentication-algorithm sha2- 256
[FW_C-ipsec-proposal-tran1] esp encryption-algorithm aes- 256
[FW_C-ipsec-proposal-tran1] quit
复制代码

配置IKE安全提议。

[FW_C] ike proposal 10
[FW_C-ike-proposal-10] authentication-method pre-share
[FW_C-ike-proposal-10] authentication-algorithm sha2- 256
[FW_C-ike-proposal-10] quit
复制代码

配置IKE Peer。

[FW_C] ike peer ngfw_a
[FW_C-ike-peer-b] ike-proposal 10
[FW_C-ike-peer-b] remote-address 1.1.1.1
[FW_C-ike-peer-b] pre-shared-key Admin @ 123
[FW_C-ike-peer-b] undo version 2
[FW_C-ike-peer-b] quit
[FW_C] ike peer ngfw_b
[FW_C-ike-peer-c] ike-proposal 10
[FW_C-ike-peer-c] remote-address 1.1.2.1
[FW_C-ike-peer-c] pre-shared-key Admin @ 123
[FW_C-ike-peer-c] undo version 2
[FW_C-ike-peer-c] quit
复制代码

配置两个非模板方式IPSec策略。

[FW_C] ipsec policy map1 10 isakmp
[FW_C-ipsec-policy-isakmp-map1-10] security acl 3005
[FW_C-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_C-ipsec-policy-isakmp-map1-10] ike-peer ngfw_a
[FW_C-ipsec-policy-isakmp-map1-10] quit
[FW_C] ipsec policy map2 10 isakmp
[FW_C-ipsec-policy-isakmp-map2-10] security acl 3006
[FW_C-ipsec-policy-isakmp-map2-10] proposal tran1
[FW_C-ipsec-policy-isakmp-map2-10] ike-peer ngfw_b
[FW_C-ipsec-policy-isakmp-map2-10] quit
复制代码

在Tunnel接口上应用IPSec策略。

[FW_C] interface Tunnel  1
[FW_C-Tunnel1] ipsec policy map1 master
[FW_C-Tunnel1] quit
[FW_C] interface Tunnel  2
[FW_C-Tunnel2] ipsec policy map2 slave
[FW_C-Tunnel2] quit
复制代码

开启FW_C（总部）的双机配置。

[FW_C] hrp interface gigabitethernet 1 / 0 / 2
[FW_C] hrp enable
HRP_M[FW_C] hrp load balance device
HRP_M[FW_C] hrp auto-sync config
HRP_M[FW_C] hrp mirror session enable
复制代码

配置FW_D（总部）。 FW_D开启双机配置以后，FW_C上配置的ACL、安全策略和IPSec业务都会自动备份到FW_D上。只有接口配置和路由信息不会备份过来，因此需要手工在FW_D上配置。

配置FW_D的接口IP地址，并将接口加入安全区域。具体配置过程请参见FW_C。
配置FW_D的路由数据。

[FW_D] ip route- static  10.1.3.0  24 tunnel 1
[FW_D] ip route- static  10.1.4.0  24 tunnel 2
[FW_D] ospf 1
[FW_D-ospf-1] import -route direct route-policy rp
[FW_D-ospf-1] import -route static route-policy rp
[FW_D-ospf-1] area 0.0.0.0
[FW_D-ospf-1-area-0.0.0.0] network 10.3.4.0  0.0.0.255
[FW_D-ospf-1-area-0.0.0.0] network 2.2.3.0  0.0.0.255
[FW_D-ospf-1-area-0.0.0.0] quit
[FW_D-ospf-1] quit
[FW_D] route-policy rp permit node 1
[FW_D-route-policy] if -match acl 2000
[FW_D-route-policy] if -match backup-status load-balance
[FW_D-route-policy] apply cost + 10
[FW_D-route-policy] quit
[FW_D] route-policy rp permit node 2
[FW_D-route-policy] if -match acl 2001
[FW_D-route-policy] if -match backup-status load-balance
[FW_D-route-policy] apply cost - 10
[FW_D-route-policy] quit
[FW_D] route-policy rp permit node 3
[FW_D-route-policy] if -match acl 2002
[FW_D-route-policy] if -match backup-status active
[FW_D-route-policy] apply cost - 10
[FW_D-route-policy] quit
[FW_D] route-policy rp permit node 4
[FW_D-route-policy] if -match acl 2002
[FW_D-route-policy] if -match backup-status standby
[FW_D-route-policy] apply cost + 10
[FW_D-route-policy] quit
复制代码

