交換機二層端口引流案列

如圖，交換機的int vlan 10和防火牆的RAGG1.10處於同一網段，交換機的int vlan20、路由器的GE0/0以及防火牆的RAGG1.20處於同一網段。  

現在客戶需要實現如下需求：防火牆工作正常的時候，終端前往邊界路由器的流量需要經過防火牆，但是當防火牆異常的時候，流量直接從交換機轉發給防火牆。

防火牆配置：

interface Route-Aggregation1.10

 ip address 192.168.10.1 255.255.255.0

 vlan-type dot1q vid 10

#

interface Route-Aggregation1.20

 ip address 192.168.20.1 255.255.255.0

 vlan-type dot1q vid 20

#

interface GigabitEthernet1/0/0

 port link-mode route

 port link-aggregation group 1

#

interface GigabitEthernet1/0/1

 port link-mode route

 port link-aggregation group 1

#

security-zone name Trust

 import interface Route-Aggregation1.10

#

security-zone name Untrust

 import interface Route-Aggregation1.20

#

 ip route-static 0.0.0.0 0 192.168.20.3

 ip route-static 192.168.100.0 24 192.168.10.2

#

security-policy ip

 rule 0 name permit-all

  action pass

  source-zone untrust

  source-zone trust

  source-zone local

  destination-zone untrust

  destination-zone trust

  destination-zone local

交換機配置

track 1 nqa entry fw 1 reaction 1 //track nqa狀態

#

nqa entry fw 1    //配置nqa，探測10.1是否可達，頻率1秒（100厘秒），探測三次

 type icmp-echo

  destination ip 192.168.10.1

  frequency 100

  reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only

#

 nqa schedule fw 1 start-time now lifetime forever  //開啟nqa探測

#

interface Bridge-Aggregation1

 port link-type trunk

 port trunk permit vlan 1 10 20

#

interface Vlan-interface10

 ip address 192.168.10.2 255.255.255.0

#

interface Vlan-interface20

 ip address 192.168.20.2 255.255.255.0

#

interface Vlan-interface100

 ip address 192.168.100.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 10 20

 port link-aggregation group 1

#

interface GigabitEthernet1/0/2

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 10 20

 port link-aggregation group 1

#

 ip route-static 0.0.0.0 0 192.168.10.1 track 1   //配置靜態路由指向防火牆並調用track，當nqa探測失敗的時候自動失效

 ip route-static 0.0.0.0 0 192.168.20.3 preference 70   //配置浮動路由指向路由器，當上麵的靜態路由失效的時候生效

路由器配置

track 1 nqa entry fw 1 reaction 1 //track nqa狀態

#

nqa entry fw 1    //配置nqa，探測20.1是否可達，頻率1秒（100厘秒），探測三次

 type icmp-echo

  destination ip 192.168.20.1

  frequency 100

  reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only

#

 nqa schedule fw 1 start-time now lifetime forever   //開啟nqa探測

#

interface LoopBack0   //模擬的外網地址

 ip address 100.100.100.100 255.255.255.255

#

interface GigabitEthernet0/0

 port link-mode route

 ip address 192.168.20.3 255.255.255.0

#

 ip route-static 192.168.100.0 24 192.168.20.1 track 1  //配置靜態路由指向防火牆並調用track，當nqa探測失敗的時候自動失效

 ip route-static 192.168.100.0 24 192.168.20.2 preference 70   //配置浮動路由指向交換機，當上麵的靜態路由失效的時候生效

測試結果

正常情況下的交換機路由表

[SW]dis ip ro

Destinations : 21       Routes : 21

Destination/Mask   Proto   Pre Cost        NextHop         Interface

0.0.0.0/0          Static  60  0           192.168.10.1    Vlan10

......

正常情況下的路由器路由表

[RT]dis ip ro

Destinations : 14       Routes : 14

Destination/Mask   Proto   Pre Cost        NextHop         Interface

......

192.168.100.0/24   Static  60  0           192.168.20.1    GE0/0

......

