VRRP、Track与NQA联动配置举例

1、VRRP、Track与NQA联动配置举例组网需求HostA需要访问Internet上的HostB,HostA的缺省网关为10.1.1.10/24；SecPathA和SecPathB属于虚拟IP地址为10.1.1.10的备份组1；当SecPathA正常工作时,HostA发送给HostB的报文通过SecPathA转发；当通过NQA监测到SecPathA上行链路不通时，HostA发送给HostB的报文通过SecPathB转发。组网图VirtualIPaddress:10.1.1.10/24VRRP、Track与NQA联动配置组网图配置步骤按照图1-2配置各接口的IP地址，具体配置过程略。在SecPa

2、thA上配置NQA测试组system-view#创建管理员名为admin、操作标签为test的NQA测试组。SecPathAnqaentryadmintest配置测试类型为ICMP-echo。SecPathA-nqa-admin-testtypeicmp-echo配置目的地址为10.1.2.2。SecPathA-nqa-admin-test-icmp-echodestinationip10.1.2.2#测试频率为100ms。SecPathA-nqa-admin-test-icmp-echofrequency100配置联动项1（连续失败5次触发联动）。SecPathA-nqa-admin-tes

3、t-icmp-echoreaction1checked-elementprobe-failthreshold-typeconsecutive5action-typetrigger-onlySecPathA-nqa-admin-test-icmp-echoquit启动探测。SecPathAnqascheduleadminteststart-timenowlifetimeforever在SecPathA上配置Track项#配置Track项1,关联NQA测试组（管理员为admin,操作标签为test）的联动项1。SecPathAtrack1nqaentryadmintestreaction1在Sec

4、PathA上配置VRRP#创建备份组1,并配置备份组1的虚拟IP地址为10.1.1.10。SecPathAinterfacegigabitethernet0/0SecPathA-GigabitEthernet0/0vrrpvrid1virtual-ip10.1.1.10#设置SecPathA在备份组1中的优先级为110。SecPathA-GigabitEthernet0/0vrrpvrid1priority110#设置备份组的认证方式为SIMPLE，认证字为hello。SecPathA-GigabitEthernet0/0vrrpvrid1authentication-modesimplehe

5、llo#设置Master防火墙发送VRRP报文的间隔时间为5秒。SecPathA-GigabitEthernet0/0vrrpvrid1timeradvertise5#设置SecPathA工作在抢占方式，抢占延迟时间为5秒。SecPathA-GigabitEthernet0/0vrrpvrid1preempt-modetimerdelay5#设置监视Track项。SecPathA-GigabitEthernet0/0vrrpvrid1track1reduced30在SecPathB上配置VRRPsystem-viewSecPathBinterfacegigabitethernet0/0#创建备

6、份组1,并配置备份组1的虚拟IP地址为10.1.1.10。SecPathB-GigabitEthernet0/0vrrpvrid1virtual-ip10.1.1.10#设置备份组的认证方式为SIMPLE，认证字为hellooSecPathB-GigabitEthernet0/0vrrpvrid1authentication-modesimplehello#设置Master防火墙发送VRRP报文的间隔时间为5秒。SecPathB-GigabitEthernet0/0vrrpvrid1timeradvertise5#设置SecPathB工作在抢占方式，抢占延迟时间为5秒。SecPathB-Gig

7、abitEthernet0/0vrrpvrid1preempt-modetimerdelay5验证配置结果配置完成后，在HostA上可以ping通HostB。通过displayvrrp命令查看配置后的结果。#显示SecPathA上备份组1的详细信息。SecPathA-GigabitEthernet0/0displayvrrpverboseIPv4StandbyInformation:RunMethod:VIRTUAL-MACVirtualIPPing:EnableTotalnumberofvirtualrouters:1Interface:GigabitEthernet0/0VRID1Adve

8、r.Timer:5AdminStatusUPStateMasterConfigPri110RunPri110PreemptModeYESDelayTime5AuthTypeSIMPLETEXTKeyhelloTrackObject:1PriReduced:0VirtualIP:10.1.1.10VirtualMAC:0000-5e00-0101MasterIP:10.1.1.1#显示SecPathB上备份组1的详细信息。SecPathB-GigabitEthernet0/0displayvrrpverboseIPv4StandbyInformation:RunMethodVIRTUAL-MAC

9、VirtualIPPingEnableTotalnumberofvirtualrouters:1InterfaceGigabitEthernet0/0VRID1Adver.Timer5AdminStatusUPStateBackupConfigPri100RunPri100PreemptModeYESDelayTime5AuthTypeSIMPLETEXTKeyhelloVirtualIP10.1.1.10MasterIP10.1.1.1以上显示信息表示在备份组1中SecPathA为Master防火墙，SecPathB为Backup防火墙，HostA发送给HostB的报文通过SecPathA转

10、发。SecPathA与SecPathC不通时，在HostA上仍然可以ping通HostB。通过displayvrrp命令查看备份组的信息。#SecPathA与SecPathC不通时，显示SecPathA上备份组1的详细信息。SecPathA-GigabitEthernet0/0displayvrrpverboseIPv4StandbyInformation:RunMethod:VIRTUAL-MACVirtualIPPing:EnableTotalnumberofvirtualrouters:1Interface:GigabitEthernet0/0VRID1Adver.Timer:5Admi

11、nStatusUPStateBackupConfigPri110RunPri80PreemptModeYESDelayTime5AuthTypeSIMPLETEXTKeyhelloTrackObject1PriReduced30VirtualIP10.1.1.10MasterIP:10.1.1.2#SecPathA与SecPathC不通时，显示SecPathB上备份组1的详细信息。SecPathB-GigabitEthernet0/0displayvrrpverboseIPv4StandbyInformation:RunMethod:VIRTUAL-MACVirtualIPPingEnableTotalnumberofvirtualrouters:1InterfaceGigabitEthernet0/0VRID1Adver.Timer5AdminStatusUPStateMasterConfigPri100RunPri100PreemptModeYESDelayTime5AuthTypeSIM