【正文】 添加接口至對應(yīng)區(qū)域[Eudemon B]firewall zone trust[Eudemon Bzonetrust]add interface GigabitEthernet 0/0/0[Eudemon Bzonetrust]quit[Eudemon B]firewall zone dmz[Eudemon Bzonedmz]add interface GigabitEthernet 0/0/1[Eudemon Bzonedmz]quit[Eudemon B]firewall zone untrust[Eudemon Bzoneuntrust]add interface GigabitEthernet 0/0/2[Eudemon Bzoneuntrust]quit配置VRRP備份組，并指定備份組所屬的管理組。 實驗結(jié)果驗證實驗結(jié)果驗證一：通過命令display vrrp查看VRRP備份組的狀態(tài)。s config state is: MASTER Current state of virtual routers configured as master: GigabitEthernet0/0/2 vrid 2 : master GigabitEthernet0/0/1 vrid 3 : master GigabitEthernet0/0/0 vrid 1 : master Current state of virtual routers configured as slave: GigabitEthernet0/0/2 vrid 5 : slave GigabitEthernet0/0/1 vrid 6 : slave GigabitEthernet0/0/0 vrid 4 : slaveHRP_S[Eudemon B]display hrp state The firewall39。HRP_M[Eudemon A]display hrp group Master group status: Group enabled: yes State: master Priority running: 65001 Total VRRP members: 3 Hello interval(ms): 1000 Preempt delay(s): 30 Peer group available: 1 Peer39。s member same: yes實驗結(jié)果驗證四：在PC1上執(zhí)行“ping –t ”，宕掉Eudemon A的接口GE0/0/2，觀察防火墻的主備倒換以及對數(shù)據(jù)包轉(zhuǎn)發(fā)的影響。實驗要求：完成防火墻雙機熱備配置，使PC1可以ping通PC2，PC2無法ping通PC1。VRP vrrp vrid virtualrouterID virtualip virtualaddress [ ipmask | ipmasklength ] { slave | master }使能HRP功能?？梢詤⒖济钚惺謨浴?2) 配置VRRP備份組并制定備份組所屬的管理組。配置工作在透明模式的接口[Eudemon A] interface gigabitethernet 0/0/0[Eudemon AGigabitEthernet 0/0/0] portswitch[Eudemon AGigabitEthernet 0/0/0] quit[Eudemon A] interface gigabitethernet 0/0/2[Eudemon AGigabitEthernet 0/0/2] portswitch[Eudemon AGigabitEthernet 0/0/2] quit添加接口至對應(yīng)區(qū)域[Eudemon A]firewall zone trust[Eudemon Azonetrust]add interface GigabitEthernet 0/0/0[Eudemon Azonetrust]quit[Eudemon A]firewall zone dmz[Eudemon Azonedmz]add interface GigabitEthernet 0/0/1[Eudemon Azonedmz]quit[Eudemon A]firewall zone untrust[Eudemon Azoneuntrust]add interface GigabitEthernet 0/0/2[Eudemon Azoneuntrust]quit配置local區(qū)域和dmz區(qū)域的域間包過濾規(guī)則，以便VRRP報文、VGMP報文和HRP報文能夠通過心跳接口正常交互。配置工作在透明模式的接口[Eudemon A] interface gigabitethernet 0/0/0[Eudemon AGigabitEthernet 0/0/0] portswitch[Eudemon AGigabitEthernet 0/0/0] quit[Eudemon A] interface gigabitethernet 0/0/2[Eudemon AGigabitEthernet 0/0/2] portswitch[Eudemon AGigabitEthernet 0/0/2] quit添加接口至對應(yīng)區(qū)域[Eudemon B]firewall zone trust[Eudemon Bzonetrust]add interface GigabitEthernet 0/0/0[Eudemon Bzonetrust]quit[Eudemon B]firewall zone dmz[Eudemon Bzonedmz]add interface GigabitEthernet 0/0/1[Eudemon Bzonedmz]quit[Eudemon B]firewall zone untrust[Eudemon Bzoneuntrust]add interface GigabitEthernet 0/0/2[Eudemon Bzoneuntrust]quit配置local區(qū)域和dmz區(qū)域的域間包過濾規(guī)則，以便VRRP報文、VGMP報文和HRP報文能夠通過心跳接口正常交互。