hcie-安全胶片优化完成hc高可用

修订记录课程编码适用产品产品版本课程版本ISSUEHC13031065USG6000V1R1V1.0开发/优化者时间审核人开发类型（新开发/优化）戴鑫2014-08-15王锐开发姚传哲2014-09-15王锐优化丁祖贤2015-3-30优化本页不打印HC13031065

VPN高可用目标学完本课程后，您将能够:了解VPN高可用性的工作原理和关键技术掌握设备级别的高可用和链路级别的高可用性的配置方式了解几种高可用性部署的优缺点对于不同的需求给出最合理的部署方式目录链路冗余1.1“主备”/“主主”链路冗余1.2隧道化链路冗余1.3全网状网络设备冗余链路冗余1.2 隧道化链路备份（推荐）将IPSec策略应用到Tunnel接口上，IPSec策略跟具体的物理接口没有绑定关系，从而实现出接口链路的备份。当一条链路出现问题时，可直接路由到其他链路传输。1.1 “主主”“主备”链路冗余一般情况下，主用IPSec隧道采用以太网链路固定IP接入，备用IPSec隧道采用以太网链路或拨号链路（PPPoE/ADSL/3G）接入均可。主用链路故障时业务倒换到备用链路。“主备”链路冗余拓扑和需求（物理口建VPN）需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个物理接口分别应用不同的IPSec策略需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：通过静态路由或者动态路由，以及IP-Link引导流量。“主备”链路冗余拓扑和需求（物理口建VPN）需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个tunnel接口分别应用不同的IPSec策略。（隧道化）需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：网关A和网关B分别通过静态路由或者动态路由，以及IP-Link引导流量。“主主”链路冗余拓扑和需求（物理口建VPN）需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个tunnel接口分别应用不同的IPSec策略。需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：网关A和网关B分别通过静态路由或者动态路由，以及IP-Link引导流量。“主主”链路冗余拓扑和需求（物理口建VPN）需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个tunnel接口分别应用不同的IPSec策略。（隧道化）需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：通过静态路由或者动态路由，以及IP-Link引导流量。“主主/主备”链路冗余拓扑（Loopback口建VPN）需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A和网关B

Loopback接口分别应用IPSec策略。配置：Loopback接口要配置公网地址。需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：Loopback接口地址发布到两个出口ISP中，并通过静态路由或者动态路由，以及IP-Link引导流量。CaseStudy1：主备链路冗余拓扑和需求需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A的两个物理接口分别应用不同的IPSec策略。网关B的两个tunnel接口分别应用不同的IPSec策略。（隧道化）需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：通过静态路由或者动态路由，以及IP-Link引导流量。基本网络配置(路由器)sysnameSite1-Server#

interfaceGigabitEthernet0/0/0ipaddress192.168.1.1255.255.255.0#

iproute-static0.0.0.00.0.0.0192.168.1.254sysnameInternet#

interfaceGigabitEthernet0/0/0ipaddress202.101.1.254255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.100.1.254255.255.255.0#interfaceGigabitEthernet0/0/2ipaddress202.100.2.254255.255.255.0

sysnameSite2-Server#

interfaceGigabitEthernet0/0/0ipaddress10.1.1.1255.255.255.0#

iproute-static0.0.0.00.0.0.010.1.1.254基本网络配置(防火墙)sysnameSite1#

interfaceGigabitEthernet0/0/0ipaddress192.168.1.254255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.100.1.1255.255.255.0#interfaceGigabitEthernet0/0/2ipaddress202.100.2.1255.255.255.0#firewallzoneuntrustaddinterfaceGigabitEthernet0/0/1addinterfaceGigabitEthernet0/0/2sysnameSite2#

interfaceGigabitEthernet0/0/0ipaddress10.1.1.254255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.101.1.1255.255.255.0#

iproute-static0.0.0.00.0.0.0202.101.1.254#firewallzoneuntrustaddinterfaceGigabitEthernet0/0/1Site1配置

双链路的IP-Link和相关路由ip-linkcheckenableip-link1destination202.101.1.1interfaceg0/0/1modeicmpnext-hop202.100.1.1#iproute-static0.0.0.00.0.0.0202.100.1.254preference10trackip-link1iproute-static0.0.0.00.0.0.0202.100.2.254preference20Site1配置

