需求sw3的流量正常sw1---FW1---sw1---R5故障sw2---FW2---sw2---R6sw4的流量正常sw2---FW2---sw2---R6故障sw1---FW1---sw1---R5sw1和sw2是核心层设备sw3和sw4是汇聚层设备纯三层设备ospf实现汇聚到核心的路由配置sw3基础配置sw3配置vlan[sw3]v b 2 3[sw3]int g0/0/3[sw3-GigabitEthernet0/0/3]po li t[sw3-GigabitEthernet0/0/3]po t a v 2 3[sw3-GigabitEthernet0/0/3]int g0/0/4[sw3-GigabitEthernet0/0/4]po li t[sw3-GigabitEthernet0/0/4]po t a v 2 3SW3开启生成树[sw3]stp region-configuration[sw3-mst-region]region-name aa[sw3-mst-region]instance 1 vlan 2[sw3-mst-region]instance 2 vlan 3[sw3-mst-region]active region-configurationsw3作为vlan2的主网关vlan3的备网关三点合一主网关主根桥汇聚层设备[sw3]stp instance 1 root primary[sw3]stp instance 2 root secondarysw3配置vrrp[sw3]interface Vlanif 2[sw3-Vlanif2]ip address 192.168.2.1 24[sw3-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254[sw3-Vlanif2]vrrp vrid 1 priority 120 作为主网关设置优先级为120默认为100[sw3-Vlanif2]vrrp vrid 1 preempt-mode timer delay 20 设置抢占延迟为20s默认立即抢占g0/0/1和g0/0/2两个接口都出现故障-----要进行vrrp网关切换1.主网关主动放弃主动降低优先级 2.出现故障上行链路监控同时监控两个接口-----当两个接口都出现问题的时候则直接切换为sw4[sw3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15[sw3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15[sw3]interface Vlanif 3[sw3-Vlanif3]ip add 192.168.3.1 24[sw3-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254sw4基础配置sw4配置vlan[sw4]v b 2 3[sw4]int g0/0/3[sw4-GigabitEthernet0/0/3]po li t[sw4-GigabitEthernet0/0/3]po t a v 2 3[sw4]int g0/0/4[sw4-GigabitEthernet0/0/4]po li t[sw4-GigabitEthernet0/0/4]po t a v 2 3配置stp生成树[sw4]stp region-configuration[sw4-mst-region]region-name aa[sw4-mst-region]instance 1 vlan 2[sw4-mst-region]instance 2 vlan 3[sw4-mst-region]active region-configuration[sw4]stp instance 1 root secondary[sw4]stp instance 2 root primary[sw4]interface Vlanif 2[sw4-Vlanif2]ip address 192.168.2.2 24[sw4-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254[sw4]interface Vlanif 3[sw4-Vlanif3]ip address 192.168.3.2 24[sw4-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254[sw4-Vlanif3]vrrp vrid 1 priority 120[sw4-Vlanif3]vrrp vrid 1 preempt-mode timer delay 20上行链路监控[sw4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15[sw4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15sw3和sw4查看vrrp信息[sw3]display vrrp brief VRID State Interface Type Virtual IP ---------------------------------------------------------------- 1 Master Vlanif2 Normal 192.168.2.254 1 Backup Vlanif3 Normal 192.168.3.254 ---------------------------------------------------------------- Total:2 Master:1 Backup:1 Non-active:0[sw4]display vrrp brief VRID State Interface Type Virtual IP ---------------------------------------------------------------- 1 Backup Vlanif2 Normal 192.168.2.254 1 Master Vlanif3 Normal 192.168.3.254 ---------------------------------------------------------------- Total:2 Master:1 Backup:1 Non-active:0sw5配置vlan信息[sw5]int g0/0/1[sw5-GigabitEthernet0/0/1]po li t[sw5-GigabitEthernet0/0/1]po t a v 2 3[sw5-GigabitEthernet0/0/1]int g0/0/2[sw5-GigabitEthernet0/0/2]po li t[sw5-GigabitEthernet0/0/2]po t a v 2 3[sw5-GigabitEthernet0/0/2]int g0/0/3[sw5-GigabitEthernet0/0/3]po