介绍了业务接口工作在二层，上下行连接交换机的主备备份组网的Web举例。
组网需求
如图1所示，两台FW的业务接口都工作在二层，上下行分别连接交换机。FW的上下行业务接口都加入到VLAN10和VLAN20中。
现在希望两台FW以主备备份方式工作。正常情况下，流量通过FW_A转发。当FW_A出现故障时，流量通过FW_B转发，保证业务不中断。
结果验证
选择，查看双机热备的运行情况。
- 正常情况下，FW_A的“当前运行模式”为“主备备份”，“当前运行角色”为“主用”；FW_B的“当前运行模式”为“主备备份”，“当前运行角色”为“备用”。这说明流量FW_A转发。
- 当FW_A出现故障时，FW_A的“当前运行模式”为“主备备份”，“当前运行角色”为“备用”；FW_B的“当前运行模式”为“主备备份”，“当前运行角色”为“主用”。这说明流量通过FW_B转发。
配置脚本
|
FW_A |
FW_B |
|---|---|
#
sysname FW_A
#
vlan batch 10 20
#
hrp enable
hrp interface GigabitEthernet1/0/2 remote 10.10.0.2
hrp track vlan 10
hrp track vlan 20
#
interface GigabitEthernet1/0/3
portswitch
port link-type trunk
port trunk allow-pass vlan 10 20
undo port trunk allow-pass vlan 1
#
interface GigabitEthernet1/0/7
portswitch
port link-type trunk
port trunk allow-pass vlan 10 20
undo port trunk allow-pass vlan 1
#
interface GigabitEthernet1/0/2
ip address 10.10.0.1 255.255.255.0
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/7
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/3
#
firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/2
#
security-policy
rule name policy_sec
source-zone trust
destination-zone untrust
action permit
|
#
sysname FW_B
#
vlan batch 10 20
#
hrp enable
hrp interface GigabitEthernet1/0/2 remote 10.10.0.1
hrp track vlan 10
hrp track vlan 20
hrp standby-device
#
interface GigabitEthernet1/0/3
portswitch
port link-type trunk
port trunk allow-pass vlan 10 20
undo port trunk allow-pass vlan 1
#
interface GigabitEthernet1/0/7
portswitch
port link-type trunk
port trunk allow-pass vlan 10 20
undo port trunk allow-pass vlan 1
#
interface GigabitEthernet1/0/2
ip address 10.10.0.2 255.255.255.0
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/7
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/3
#
firewall zone dmz
set priority 50
add interface GigabitEthernet1/0/2
#
security-policy
rule name policy_sec
source-zone trust
destination-zone untrust
action permit
|