在Tunnel接口上应用IPSec策略。

[FW_D] interface Tunnel  1
[FW_D-Tunnel1] ipsec policy map1 master
[FW_D-Tunnel1] quit
[FW_D] interface Tunnel  2
[FW_D-Tunnel2] ipsec policy map2 slave
[FW_D-Tunnel2] quit
复制代码

开启FW_D（总部）的双机配置。

[FW_D] hrp enable
HRP_S[FW_D] hrp load balance device
HRP_S[FW_D] hrp auto-sync config
HRP_S[FW_D] hrp mirror session enable
复制代码

配置FW_A（分支）。

配置接口IP地址，并将接口加入相应安全区域。

<sysname> system-view
[sysname] sysname FW_A
[FW_A] interface gigabitethernet 1 / 0 / 1
[FW_A-GigabitEthernet1/0/1] ip address 1.1.1.1  24
[FW_A-GigabitEthernet1/0/1] quit
[FW_A] interface gigabitethernet 1 / 0 / 2
[FW_A-GigabitEthernet1/0/2] ip address 10.1.3.1  24
[FW_A-GigabitEthernet1/0/2] quit
[FW_A] firewall zone untrust
[FW_A-zone-untrust] add interface gigabitethernet 1 / 0 / 1
[FW_A-zone-untrust] quit
[FW_A] firewall zone trust
[FW_A-zone-trust] add interface gigabitethernet 1 / 0 / 2
[FW_A-zone-trust] quit
复制代码

配置防火墙策略。

配置Trust域与Untrust域的转发策略，允许封装前和解封后的报文能通过FW_A。

[FW_A] security-policy
[FW_A-policy-security] rule name 1
[FW_A-policy-security-rule-1] source-zone trust
[FW_A-policy-security-rule-1] destination-zone untrust
[FW_A-policy-security-rule-1] source-address 10.1.3.0  24
[FW_A-policy-security-rule-1] destination-address 10.1.2.0  24
[FW_A-policy-security-rule-1] action permit
[FW_A-policy-security-rule-1] quit
[FW_A-policy-security] rule name 2
[FW_A-policy-security-rule-2] source-zone untrust
[FW_A-policy-security-rule-2] destination-zone trust
[FW_A-policy-security-rule-2] source-address 10.1.2.0  24
[FW_A-policy-security-rule-2] destination-address 10.1.3.0  24
[FW_A-policy-security-rule-2] action permit
[FW_A-policy-security-rule-2] quit
复制代码

配置Local域与Untrust域的本地策略，允许IKE协商报文能正常通过FW_A。

[FW_A-policy-security] rule name 3
[FW_A-policy-security-rule-3] source-zone local
[FW_A-policy-security-rule-3] destination-zone untrust
[FW_A-policy-security-rule-3] source-address 1.1.0.0  16
[FW_A-policy-security-rule-3] destination-address 2.2.0.0  16
[FW_A-policy-security-rule-3] action permit
[FW_A-policy-security-rule-3] quit
[FW_A-policy-security] rule name 4
[FW_A-policy-security-rule-4] source-zone untrust
[FW_A-policy-security-rule-4] destination-zone local
[FW_A-policy-security-rule-4] source-address 2.2.0.0  16
[FW_A-policy-security-rule-4] destination-address 1.1.0.0  16
[FW_A-policy-security-rule-4] action permit
[FW_A-policy-security-rule-4] quit
[FW_A-policy-security] quit
复制代码

配置一条缺省路由。假设到公网路由下一跳为1.1.1.2。

[FW_A] ip route- static  0.0.0.0  0.0.0.0  1.1.1.2
复制代码

配置访问控制列表，定义需要保护的数据流。

[FW_A] acl 3000 
[FW_A-acl-adv-3000] rule permit ip source 10.1.3.0  0.0.0.255 destination 10.1.2.0  0.0.0.255
[FW_A-acl-adv-3000] quit
复制代码