li ac[sw5-GigabitEthernet0/0/3]po de v 2[sw5-GigabitEthernet0/0/3]int g0/0/4[sw5-GigabitEthernet0/0/4]po li ac[sw5-GigabitEthernet0/0/4]po de v 3[sw5]stp region-configuration[sw5-mst-region] region-name aa[sw5-mst-region] instance 1 vlan 2[sw5-mst-region] instance 2 vlan 3[sw5-mst-region] active region-configuration[sw5]display stp brief MSTID Port Role STP State Protection 0 GigabitEthernet0/0/1 ALTE DISCARDING NONE 0 GigabitEthernet0/0/2 ROOT FORWARDING NONE 0 GigabitEthernet0/0/3 DESI DISCARDING NONE 0 GigabitEthernet0/0/4 DESI DISCARDING NONE 1 GigabitEthernet0/0/1 ROOT FORWARDING NONE 根接口 1 GigabitEthernet0/0/2 ALTE DISCARDING NONE 被阻塞 1 GigabitEthernet0/0/3 DESI DISCARDING NONE 指定 2 GigabitEthernet0/0/1 ALTE DISCARDING NONE 被阻塞 2 GigabitEthernet0/0/2 ROOT FORWARDING NONE 根接口 2 GigabitEthernet0/0/4 DESI DISCARDING NONE 指定sw1---sw2VLAN 102 --- 10.10.2.0/24sw1---sw3VLAN 103 --- 10.10.3.0/24sw1---sw4VLAN 104 --- 10.10.4.0/24sw2---sw3VLAN 203 --- 10.20.3.0/24sw2---sw4VLAN 204 ---10.20.4.0/24交换机和交换机之间用trunk应用于二层设备四个交换机之间跑的是三层数据核心点是IP不在VLAN用vlan是要找一个可以配IP的接口重点是放通对应vlan传递IP地址即可所以用access向上发送报文不带vlan信息交换机sw3运行生成树vlan103在实例0中(默认运行mstp)四台交换机中都有实例0默认运行mstp有一部分信息会被阻塞因为有环。两种解决方法1关闭生成树2给每一个vlan划一个实例[sw3]v b 103 203[sw3]int GigabitEthernet 0/0/1[sw3-GigabitEthernet0/0/1]po li ac[sw3-GigabitEthernet0/0/1]po de v 103[sw3-GigabitEthernet0/0/1]undo stp enable[sw3-GigabitEthernet0/0/1]int g0/0/2[sw3-GigabitEthernet0/0/2]po li ac[sw3-GigabitEthernet0/0/2]po de v 203[sw3-GigabitEthernet0/0/2]undo stp enable[sw3]interface Vlanif 103[sw3-Vlanif103]ip address 10.10.3.3 24[sw3]interface Vlanif 104[sw3-Vlanif203]ip address 10.20.3.3 24ospf[sw3]ospf 1 router-id 3.3.3.3[sw3-ospf-1]a 0[sw3-ospf-1-area-0.0.0.0]network 10.10.3.3 0.0.0.0[sw3-ospf-1-area-0.0.0.0]network 10.20.3.3 0.0.0.0要干涉选路所以pc1和pc2网关先不宣告[sw4]v b 104 204[sw4]int g0/0/1[sw4-GigabitEthernet0/0/1]po li ac[sw4-GigabitEthernet0/0/1]po de v 204[sw4-GigabitEthernet0/0/1]undo stp enable[sw4-GigabitEthernet0/0/1]int g0/0/2[sw4-GigabitEthernet0/0/2]po li ac[sw4-GigabitEthernet0/0/2]po de v 104[sw4-GigabitEthernet0/0/2]undo stp enable[sw4]interface Vlanif 104[sw4-Vlanif104]ip add 10.10.4.4 24[sw4]interface Vlanif 204[sw4-Vlanif204]ip add 10.20.4.4 24ospf[sw4]ospf 1 router-id 4.4.4.4[sw4-ospf-1]a 0[sw4-ospf-1-area-0.0.0.0]network 10.10.4.4 0.0.0.0[sw4-ospf-1-area-0.0.0.0]network 10.20.4.4 0.0.0.0sw1和sw2每一个设备分为两个设备VRF配置信息名称VRFRD100:1RT100:1创建VRF空间[sw1-vpn-instance-VRF]route-distinguisher 100:1[sw1-vpn-instance-VRF-af-ipv4]vpn-target 100:1 export-extcommunity[sw1-vpn-instance-VRF-af-ipv4]vpn-target 100:1 import-extcommunity[sw1]vlan batch 102 103 104[sw1]int g0/0/5[sw1-GigabitEthernet0/0/5]po li a[sw1-GigabitEthernet0/0/5]po de v 103[sw1-GigabitEthernet0/0/5]undo stp enable[sw1]int g0/0/6[sw1-GigabitEthernet0/0/6]po li a[sw1-GigabitEthernet0/0/6]po de v 104[sw1-GigabitEthernet0/0/6]undo stp enable物理设备和创建的VRFsw1的g0/0/1和g0/0/7放在一个区域中g0/0/2和g0/0/5放在一个区域中g0/0/2和g0/0/4会放在不同区域中g0/0/4配置trunk链路[sw1]int g0/0/4[sw1-GigabitEthernet0/0/4]po li