域间策略放行相关加密流量security-policyrulenamepolicy_ipsec_1source-zonetrust

destination-zoneuntrust

source-address192.168.1.024

destination-address10.1.1.024

actionpermit

rulenamepolicy_ipsec_2

source-zoneuntrust

destination-zonetrust

source-address10.1.1.024

destination-address192.168.1.024

actionpermitSite1配置

域间策略放行相关IKE流量rulenamepolicy_ipsec_3

source-zonelocal

destination-zoneuntrust

source-address202.100.1.132

source-address202.100.2.132

destination-address202.101.1.132

actionpermit

rulenamepolicy_ipsec_4

source-zoneuntrust

destination-zonelocal

source-address202.101.1.132

destination-address202.100.1.132

destination-address202.100.2.132

actionpermitSite1配置ACL定义需要保护的流量#aclnumber3000rule5permitipsource192.168.1.00.0.0.255destination10.1.1.00.0.0.255#aclnumber3001rule5permitipsource192.168.1.00.0.0.255destination10.1.1.00.0.0.255Site1配置VPN安全提议ikeproposal10authentication-methodpre-shareauthentication-algorithmsha1#ipsecproposaltrans1espauthentication-algorithmsha1espencryption-algorithmaesencapsulation-modetunnelSite1配置IKEPeerikepeersite2pre-shared-keyKey123ike-proposal10undoversion2remote-address202.101.1.1Site1配置IPsec安全策略组ipsecpolicymap110isakmpsecurityacl3000ike-peersite2proposaltrans1#ipsecpolicymap210isakmpsecurityacl3001ike-peersite2proposaltrans1Site1接口调用相关安全策略组interfaceGigabitEthernet0/0/1ipsecpolicymap1auto-neg#interfaceGigabitEthernet0/0/2ipsecpolicymap2auto-negSite2配置

两个Tunnel接口用于建立VPNinterfaceTunnel1ipaddressunnumberedinterfaceGigabitEthernet0/0/1

tunnel-protocolipsec#interfaceTunnel2ipaddressunnumberedinterfaceGigabitEthernet0/0/1

tunnel-protocolipsec#firewallzoneuntrustaddinterfaceTunnel1addinterfaceTunnel2Site2配置

域间策略放行相关加密流量security-policyrulenamepolicy_ipsec_1source-zonetrust

destination-zoneuntrust

source-address10.1.1.024

destination-address192.168.1.024

actionpermit

rulenamepolicy_ipsec_2

source-zoneuntrust

destination-zonetrust

source-address192.168.1.024

destination-address10.1.1.024

actionpermitSite2配置

域间策略放行相关IKE流量rulenamepolicy_ipsec_3

source-zonelocal

destination-zoneuntrust

source-address202.101.1.132

destination-address202.100.1.132destination-address202.100.2.132

actionpermit

rulenamepolicy_ipsec_4

source-zoneuntrust

destination-zonelocal

source-address202.100.1.132source-address202.100.2.132

destination-address202.101.1.132actionpermitSite2配置

双链路的IP-Link和相关路由ip-linkcheckenableip-link1destination202.100.1.1interfaceg0/0/1modeicmpnext-hop202.101.1.1#iproute-static192.168.1.0255.255.255.0Tunnel1preference10trackip-link1iproute-static192.168.1.0255.255.255.0Tunnel2preference20Site2配置ACL定义需要保护的流量#aclnumber3000rulepermitipsource10.1.1.00.0.0.255destination192.168.1.00.0.0.255#aclnumber3001rulepermitipsource10.1.1.00.0.0.255destination192.168.1.00.0.0.255Site2配置VPN安全提议ikeproposal10authentication-methodpre-shareauthentication-algorithmsha1#ipsecproposaltrans1espauthentication-algorithmsha1espencryption-algorithmaesencapsulation-modetunnelSite2配置IKEPeerikepeersite1apre-shared-keyKey123ike-proposal10undoversion2remote-address202.100.1.1#ikepeersite1bpre-shared-keyKey123ike-proposal10undoversion2remote-address202.100.2.1Site2配置IPsec安全策略组ipsecpolicymap110isakmpsecurityacl3000ike-peersite1aproposaltrans1#ipsecpolicymap210isakmpsecurityacl3001ike-peersite1bproposaltrans1Site2接口调用相关安全策略组interfaceTunnel1ipsecpolicymap1#interfaceTunnel2ipsecpolicymap2目录链路冗余1.1主备”/“主主”链路冗余1.2隧道化链路冗余1.3全网状网络设备冗余“主主/主备”链路冗余拓扑（隧道化VPN）需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A使用Tunnel隧道化技术建立一个VPN隧道。

