華三防火牆IRF冗餘組對接單台路由器，路由器不支持二層，隻能三層對接，三角形組網，如何對接

搖人 溝通方案可行性吧

另外不是所有防火牆都支持irf，而且也不推薦開局了。

可以啊，防火牆支持三層冗餘組，參考案例：

2.13.2  工作在三層，上下行分別連接一台設備

1. 組網需求

·     如圖2-7所示，Device A和Device B組成IRF，Device A和Device B分別用一個接口組建成冗餘接口，連接上行設備Device C；再分別用一個接口組建成冗餘接口，連接下行設備Device D。

·     Device C使用VLAN接口連接Device A和Device B，Device D也使用VLAN接口連接Device A和Device B。

·     正常情況下，流量走Device D——Device A——Device C；當這條通道上的任一鏈路或者設備故障時，流量切換到Device D——Device B——Device C。正常通道故障恢複時，流量再切回。

2. 組網圖

圖2-7 配置組網圖

3. 配置步驟

(1)     配置IRF

IRF的配置請參見“工作在三層，上下行分別連接兩台路由器，兩台路由器接口不在同一網段

”。

(2)     配置以太網冗餘接口

# 創建Reth1，IP地址為1.1.1.2/24，成員接口為GigabitEthernet1/0/1和GigabitEthernet2/0/1，其中GigabitEthernet1/0/1的優先級為255，GigabitEthernet2/0/1的優先級為50。

<DeviceA> system-view

[DeviceA] interface reth 1

[DeviceA-Reth1] ip address 1.1.1.2 24

[DeviceA-Reth1] member interface gigabitethernet 1/0/1 priority 255

[DeviceA-Reth1] member interface gigabitethernet 2/0/1 priority 50

[DeviceA-Reth1] quit

# 創建Reth2，IP地址為2.2.2.2/24，成員接口為GigabitEthernet1/0/2和GigabitEthernet2/0/2，其中GigabitEthernet1/0/2的優先級為255，GigabitEthernet2/0/2的優先級為50。

[DeviceA] interface reth 2

[DeviceA-Reth2] ip address 2.2.2.2 24

[DeviceA-Reth2] member interface gigabitethernet 1/0/2 priority 255

[DeviceA-Reth2] member interface gigabitethernet 2/0/2 priority 50

[DeviceA-Reth2] quit

(3)     配置Track，監測上、下行接口的狀態。

[DeviceA] track 1 interface gigabitethernet 1/0/1 physical

[DeviceA-track-1] quit

[DeviceA] track 2 interface gigabitethernet 1/0/2 physical

[DeviceA-track-2] quit

[DeviceA] track 3 interface gigabitethernet 2/0/1 physical

[DeviceA-track-3] quit

[DeviceA] track 4 interface gigabitethernet 2/0/2 physical

[DeviceA-track-4] quit

(4)     配置冗餘組

# 創建Node 1，Node 1和Device A綁定，為主節點。關聯的Track項為1和2。

[DeviceA] redundancy group aaa

[DeviceA-redundancy-group-aaa] node 1

[DeviceA-redundancy-group-aaa-node1] bind slot 1

[DeviceA-redundancy-group-aaa-node1] priority 100

[DeviceA-redundancy-group-aaa-node1] track 1 interface gigabitethernet 1/0/1

[DeviceA-redundancy-group-aaa-node1] track 2 interface gigabitethernet 1/0/2

[DeviceA-redundancy-group-aaa-node1] quit

# 創建Node 2，Node 2和Device B綁定，為備節點。關聯的Track項為3和4。

[DeviceA-redundancy-group-aaa] node 2

[DeviceA-redundancy-group-aaa-node2] bind slot 2

[DeviceA-redundancy-group-aaa-node2] priority 50

[DeviceA-redundancy-group-aaa-node2] track 3 interface gigabitethernet 2/0/1

[DeviceA-redundancy-group-aaa-node2] track 4 interface gigabitethernet 2/0/2

[DeviceA-redundancy-group-aaa-node2] quit

# 將Reth1和Reth2添加到冗餘組中。

[DeviceA-redundancy-group-aaa] member interface reth 1

[DeviceA-redundancy-group-aaa] member interface reth 2

[DeviceA-redundancy-group-aaa] quit

(5)     配置靜態路由

本舉例僅以靜態路由方式配置路由信息。實際組網中，請根據具體情況選擇相應的路由配置方式。

# 請根據組網圖中規劃的信息，配置靜態路由。本舉例假設LAN的網段為3.3.3.0/24，實際使用中請以具體組網情況為準，具體配置步驟如下。

[DeviceA] ip route-static 0.0.0.0 0 1.1.1.1

[DeviceA] ip route-static 3.3.3.0 24 2.2.2.1

(6)     配置接口加入安全域

# 請根據組網圖中規劃的信息，將接口加入對應的安全域，具體配置步驟如下。

[DeviceA] security-zone name untrust

[DeviceA-security-zone-Untrust] import interface reth 1

[DeviceA-security-zone-Untrust] quit

[DeviceA] security-zone name trust

[DeviceA-security-zone-Trust] import interface reth 2

[DeviceA-security-zone-Trust] quit

(7)     配置安全策略

# 配置名稱為trust-untrust的安全策略規則，使LAN中的主機可以訪問外網，具體配置步驟如下。

[DeviceA] security-policy ip

[DeviceA-security-policy-ip] rule 1 name trust-untrust

[DeviceA-security-policy-ip-1-trust-untrust] source-zone trust

[DeviceA-security-policy-ip-1-trust-untrust] destination-zone untrust

[DeviceA-security-policy-ip-1-trust-untrust] source-ip-subnet 3.3.3.0 24

[DeviceA-security-policy-ip-1-trust-untrust] action pass

[DeviceA-security-policy-ip-1-trust-untrust] quit

[DeviceA-security-policy-ip] quit

4. 驗證配置