t[sw1-GigabitEthernet0/0/6]po t a v 102[sw1-GigabitEthernet0/0/4]undo port trunk allow-pass vlan 1[sw1-GigabitEthernet0/0/4]undo stp enable[sw2]ip vpn-instance VRF[sw2-vpn-instance-VRF]route-distinguisher 100:1[sw2-vpn-instance-VRF-af-ipv4]vpn-target 100:1 both[sw2]vlan batch 102 203 204[sw2]int g0/0/5[sw2-GigabitEthernet0/0/5]po li a[sw2-GigabitEthernet0/0/5]po de v 104[sw2]int g0/0/6[sw2-GigabitEthernet0/0/6]po li a[sw2-GigabitEthernet0/0/6]po de v 203[sw2]int g0/0/4[sw2-GigabitEthernet0/0/5]po li t[sw2-GigabitEthernet0/0/5]po t a v 102[sw2-GigabitEthernet0/0/4]undo port trunk allow-pass vlan 1[sw2-GigabitEthernet0/0/4]undo stp enablesw1---g0/0/5:103---g0/0/6:104---g0/0/4:102--g0/0/3属于特殊虚拟VRF接口[sw1]interface Vlanif 102[sw1-Vlanif102]ip binding vpn-instance VRF[sw1-Vlanif102]ip address 10.10.2.1 24[sw1]interface Vlanif 103[sw1-Vlanif103]ip binding vpn-instance VRF[sw1-Vlanif103]ip address 10.10.3.1 24[sw1]interface Vlanif 104[sw1-Vlanif104]ip binding vpn-instance VRF[sw1-Vlanif104]ip address 10.10.4.1 24[sw2]interface Vlanif 102[sw2-Vlanif102]ip binding vpn-instance VRF[sw2-Vlanif102]ip address 10.10.2.2 24[sw2]interface Vlanif 203[sw2-Vlanif203]ip binding vpn-instance VRF[sw2-Vlanif203]ip address 10.20.3.2 24[sw2]interface Vlanif 204[sw2-Vlanif204]ip binding vpn-instance VRF[sw2-Vlanif204]ip address 10.20.4.2 24测试连通性sw3pingsw1sw3pingsw2sw1pingsw3不通原因sw1路由表中没有10.10.3.0网段第一个查的是全局路由表应该查关于VRF的路由表ping也是因为是在VRF空间写的所以ping的时候也要加上VRF空间才可以ping通在VRF区域配置ospf进程[sw1]ospf 1 router-id 1.1.1.1 vpn-instance VRF[sw1-ospf-1]a 0[sw1-ospf-1-area-0.0.0.0]network 10.10.2.1 0.0.0.0[sw1-ospf-1-area-0.0.0.0]network 10.10.3.1 0.0.0.0[sw1-ospf-1-area-0.0.0.0]network 10.10.4.1 0.0.0.0[sw1]ospf 1 router-id 2.2.2.2 vpn-instance VRF[sw1-ospf-1]a 0[sw1-ospf-1-area-0.0.0.0]network 10.10.2.2 0.0.0.0[sw1-ospf-1-area-0.0.0.0]network 10.20.2.2 0.0.0.0[sw1-ospf-1-area-0.0.0.0]network 10.20.3.2 0.0.0.0查看邻居表sw3display ospf peer brief OSPF Process 1 with Router ID 3.3.3.3 Peer Statistic Information ------------------------------------------------------------------------- Area Id Interface Neighbor id State 0.0.0.0 Vlanif103 1.1.1.1 Full 0.0.0.0 Vlanif203 2.2.2.2 Full -------------------------------------------------------------------------路由的引导---策略干涉(路由策略ospf开销值)上行流量sw3主流量发给sw1备份发给sw2sw4主流量发给sw2备份发给sw1下行流量sw1访问2.0网关发给sw3备份发给sw43.0发给sw4备份发给sw3回程流量下行流量2.0---vlan2---sw3主网关上行流量缺省走不用区分改开销值[sw3]interface Vlanif 203[sw3-Vlanif203]ospf cost 5sw4[sw4]interface Vlanif 104[sw4-Vlanif104]ospf cost 5ospf干涉路由域外路由引入的时候干涉[sw3]ip ip-prefix aa permit 192.168.3.0 24[sw3]ip ip-prefix bb permit 192.168.2.0 24[sw3]route-policy aa permit node 10 3.0改大[sw3-route-policy]apply cost 5[sw3]route-policy aa permit node 20 放通2.0[sw3-route-policy]if-match ip-prefix bb[sw3]ospf[sw3-ospf-1]import-route direct route-policy aa 宣告直连sw4[sw4]ip ip-prefix aa permit 192.168.2.0 24[sw4]ip ip-prefix bb permit 192.168.3.0 24[sw4]route-policy aa permit node 10[sw4-route-policy]if-match ip-prefix aa[sw4-route-policy]apply cost 5[sw4-route-policy]q[sw4]route-policy aa permit