网关B使用物理接口建立一个VPN隧道。需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。IPSec隧道不需要进行重协商，故可快速完成流量切换。配置：通过静态路由或者动态路由，以及IP-Link引导流量至Tunnel隧道接口。CaseStudy2：隧道化链路备份拓扑和需求需求1：Site1有两个出口接入不同的ISP中，Site2只有一个出口之间配置：网关A的tunnel接口应用IPSec策略。（隧道化）网关B的物理接口应用IPSec策略。需求2：通过Site1上的主链路发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：网关A通过静态路由或者动态路由，以及IP-Link引导流量。基本网络配置(路由器)sysnameSite1-Server#

interfaceGigabitEthernet0/0/0ipaddress192.168.1.1255.255.255.0#

iproute-static0.0.0.00.0.0.0192.168.1.254sysnameInternet#

interfaceGigabitEthernet0/0/0ipaddress202.101.1.254255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.100.1.254255.255.255.0#interfaceGigabitEthernet0/0/2ipaddress202.100.2.254255.255.255.0

sysnameSite2-Server#

interfaceGigabitEthernet0/0/0ipaddress10.1.1.1255.255.255.0#

iproute-static0.0.0.00.0.0.010.1.1.254基本网络配置(防火墙)sysnameSite1#

interfaceGigabitEthernet0/0/0ipaddress192.168.1.254255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.100.1.1255.255.255.0#interfaceGigabitEthernet0/0/2ipaddress202.100.2.1255.255.255.0#firewallzoneuntrustaddinterfaceGigabitEthernet0/0/1addinterfaceGigabitEthernet0/0/2sysnameSite2#

interfaceGigabitEthernet0/0/0ipaddress10.1.1.254255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.101.1.1255.255.255.0#

iproute-static0.0.0.00.0.0.0202.101.1.254#firewallzoneuntrustaddinterfaceGigabitEthernet0/0/1Site1配置Tunnel接口用于建立VPNinterfaceTunnel1ipaddress1.1.1.124

tunnel-protocolipsec#firewallzoneuntrustaddinterfaceTunnel1Site1配置

双链路的IP-Link和相关路由ip-linkcheckenableip-link1destination202.101.1.1interfaceg0/0/1modeicmpnext-hop202.100.1.1#iproute-static202.101.1.1255.255.255.255202.100.1.254preference10trackip-link1iproute-static202.101.1.1255.255.255.255202.100.2.254preference20iproute-static10.1.1.0255.255.255.0tunnel1Site1配置

域间策略放行相关加密流量security-policyrulenamepolicy_ipsec_1source-zonetrust

destination-zoneuntrust

source-address192.168.1.024

destination-address10.1.1.024

actionpermit

rulenamepolicy_ipsec_2

source-zoneuntrust

destination-zonetrust

source-address10.1.1.024

destination-address192.168.1.024

actionpermitSite1配置

域间策略放行相关IKE流量rulenamepolicy_ipsec_3

source-zonelocal

destination-zoneuntrust

source-address202.100.1.132

source-address202.100.2.132source-address1.1.1.132

destination-address202.101.1.132

actionpermit

rulenamepolicy_ipsec_4

source-zoneuntrust

destination-zonelocal

source-address202.101.1.132

destination-address202.100.1.132

destination-address202.100.2.132destination-address1.1.1.132

actionpermitSite1配置ACL定义需要保护的流量#aclnumber3000rule5permitipsource192.168.1.00.0.0.255destination10.1.1.00.0.0.255#aclnumber3001rule5permitipsource192.168.1.00.0.0.255destination10.1.1.00.0.0.255Site1配置VPN安全提议ikeproposal10authentication-methodpre-shareauthentication-algorithmsha1#ipsecproposaltrans1espauthentication-algorithmsha1espencryption-algorithmaesencapsulation-modetunnelSite1配置IKEPeerikepeersite2pre-shared-keyKey123ike-proposal10undoversion2remote-address202.101.1.1Site1配置IPsec安全策略组ipsecpolicymap110isakmpsecurityacl3000ike-peersite2proposaltrans1Site1接口调用相关安全策略组interfaceTunnel1ipsecpolicymap1auto-neg#Site2配置