PC(192.168.100.2)測試訪問100.100.100.100

[PC]ping 100.100.100.100

Ping 100.100.100.100 (100.100.100.100): 56 data bytes, press CTRL_C to break

56 bytes from 100.100.100.100: icmp_seq=0 ttl=253 time=3.000 ms

56 bytes from 100.100.100.100: icmp_seq=1 ttl=253 time=3.000 ms

56 bytes from 100.100.100.100: icmp_seq=2 ttl=253 time=3.000 ms

56 bytes from 100.100.100.100: icmp_seq=3 ttl=253 time=2.000 ms

56 bytes from 100.100.100.100: icmp_seq=4 ttl=253 time=4.000 ms

--- Ping statistics for 100.100.100.100 ---

5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss

round-trip min/avg/max/std-dev = 2.000/3.000/4.000/0.632 ms

此時防火牆能夠看到會話，說明流量經過防火牆

[FW]dis session table ipv4 source-ip 192.168.100.2 destination-ip 100.100.100.100 verbose

Slot 1:

Initiator:

  Source      IP/port: 192.168.100.2/225

  Destination IP/port: 100.100.100.100/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: Route-Aggregation1.10

  Source security zone: Trust

Responder:

  Source      IP/port: 100.100.100.100/225

  Destination IP/port: 192.168.100.2/0

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: Route-Aggregation1.20

  Source security zone: Untrust

State: ICMP_REPLY

Application: ICMP

Rule ID: 0

Rule name: permit-all

Start time: 2020-04-30 03:10:17  TTL: 26s

Initiator->Responder:            0 packets          0 bytes

Responder->Initiator:            0 packets          0 bytes

Total sessions found: 1

當防火牆故障的時候，track使靜態路由失效

%Apr 30 03:25:36:153 2020 SW NQA/6/NQA_ENTRY_PROBE_RESULT: Reaction entry 1 of NQA entry admin-name fw operation-tag 1: probe-fail.

dis track 1

Track ID: 1

  State: Negative

  Duration: 0 days 0 hours 0 minutes 15 seconds

  Tracked object type: NQA

  Notification delay: Positive 0, Negative 0 (in seconds)

  Tracked object:

    NQA entry: fw 1

    Reaction: 1

    Remote IP/URL: 192.168.10.1                                               

    Local IP: --                                                          

    Interface: --

%Apr 30 03:25:41:279 2020 RT NQA/6/NQA_ENTRY_PROBE_RESULT: Reaction entry 1 of NQA entry admin-name fw operation-tag 1: probe-fail.

dis track 1

Track ID: 1

  State: Negative

  Duration: 0 days 0 hours 2 minutes 43 seconds

  Tracked object type: NQA

  Notification delay: Positive 0, Negative 0 (in seconds)

  Tracked object:

    NQA entry: fw 1

    Reaction: 1

    Remote IP/URL: 192.168.20.1                                               

    Local IP: --                                                          

    Interface: --

此時看靜態路由，發現SW、RT的路由已切換不走防火牆

dis ip ro

Destinations : 21       Routes : 21

Destination/Mask   Proto   Pre Cost        NextHop         Interface

0.0.0.0/0          Static  70  0           192.168.20.3    Vlan20

......

dis ip ro

Destinations : 14       Routes : 14

......

192.168.100.0/24   Static  70  0           192.168.20.2    GE0/0

......

PC仍然能夠ping通100.100.100.100

ping 100.100.100.100

Ping 100.100.100.100 (100.100.100.100): 56 data bytes, press CTRL_C to break

56 bytes from 100.100.100.100: icmp_seq=0 ttl=254 time=2.000 ms

56 bytes from 100.100.100.100: icmp_seq=1 ttl=254 time=1.000 ms

56 bytes from 100.100.100.100: icmp_seq=2 ttl=254 time=1.000 ms

56 bytes from 100.100.100.100: icmp_seq=3 ttl=254 time=1.000 ms

56 bytes from 100.100.100.100: icmp_seq=4 ttl=254 time=2.000 ms

--- Ping statistics for 100.100.100.100 ---

5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss

round-trip min/avg/max/std-dev = 1.000/1.400/2.000/0.490 ms

此時由於流量不經過防火牆，防火牆上沒有會話

[FW-Route-Aggregation1.10]dis session table ipv4 source-ip 192.168.100.2 destination-ip 100.100.100.100 verbose

Slot 1:

Total sessions found: 0