node 20[sw4-route-policy]if-match ip-prefix bb[sw4-route-policy]q[sw4]ospf 1[sw4-ospf-1]import-route direct route-policy aasw1display ospf lsdb OSPF Process 1 with Router ID 1.1.1.1 Link State Database Area: 0.0.0.0 Type LinkState ID AdvRouter Age Len Sequence Metric Router 4.4.4.4 4.4.4.4 10 48 80000007 5 Router 2.2.2.2 2.2.2.2 270 48 80000007 1 Router 1.1.1.1 1.1.1.1 269 60 80000008 1 Router 3.3.3.3 3.3.3.3 265 48 80000007 1 Network 10.10.3.3 3.3.3.3 265 32 80000002 0 Network 10.10.4.4 4.4.4.4 266 32 80000002 0 Network 10.10.2.2 2.2.2.2 270 32 80000001 0 Network 10.20.3.3 3.3.3.3 266 32 80000002 0 AS External Database Type LinkState ID AdvRouter Age Len Sequence Metric External 192.168.2.0 3.3.3.3 314 36 80000001 1 External 192.168.2.0 4.4.4.4 10 36 80000001 5 External 192.168.3.0 3.3.3.3 314 36 80000001 5 External 192.168.3.0 4.4.4.4 10 36 80000001 1FW1-FW2-SW1-SW2VRRP备份组1 --- VRRP备份组5VRRP备份组2 --- VRRP备份组6 --- 402VRRP备份组3 --- VRRP备份组7 --- 403VRRP备份组4 --- VRRP备份组8 --- 404VRRP备份组1VRF使用sw1为主sw2为备VLAN 401 --- 10.40.1.0/24sw110.40.1.1/24sw210.40.1.2/24虚拟IP10.40.1.100VRRP备份组5FW使用FW1为主FW2为备VALN 401 --- 10.40.1.0/24FW110.40.1.10/24FW210.40.1.20/24虚拟IP10.40.1.200sw1[sw1]vlan batch 401 402[sw1]int g0/0/3[sw1-GigabitEthernet0/0/3]po li t[sw1-GigabitEthernet0/0/3]po t a v 401 402[sw1-GigabitEthernet0/0/3]int g0/0/4[sw1-GigabitEthernet0/0/4]po li t[sw1-GigabitEthernet0/0/4]po t a v 401 402[sw1]interface Vlanif 401[sw1-Vlanif401]ip binding vpn-instance VRF[sw1-Vlanif401]ip address 10.40.1.1 24[sw1-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100[sw1-Vlanif401]vrrp vrid 1 priority 120[sw1-Vlanif401]vrrp vrid 1 preempt-mode timer delay 60[sw1-Vlanif401]vrrp vrid 1 track interface GigabitEthernet 0/0/3 reduced 30[sw1]interface Vlanif 402[sw1-Vlanif402]ip binding vpn-instance VRF[sw1-Vlanif402]ip address 10.40.2.1 24[sw1-Vlanif402]vrrp vrid 2 virtual-ip 10.40.2.100sw2[sw2]vlan batch 401 402[sw2]int g0/0/3[sw2-GigabitEthernet0/0/3]po li t[sw2-GigabitEthernet0/0/3]po t a v 401 402[sw2-GigabitEthernet0/0/3]int g0/0/4[sw2-GigabitEthernet0/0/4]po li t[sw2-GigabitEthernet0/0/4]po t a v 401 402[sw2]interface Vlanif 401[sw2-Vlanif401]ip binding vpn-instance VRF[sw2-Vlanif401]ip address 10.40.1.2 24[sw2-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100[sw2-Vlanif401]q[sw2]interface Vlanif 402[sw2-Vlanif402]ip binding vpn-instance VRF[sw2-Vlanif402]ip address 10.40.2.2 24[sw2-Vlanif402]vrrp vrid 2 virtual-ip 10.40.2.100[sw2-Vlanif402]vrrp vrid 2 priority 120[sw2-Vlanif402]vrrp vrid 2 preempt-mode timer delay 60[sw2-Vlanif402]vrrp vrid 2 track interface GigabitEthernet 0/0/3 reduced 30[sw2]display vrrp brief VRID State Interface Type Virtual IP ---------------------------------------------------------------- 1 Backup Vlanif401 Normal 10.40.1.100 1 Master Vlanif402 Normal 10.40.2.100 ---------------------------------------------------------------- Total:2 Master:1 Backup:1 Non-active:0FW1[FW1]vlan batch 401 to 402[FW1]int g1/0/0[FW1-GigabitEthernet1/0/0]ip address 10.10.10.1 30[FW1]int