PC機IP地址的配置此處不再贅述。HRP_M[Eudemon A]display hrp state The firewall39。s config state is: SLAVE Current state of virtual routers configured as slave: GigabitEthernet0/0/1 vrid 1 : slave從以上顯示信息可以看出，在Eudemon A上，VRRP備份組1屬于Master管理組，狀態(tài)為Master；在Eudemon B上，VRRP備份組1屬于Slave管理組，狀態(tài)為Slave。HRP_M[Eudemon A]display vrrp GigabitEthernet0/0/1 | Virtual Router 1 state : Master Virtual IP : PriorityRun : 100 PriorityConfig : 100 MasterPriority : 100 Preempt : YES Delay Time : 0 Timer : 1 Auth Type : NONE Check TTL : YESHRP_S[Eudemon B]display vrrpGigabitEthernet0/0/1 | Virtual Router 1 state : Backup Virtual IP : PriorityRun : 100 PriorityConfig : 100 MasterPriority : 100 Preempt : YES Delay Time : 0 Timer : 1 Auth Type : NONE Check TTL : YES通過以上結(jié)果可知， Eudemon A在備份組1中都處于Master狀態(tài)；Eudemon B在備份組1中都處于Backup狀態(tài)。[Eudemon B] vlan 2[Eudemon Bvlan2]port interface GigabitEthernet 0/0/0[Eudemon Bvlan2]port interface GigabitEthernet 0/0/2[Eudemon Bvlan2]hrp track slave配置HRP備份通道。[Eudemon A] vlan 2[Eudemon Avlan2]port interface GigabitEthernet 0/0/0[Eudemon Avlan2]port interface GigabitEthernet 0/0/2[Eudemon Avlan2]hrp track master配置HRP備份通道。(4) 使能配置命令和連接狀態(tài)的自動備份功能。印刷時上段話刪除。VRP hrp interface interfacetype interfacenumber transferonly使能配置命令和連接狀態(tài)的自動備份。查看主備防火墻倒換對于從PC1發(fā)往PC2的數(shù)據(jù)包的影響。注意：防火墻上下行端口工作在透明模式，無法配置IP地址，故PC1和PC2的IP地址應(yīng)屬于相同網(wǎng)段。s member same: yesHRP_S[Eudemon B]display hrp group Master group status: Group enabled: yes State: master Priority running: 65001 Total VRRP members: 3 Hello interval(ms): 1000 Preempt delay(s): 30 Peer group available: 1 Peer39。也就是說，在每臺防火墻上都存在Master和Slave兩個管理組，管理組中處于Master狀態(tài)的備份組負責(zé)轉(zhuǎn)發(fā)數(shù)據(jù)，而處于Slave狀態(tài)的備份組接收處于Master狀態(tài)的備份組發(fā)出的VGMP報文和HRP報文。實驗結(jié)果驗證二：通過命令display hrp state查看HRP管理組的狀態(tài)。[Eudemon B]acl 2000[Eudemon Baclbasic2000]rule permit source [Eudemon Baclbasic2000]quit[Eudemon B]firewall interzone local dmz[Eudemon Binterzonelocaldmz]packetfilter 2000 inbound[Eudemon Binterzonelocaldmz]packetfilter 2000 outbound配置HRP備份通道。[Eudemon A]interface GigabitEthernet 0/0/0[Eudemon AGigabitEthernet0/0/0]vrrp vrid 1 virtualip master[Eudemon AGigabitEthernet0/0/0]vrrp vrid 4 virtualip slave[Eudemon A]quit[Eudemon A]interface GigabitEthernet 0/0/1[Eudemon AGigabitEthernet0/0/1]vrrp vrid 2 virtualip master[Eudemon AGigabitEthernet0/0/1]vrrp vrid 5 virtualip slave[Eudemon A]quit[Eudemon A]interface GigabitEthernet 0/0/2[Eudemon AGigabitEthernet0/0/2]vrrp vrid 3 virtualip master[Eudemon AGigabitEthernet0/0/2]vrrp vrid 6 virtualip slave配置local區(qū)域和dmz區(qū)域的域間包過濾規(guī)則，以便VRRP報文、VGMP報文和HRP報文能夠通過心跳接口正常交互。(2) 配置VRRP備份組并制定備份組所屬的管理組?？梢詤⒖济钚惺謨?。VRP