域间策略放行相关加密流量security-policyrulenamepolicy_ipsec_1source-zonetrust

destination-zoneuntrust

source-address10.1.1.024

destination-address192.168.1.024

actionpermit

rulenamepolicy_ipsec_2

source-zoneuntrust

destination-zonetrust

source-address192.168.1.024

destination-address10.1.1.024

actionpermitSite2配置

域间策略放行相关IKE流量rulenamepolicy_ipsec_3

source-zonelocal

destination-zoneuntrust

source-address202.101.1.132

destination-address202.100.1.132destination-address202.100.2.132

actionpermit

rulenamepolicy_ipsec_4

source-zoneuntrust

destination-zonelocal

source-address202.100.1.132source-address202.100.2.132

destination-address202.101.1.132actionpermitSite2配置ACL定义需要保护的流量#aclnumber3000rulepermitipsource10.1.1.00.0.0.255destination192.168.1.00.0.0.255#aclnumber3001rulepermitipsource10.1.1.00.0.0.255destination192.168.1.00.0.0.255Site2配置VPN安全提议ikeproposal10authentication-methodpre-shareauthentication-algorithmsha1#ipsecproposaltrans1espauthentication-algorithmsha1espencryption-algorithmaesencapsulation-modetunnelSite2配置IKEPeerikepeersite1apre-shared-keyKey123ike-proposal10undoversion2remote-address1.1.1.1Site2配置IPsec安全策略组ipsecpolicymap110isakmpsecurityacl3000ike-peersite1aproposaltrans1Site2接口调用相关安全策略组interfaceGigabitEthernet0/0/1ipsecpolicymap1#目录链路冗余1.1主备”/“主主”链路冗余1.2隧道化链路冗余1.3全网状网络设备冗余全网状网络如图所示，当网络中的所有节点之间都需要通信或者通信流量较大时，可采用网状结构建立VPN。所有节点都可以自行上网，任何节点Down掉都不影响其它节点。这种网络结构适用于同等重要的多个节点之间的互联。CaseStudy：全网状网络配置（Site1配置）ipsecpolicymap11isakmp

securityacl3000

ike-peerb

aliaspolicy1

proposalb

local-address202.38.163.1

#

ipsecpolicymap12isakmp

securityacl3001

ike-peeric

aliaspolicy2

proposalc

local-address202.38.163.1interfaceGigabitEthernet0/0/1ipsecpolicymap1

Site1网关关键配置和其他Site安全网关配置类似ikepeerb

exchange-modeauto

pre-shared-key%$%$c([VET@941t/q_4tS-f7,ri/%$%$

ike-proposal1

remote-id-typeip202.38.169.1

remote-address202.38.169.1

#

ikepeerc

exchange-modeauto

pre-shared-key%$%$c([VET@941t/q_4tS-f7,ri/%$%$

ike-proposal2

remote-id-typeip202.38.170.1

remote-address202.38.170.1

#

ipsecproposalb

encapsulation-modeauto

#

ipsecproposalc

encapsulation-modeauto

目录链路冗余设备冗余2.1IPSec网关主备备份设备冗余主备设备冗余IPSecVPN网关采用主备备份机制，当一台设备出现故障时，业务可以平滑的切换到备用设备上。IPSec网关主备备份需求：Site1有两个Gateway，两个Gateway分别有一个公网出口接入相同的ISP中，Site2只有一个公网出口。通过Site1上的设备发生故障时，业务可以自动切换到备链路；主链路恢复时，业务会自动回切到主链路。配置：Site2网关和Site1虚拟地址建立IPsec隧道。配置：Gateway1和Gateway2启用HA功能，对内网侧和外网侧分别并生成一个虚拟地址，外网侧的虚拟地址占用一个公网地址。基本网络配置(路由器)sysnameSite1-Server#

interfaceGigabitEthernet0/0/0ipaddress10.100.10.100255.255.255.0#

iproute-static0.0.0.00.0.0.010.100.10.1sysnameInternet#

interfaceGigabitEthernet0/0/0ipaddress202.10.1.254255.255.255.0#interfaceGigabitEthernet0/0/1ipaddress202.38.10.254255.255.255.0#sysnameSite2-Server#