g1/0/2.401[FW1-GigabitEthernet1/0/2.401]ip address 10.40.1.10 24[FW1-GigabitEthernet1/0/2.401]vlan-type dot1q 401[FW1]int g1/0/2.402[FW1-GigabitEthernet1/0/2.402]ip address 10.40.2.10 24[FW1-GigabitEthernet1/0/2.402]vlan-type dot1q 402[FW1]int g1/0/3.403[FW1-GigabitEthernet1/0/3.403]ip address 10.40.3.10 24[FW1-GigabitEthernet1/0/3.403]vlan-type dot1q 403[FW1]int g1/0/3.404[FW1-GigabitEthernet1/0/3.404]ip address 10.40.4.10 24[FW1-GigabitEthernet1/0/3.404]vlan-type dot1q 404[FW1]firewall zone trust[FW1-zone-trust]add interface GigabitEthernet 1/0/2.401[FW1-zone-trust]add interface GigabitEthernet 1/0/2.402[FW1-zone-trust]q[FW1]firewall zone untrust[FW1-zone-untrust]add interface GigabitEthernet 1/0/3.403[FW1-zone-untrust]add interface GigabitEthernet 1/0/3.404[FW1]firewall zone dmz[FW1-zone-dmz]add interface GigabitEthernet 1/0/0双机热备[FW1]interface GigabitEthernet 1/0/2.401[FW1-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.1.200 active 主用设备[FW1]interface GigabitEthernet 1/0/2.402[FW1-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.2.200 standby[FW1]interface GigabitEthernet 1/0/3.403[FW1-GigabitEthernet1/0/3.403]vrrp vrid 7 virtual-ip 10.40.3.200 active[FW1]int g1/0/3.404[FW1-GigabitEthernet1/0/3.404]vrrp vrid 8 virtual-ip 10.40.4.200 standby[FW1]hrp mirror session enable 会话快速备份功能[FW1]hrp interface GigabitEthernet 1/0/0 remote 10.10.10.2 连接心跳线以及对端IP[FW1]hrp enable 设备启动HRP_M[FW1]ip route-static 0.0.0.0 0 10.40.3.100 写路由HRP_M[FW1]ip route-static 0.0.0.0 0 10.40.4.100 preference 70 浮动静态路由HRP_M[FW1]ip route-static 192.168.0.0 16 10.40.1.100HRP_M[FW1]ip route-static 192.168.0.0 16 10.40.2.100 preference 70FW2[FW2]vlan batch 401 to 404[FW2]int g1/0/0 心跳线[FW2-GigabitEthernet1/0/0]ip address 10.10.10.2 30[FW2-GigabitEthernet1/0/0]int g1/0/2.401[FW2-GigabitEthernet1/0/2.401]ip address 10.40.1.20 24[FW2-GigabitEthernet1/0/2.401]vlan-type dot1q 401[FW2-GigabitEthernet1/0/2.401]int g1/0/2.402[FW2-GigabitEthernet1/0/2.402]ip address 10.40.2.20 24[FW2-GigabitEthernet1/0/2.402]vlan-type dot1q 402[FW2]int g1/0/3.403[FW2-GigabitEthernet1/0/3.403]ip address 10.40.3.20 24[FW2-GigabitEthernet1/0/3.403]vlan-type dot1q 403[FW2]int g1/0/3.404[FW2-GigabitEthernet1/0/3.404]ip address 10.40.4.20 24[FW2-GigabitEthernet1/0/3.404]vlan-type dot1q 404[FW2]firewall zone trust[FW2-zone-trust]add interface GigabitEthernet 1/0/2.401[FW2-zone-trust]add interface GigabitEthernet 1/0/2.402[FW2-zone-trust]q[FW2]firewall zone untrust[FW2-zone-untrust]add interface GigabitEthernet 1/0/3.403[FW2-zone-untrust]add interface GigabitEthernet 1/0/3.404[FW2-zone-untrust]q[FW2]firewall zone dmz[FW2-zone-dmz]add interface GigabitEthernet 1/0/0双机热备[FW2]int GigabitEthernet 1/0/2.401[FW2-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.1.200 standby[FW2-GigabitEthernet1/0/2.401]int g1/0/2.402[FW2-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.2.200 active[FW2-GigabitEthernet1/0/2.402]int g1/0/3.403[FW2-GigabitEthernet1/0/3.403]vrrp vrid 7 virtual-ip 10.40.3.200 standby[FW2-GigabitEthernet1/0/3.403]int