配置名称为tran1的IPSec安全提议。

[FW_A] ipsec proposal tran1
[FW_A-ipsec-proposal-tran1] encapsulation-mode tunnel
[FW_A-ipsec-proposal-tran1] transform esp
[FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2- 256
[FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes- 256
[FW_A-ipsec-proposal-tran1] quit
复制代码

配置序号为10的IKE安全提议。

[FW_A] ike proposal 10
[FW_A-ike-proposal-10] authentication-method pre-share
[FW_A-ike-proposal-10] authentication-algorithm sha2- 256
[FW_A-ike-proposal-10] quit
复制代码

配置IKE Peer。

[FW_A] ike peer ngfw_c
[FW_A-ike-peer-c] ike-proposal 10
[FW_A-ike-peer-c] remote-address 2.2.4.1
[FW_A-ike-peer-c] pre-shared-key Admin @ 123
[FW_A-ike-peer-c] undo version 2
[FW_A-ike-peer-c] quit
复制代码

配置IPSec安全策略组map1。

[FW_A] ipsec policy map1 10 isakmp
[FW_A-ipsec-policy-isakmp-map1-10] security acl 3000
[FW_A-ipsec-policy-isakmp-map1-10] proposal tran1
[FW_A-ipsec-policy-isakmp-map1-10] ike-peer ngfw_c
[FW_A-ipsec-policy-isakmp-map1-10] quit
复制代码

在出接口GE1/0/1上应用安全策略组map1。

[FW_A] interface gigabitethernet 1 / 0 / 1
[FW_A-GigabitEthernet1/0/1] ipsec policy map1
[FW_A-GigabitEthernet1/0/1] quit
复制代码

配置FW_B（分支）。 FW_B与FW_A的配置方法相同，请参考FW_A配置FW_B。

结果验证

配置完成后，在FW_C上执行display hrp state命令，检查当前HRP的状态，显示以下信息表示HRP建立成功。

[FW_C] display hrp state
 Role: active, peer: active                                                    
 Running priority: 47002, peer: 47002                                         
 Core state: normal, peer: normal                                    
 Backup channel usage: 0.00%                                                    
 Stable time: 0 days, 0 hours, 18 minutes
复制代码

分别在FW_A、FW_B上执行display ipsec sa命令会显示IPSec安全联盟的建立情况。以FW_A为例，出现以下显示说明IPSec安全联盟建立成功。

<FW_A> display ipsec sa brief
Current ipsec sa num:2

Spu board slot 1, cpu 1 ipsec sa information:                                   
Number of SAs:2                                                              
    Src address   Dst address      SPI        VPN  Protocol     Algorithm       
------------------------------------------------------------------------------- 
    2.2.4.1         1.1.1.1       4001819557        ESP      E:AES-256 A:SHA2-256-128
    1.1.2.1         2.2.4.1       3923280450        ESP      E:AES-256 A:SHA2-256-128
复制代码

验证双机切换，业务是否正常。
1. 在FW_A和FW_B运行在正常状态时，分别使用FW_A和FW_B下的用户PC访问总部资源，访问成功则表明配置OK。
2. DOWN掉FW_C设备，然后观察两个分支是否依然能够正常访问总部资源，如果访问成功，表示流量可以正常从FW_C切换至FW_D设备。
3. 恢复FW_C设备，然后再DOWN掉FW_D设备，观察两个分支是否依然能够正常访问总部资源，如果访问成功，表示流量可以正常从FW_D切换至FW_C设备。
4. 如果在上述3个场景下，两个分支均能够正常访问总部资源，则表明该业务场景配置OK。

以上是关于玩转华为ENSP模拟器系列 | IPSec网关负载分担双机热备，上下行连接路由器的主要内容，如果未能解决你的问题，请参考以下文章

玩转华为ENSP模拟器系列 | 两个网关之间通过IPSec VdPdNd互联并通过总部IPSec网关进行NAT后上网

玩转华为ENSP模拟器系列 | 两个网关之间通过IPSec VdPdNd互联并通过各自IPSec网关进行NAT后上网