interfaceGigabitEthernet0/0/0ipaddress10.6.1.100255.255.255.0#

iproute-static0.0.0.00.0.0.010.6.1.1基本网络配置(防火墙-Site1)sysnameGateway1#

firewallzonetrust

addinterfaceGigabitEthernet1/0/3

#

firewallzoneuntrust

addinterfaceGigabitEthernet1/0/2

#

firewallzonedmz

addinterfaceGigabitEthernet1/0/1#

interfaceGigabitEthernet1/0/1

ipaddress10.2.2.2255.255.255.0

#

interfaceGigabitEthernet1/0/2

ipaddress202.38.10.6255.255.255.0

#

interfaceGigabitEthernet1/0/3

ipaddress10.100.10.3255.255.255.0#

iproute-static0.0.0.00.0.0.0202.38.10.254

sysnameGateway2#

firewallzonetrust

addinterfaceGigabitEthernet1/0/3

#

firewallzoneuntrust

addinterfaceGigabitEthernet1/0/2

#

firewallzonedmz

addinterfaceGigabitEthernet1/0/1#

interfaceGigabitEthernet1/0/1

ipaddress10.2.2.3255.255.255.0

#

interfaceGigabitEthernet1/0/2

ipaddress202.38.10.5255.255.255.0

#

interfaceGigabitEthernet1/0/3

ipaddress10.100.10.4255.255.255.0#

iproute-static0.0.0.00.0.0.0202.38.10.254

基本网络配置(防火墙-Site2)sysnameSite2#

firewallzonetrust

addinterfaceGigabitEthernet1/0/3

#

firewallzoneuntrust

addinterfaceGigabitEthernet1/0/1

#

interfaceGigabitEthernet1/0/3

ipaddress10.6.1.1255.255.255.0

#

interfaceGigabitEthernet1/0/1

ipaddress202.10.1.2255.255.255.0#

iproute-static0.0.0.00.0.0.0202.10.1.254

Site1(Gateway1)配置

域间策略放行相关加密流量security-policy

rulenamepolicy_ipsec_2

source-zonetrust

destination-zoneuntrust

source-address10.100.10.024

destination-address10.6.1.024

actionpermit

rulenamepolicy_ipsec_3

source-zoneuntrust

destination-zonetrust

source-address10.6.1.024

destination-address10.100.10.024

actionpermit

Site1(Gateway1)配置

域间策略放行相关IKE流量security-policy

rulenamepolicy_ipsec_1

source-zonelocal

source-zonedmz

destination-zonelocal

destination-zonedmz

actionpermit

rulenamepolicy_ipsec_4

source-zoneuntrust

destination-zonelocal

source-address202.10.1.232

destination-address202.38.10.024

actionpermit

rulenamepolicy_ipsec_5

source-zonelocal

destination-zoneuntrust

source-address202.38.10.024

destination-address202.10.1.232

actionpermitSite1配置ACL定义需要保护的流量Gateway1：acl3003

rulepermitipsource10.100.10.00.0.0.255destination10.6.1.00.0.0.255

Gateway2：acl3003

rulepermitipsource10.100.10.00.0.0.255destination10.6.1.00.0.0.255Site1(Gateway1)配置VPN安全提议ikeproposal10authentication-methodpre-shareauthentication-algorithmsha1#ipsecproposaltrans1espauthentication-algorithmsha1espencryption-algorithmaesencapsulation-modetunnelSite1(Gateway1)配置IKEPeerikepeersite2pre-shared-keyKey123ike-proposal10undoversion2remote-address202.101.1.1Site1(Gateway1)配置IPsec安全策略组ipsecpolicymap110isakmpsecurityacl3000ike-peersite2proposaltrans1HA配置(防火墙-Site1)Gateway1:#

hrpenable

hrpinterfaceGigabitEthernet1/0/1

#

interfaceGigabitEthernet1/0/2

ipaddress202.38.10.6255.255.255.0

vrrpvrid2virtual-ip202.38.10.124active

ipsecpolicymap1auto-neg

#

interfaceGigabitEthernet1/0/3

ipaddress10.100.10.3255.255.255.0

vrrpvrid1virtual-ip10.100.10.224active

Gateway2:#

hrpenable

hrpinterfaceGigabitEthernet1/0/1

#

interfaceGigabitEthernet1/0/2

ipaddress202.38.10.5255.255.255.0

vrrpvrid2virtual-ip202.38.10.124standby

ipsecpolicymap1auto-neg#interfaceGigabitEthernet1/0/3

ipaddress10.100.10.4255.255.255.0

vrrpvrid1virtual-ip10.100.10.224standby

接口调用相关安全策略组接口调用相关安全策略组Site1(Gateway1)配置