g1/0/3.404[FW2-GigabitEthernet1/0/3.404]vrrp vrid 8 virtual-ip 10.40.4.200 active[FW2-GigabitEthernet1/0/3.404]q[FW2]hrp mirror session enable[FW2]hrp interface GigabitEthernet 1/0/0 remote 10.10.10.1[FW2]hrp enableHRP_S[FW2]ip route-static 0.0.0.0 0 10.40.4.100HRP_S[FW2]ip route-static 0.0.0.0 0 10.40.3.100 preference 70HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.2.100HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.1.100 preference 70HRP_M[FW1]display vrrp brief 2026-08-09 11:29:19.740 Total:4 Master:2 Backup:2 Non-active:0 VRID State Interface Type Virtual IP ---------------------------------------------------------------- 5 Master GE1/0/2.401 Vgmp 10.40.1.200 6 Backup GE1/0/2.402 Vgmp 10.40.2.200 7 Master GE1/0/3.403 Vgmp 10.40.3.200 8 Backup GE1/0/3.404 Vgmp 10.40.4.200 HRP_M[FW1]HRP_S[FW2]display vrrp brief 2026-08-09 11:31:30.370 Total:4 Master:2 Backup:2 Non-active:0 VRID State Interface Type Virtual IP ---------------------------------------------------------------- 5 Backup GE1/0/2.401 Vgmp 10.40.1.200 6 Master GE1/0/2.402 Vgmp 10.40.2.200 7 Backup GE1/0/3.403 Vgmp 10.40.3.200 8 Master GE1/0/3.404 Vgmp 10.40.4.200 HRP_S[FW2]安全策略FW1主设备写HRP_M[FW1]security-policy (B)HRP_M[FW1-policy-security]rule name t_to_un (B)HRP_M[FW1-policy-security-rule-t_to_un]source-zone trust (B)HRP_M[FW1-policy-security-rule-t_to_un]destination-zone untrust (B)HRP_M[FW1-policy-security-rule-t_to_un]source-address 192.168.0.0 16 (B)HRP_M[FW1-policy-security-rule-t_to_un]action permit (B)HRP_M[FW1-policy-security-rule-t_to_un]qsw1与sw2配置配置vlan 403 404sw1配置vlan 403 404[sw1]vlan batch 403 404[sw1]int g0/0/1[sw1-GigabitEthernet0/0/1]po li t[sw1-GigabitEthernet0/0/1]po t a v 403 404[sw1]int g0/0/2[sw1-GigabitEthernet0/0/2]po li t[sw1-GigabitEthernet0/0/2]po t a v 403 404[sw1]interface Vlanif 403[sw1-Vlanif403]ip address 10.40.3.1 24[sw1-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100[sw1-Vlanif403]vrrp vrid 3 priority 120[sw1-Vlanif403]vrrp vrid 3 preempt-mode timer delay 60[sw1-Vlanif403]vrrp vrid 3 track interface GigabitEthernet 0/0/1 reduced 30[sw1]interface Vlanif 404[sw1-Vlanif404]ip address 10.40.4.1 24[sw1-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100sw2配置vlan 403 404[sw2]vlan batch 403 404[sw2]int g0/0/1[sw2-GigabitEthernet0/0/1]po li t[sw2-GigabitEthernet0/0/1]po t a v 403 404[sw2-GigabitEthernet0/0/1]int g0/0/2[sw2-GigabitEthernet0/0/2]po t a v 403 404[sw2]interface Vlanif 403[sw2-Vlanif403]ip address 10.40.3.2 24[sw2-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100[sw2-Vlanif403]q[sw2]interface Vlanif 404[sw2-Vlanif404]ip address 10.40.4.2 24[sw2-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100[sw2-Vlanif404]vrrp vrid 4 priority 120[sw2-Vlanif404]vrrp vrid 4 preempt-mode timer delay 60[sw2-Vlanif404]vrrp vrid 4 track interface GigabitEthernet 0/0/1 reduced 30sw1和sw2查vrrp[sw1]display vrrp brief VRID State Interface Type Virtual IP ---------------------------------------------------------------- 1 Master Vlanif401 Normal 10.40.1.100 2 Backup Vlanif402 Normal 10.40.2.100 3 Master Vlanif403 Normal 10.40.3.100 4 Backup Vlanif404 Normal 10.40.4.100 ---------------------------------------------------------------- Total:4 Master:2 Backup:2 Non-active:0[sw2]display vrrp brief VRID State Interface Type Virtual IP ---------------------------------------------------------------- 1 Backup Vlanif401 Normal 10.40.1.100 2 Master Vlanif402 Normal 10.40.2.100 3 Backup Vlanif403 Normal 10.40.3.100 4 Master Vlanif404 Normal 10.40.4.100 ---------------------------------------------------------------- Total:4 Master:2 Backup:2 Non-active:0配置VRF路由sw1配置VRF路由[sw1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200[sw1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 preference 70sw2配置VRF路由[sw2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200[sw2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200 preference 70路由配置sw1[sw1]ip route-static 192.168.0.0 16 10.40.3.200[sw1]ip route-static 192.168.0.0 16 10.40.4.200 preference 70sw2[sw2]ip route-static 192.168.0.0 16 10.40.4.200[sw2]ip route-static 192.168.0.0 16 10.40.3.200 preference 70FW激活物理接口FW1和FW2都是物理接口g1/0/2和g1/0/3激活一样的HRP_M[FW1]int g1/0/2 (B)HRP_M[FW1-GigabitEthernet1/0/2]ip address 1.1.1.1 24HRP_M[FW1-GigabitEthernet1/0/2]undo ip address 1.1.1.1 24HRP_M[FW1]int g1/0/3 (B)HRP_M[FW1-GigabitEthernet1/0/3]ip address 1.1.1.1 24HRP_M[FW1-GigabitEthernet1/0/3]undo ip address 1.1.1.1 24分析sw1-sw2-R5-R6sw1-sw2VALN 201 --- 10.20.1.0/24sw1-R5VLAN 105 --- 10.10.5.0/24sw2-R6VLAN 206 --- 10.20.6.0/24R5-R610.56.0.0/24配置vlan 201 105 206sw1配置201 105[sw1]vlan batch 201 105[sw1]int g0/0/7[sw1-GigabitEthernet0/0/7]po li a[sw1-GigabitEthernet0/0/7]po de v 105[sw1-GigabitEthernet0/0/7]undo stp enable[sw1]int g0/0/2[sw1-GigabitEthernet0/0/2]po t a v 201[sw1-GigabitEthernet0/0/2]undo stp enable[sw1]interface Vlanif 105[sw1-Vlanif105]ip address 10.10.5.1 24[sw1]interface Vlanif 201[sw1-Vlanif201]ip address 10.20.1.1 24[sw1]ospf 2 router-id 1.1.1.1[sw1-ospf-2]a 0[sw1-ospf-2-area-0.0.0.0]network 10.10.5.1 0.0.0.0[sw1-ospf-2-area-0.0.0.0]network 10.20.1.1 0.0.0.0sw2配置201 206[sw2]vlan batch 201 206[sw2]int g0/0/7[sw2-GigabitEthernet0/0/7]po li a[sw2-GigabitEthernet0/0/7]po de v 206[sw2-GigabitEthernet0/0/7]undo stp enable[sw2]int g0/0/2[sw2-GigabitEthernet0/0/2]po t a v 201[sw2-GigabitEthernet0/0/2]undo stp enable[sw2]interface Vlanif 201[sw2-Vlanif201]ip address 10.20.1.2 24[sw2]interface Vlanif 206[sw2-Vlanif206]ip address 10.20.6.2 24[sw2]ospf 2 router-id 2.2.2.2[sw2-ospf-2]a 0[sw2-ospf-2-area-0.0.0.0]network 10.20.6.2 0.0.0.0[sw2-ospf-2-area-0.0.0.0]network 10.20.1.2 0.0.0.0R5R6路由器配置R5接口0/0/0和0/0/1配IP以及ospf[r5]int g0/0/0[r5-GigabitEthernet0/0/0]ip address 10.10.5.5 24[r5-GigabitEthernet0/0/0]int g0/0/1[r5-GigabitEthernet0/0/1]ip address 10.56.0.5 24[r5]ospf 1 router-id 5.5.5.5[r5-ospf-1]a 0[r5-ospf-1-area-0.0.0.0]network 10.56.0.5 0.0.0.0[r5-ospf-1-area-0.0.0.0]network 10.10.5.5 0.0.0.0R6接口0/0/0和0/0/1配IP以及ospf[r6]int g0/0/0[r6-GigabitEthernet0/0/0]ip address 10.20.6.6 24[r6-GigabitEthernet0/0/0]int g0/0/1[r6-GigabitEthernet0/0/1]ip address 10.56.0.6 24[r6]ospf 1 router-id 6.6.6.6[r6-ospf-1]a 0[r6-ospf-1-area-0.0.0.0]network 10.56.0.6 0.0.0.0[r6-ospf-1-area-0.0.0.0]network 10.20.6.6 0.0.0.0R5接口0/0/2配置以及开启acl[r5]int g0/0/2[r5-GigabitEthernet0/0/2]ip address 12.0.0.5 24[r5]ip route-static 0.0.0.0 0 12.0.0.100[r5]ospf 1[r5-ospf-1]default-route-advertise[r5]acl 2000[r5-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255[r5]int g0/0/2[r5-GigabitEthernet0/0/2]nat outbound 2000R6接口0/0/2配置以及开启acl[r6]int g0/0/2[r6-GigabitEthernet0/0/2]ip address 13.0.0.6 24[r6]ip route-static 0.0.0.0 0 13.0.0.100[r6]ospf 1[r6-ospf-1]default-route-advertise[r6]acl 2000[r6-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255[r6]int g0/0/2[r6-GigabitEthernet0/0/2]nat outbound 2000ISP配置[ISP]int g0/0/0[ISP-GigabitEthernet0/0/0]ip address 12.0.0.100 24[ISP]int g0/0/1[ISP-GigabitEthernet0/0/1]ip address 13.0.0.100 24[ISP]interface LoopBack 0[ISP-LoopBack0]ip address 100.1.1.1 24sw1和sw2将自身静态路由注入OSPF 2进程[sw1]ospf 2[sw1-ospf-2]import-route static[sw2]ospf 2[sw2-ospf-2]import-route staticsw1查VRF路由表sw1display ip routing-table vpn-instance VRF Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Routing Tables: VRF Destinations : 16 Routes : 16 Destination/Mask Proto Pre Cost Flags NextHop Interface 0.0.0.0/0 Static 60 0 RD 10.40.1.200 Vlanif401 10.10.2.0/24 Direct 0 0 D 10.10.2.1 Vlanif102 10.10.2.1/32 Direct 0 0 D 127.0.0.1 Vlanif102 10.10.3.0/24 Direct 0 0 D 10.10.3.1 Vlanif103 10.10.3.1/32 Direct 0 0 D 127.0.0.1 Vlanif103 10.10.4.0/24 Direct 0 0 D 10.10.4.1 Vlanif104 10.10.4.1/32 Direct 0 0 D 127.0.0.1 Vlanif104 10.20.3.0/24 OSPF 10 2 D 10.10.2.2 Vlanif102 10.20.4.0/24 OSPF 10 2 D 10.10.4.4 Vlanif104 10.40.1.0/24 Direct 0 0 D 10.40.1.1 Vlanif401 10.40.1.1/32 Direct 0 0 D 127.0.0.1 Vlanif401 10.40.1.100/32 Direct 0 0 D 127.0.0.1 Vlanif401 10.40.2.0/24 Direct 0 0 D 10.40.2.1 Vlanif402 10.40.2.1/32 Direct 0 0 D 127.0.0.1 Vlanif402 192.168.2.0/24 O_ASE 150 1 D 10.10.3.3 Vlanif103 192.168.3.0/24 O_ASE 150 1 D 10.10.4.4 Vlanif104sw1和sw2将自身静态路由注入OSPF 2进程[sw1]ospf 1[sw1-ospf-1]default-route-advertise[sw2]ospf 1[sw2-ospf-1]default-route-advertisesw3有了缺省路由sw3display ip routing-table Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Routing Tables: Public Destinations : 15 Routes : 15 Destination/Mask Proto Pre Cost Flags NextHop Interface 0.0.0.0/0 O_ASE 150 1 D 10.10.3.1 Vlanif103 10.10.2.0/24 OSPF 10 2 D 10.10.3.1 Vlanif103 10.10.3.0/24 Direct 0 0 D 10.10.3.3 Vlanif103 10.10.3.3/32 Direct 0 0 D 127.0.0.1 Vlanif103 10.10.4.0/24 OSPF 10 2 D 10.10.3.1 Vlanif103 10.20.3.0/24 Direct 0 0 D 10.20.3.3 Vlanif203 10.20.3.3/32 Direct 0 0 D 127.0.0.1 Vlanif203 10.20.4.0/24 OSPF 10 3 D 10.10.3.1 Vlanif103 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0 192.168.2.0/24 Direct 0 0 D 192.168.2.1 Vlanif2 192.168.2.1/32 Direct 0 0 D 127.0.0.1 Vlanif2 192.168.2.254/32 Direct 0 0 D 127.0.0.1 Vlanif2 192.168.3.0/24 Direct 0 0 D 192.168.3.1 Vlanif3 192.168.3.1/32 Direct 0 0 D 127.0.0.1 Vlanif3做测试pc1ping100.1.1.1从左边出去