华为H3C实战 | 第42章 企业双出口冗余与链路选路

                        [Internet]
                       /            \
            电信（主） /              \ 联通（备）
                     /                \
              +-----+------+      +----+--------+
              | 光猫 CT     |      | 光猫 CU      |
              +-----+------+      +----+--------+
                    | 10.100.1.0/30    | 10.101.1.0/30
                    |                  |
        +-----------+------------------+-----------+
        |          FW1 防火墙（出口）                |
        |  Untrust 区：两个出口接口                  |
        |  Trust 区：接内网核心                      |
        +--------------------+---------------------+
                             | 10.200.1.0/30
                     +-------+-------+
                     |  CORE 核心    |
                     |  交换机       |
                     +---+-------+---+
                         |       |
                +--------+       +---------+
                |                          |
        [办公 VLAN 10]              [服务器 VLAN 20]
        [仓储 VLAN 11]              [分公司 IPSec]

   【内网域】
   办公/仓储终端 --VLAN--> CORE --默认路由--> FW1 --Trust区

   【出口域 - 电信】
   FW1 --10.100.1.1--> 光猫CT --公网--> 电信资源

   【出口域 - 联通】
   FW1 --10.101.1.1--> 光猫CU --公网--> 联通资源

   【分支域 - IPSec】
   FW1 <==加密隧道==> 分公司防火墙（B 市，静态 IP）

   源 NAT（内网→公网）  →  安全策略检查  →  路由（决定走哪条链路）  →  发出

   ⚠ 关键问题：如果先做源 NAT 再做策略路由，
      策略路由看到的源地址已经是公网地址，匹配不到内网 ACL！

system-view
sysname CORE

# VLAN 规划
vlan batch 10 11 20

# 办公网关
interface Vlanif10
 ip address 192.168.10.1 255.255.255.0
 quit
# 仓储网关
interface Vlanif11
 ip address 192.168.11.1 255.255.255.0
 quit
# 服务器网关
interface Vlanif20
 ip address 192.168.20.1 255.255.255.0
 quit

# 到防火墙的互联口
interface Vlanif200
 ip address 10.200.1.1 255.255.255.252
 quit

# 默认路由指向防火墙
ip route-static 0.0.0.0 0.0.0.0 10.200.1.2
# 到分公司内网的路由（经 IPSec 隧道，下一跳是防火墙隧道地址）
ip route-static 10.50.0.0 255.255.0.0 10.200.1.2

# DHCP 服务
dhcp enable
ip pool office
 network 192.168.10.0 mask 255.255.255.0
 gateway-list 192.168.10.1
 dns-list 114.114.114.114
 quit
ip pool warehouse
 network 192.168.11.0 mask 255.255.255.0
 gateway-list 192.168.11.1
 dns-list 114.114.114.114
 quit

system-view
sysname FW1

# 安全区域
firewall zone trust
 add interface GigabitEthernet1/0/1
 quit
firewall zone untrust
 add interface GigabitEthernet1/0/2
 add interface GigabitEthernet1/0/3
 quit

# 接口地址
interface GigabitEthernet1/0/1
 description to-CORE
 ip address 10.200.1.2 255.255.255.252
 quit
interface GigabitEthernet1/0/2
 description to-CT-telecom
 ip address 10.100.1.1 255.255.255.252
 quit
interface GigabitEthernet1/0/3
 description to-CU-unicom
 ip address 10.101.1.1 255.255.255.252
 quit

# 电信链路探测：每 1 秒探测，连续 3 次失败判定不可达
nqa test-instance admin ct
 test-type icmp
 destination-address ipv4 10.100.1.2
 frequency 1
 probe-count 3
 timeout 1
 start now
 quit

# 联通链路探测
nqa test-instance admin cu
 test-type icmp
 destination-address ipv4 10.101.1.2
 frequency 1
 probe-count 3
 timeout 1
 start now
 quit

nqa schedule admin ct start-time now lifetime forever
nqa schedule admin cu start-time now lifetime forever

# 主路由：默认走电信，捆绑 NQA 探测
ip route-static 0.0.0.0 0.0.0.0 10.100.1.2 track nqa admin ct
# 备路由：优先级更低（数值更大），电信挂了才生效
ip route-static 0.0.0.0 0.0.0.0 10.101.1.2 preference 70 track nqa admin cu

# ---------- 匹配电信资源段 ----------
acl number 3100
 description CT-resources
 rule 10 permit ip destination 106.0.0.0 0.255.255.255
 rule 20 permit ip destination 180.0.0.0 0.255.255.255
 quit

# ---------- 匹配联通资源段 ----------
acl number 3200
 description CU-resources
 rule 10 permit ip destination 110.0.0.0 0.255.255.255
 rule 20 permit ip destination 210.0.0.0 0.255.255.255
 quit

# ---------- 流分类 ----------
traffic classifier ct-res operator or
 if-match acl 3100
 quit
traffic classifier cu-res operator or
 if-match acl 3200
 quit

# ---------- 流行为：重定向到指定下一跳 ----------
traffic behavior to-ct
 redirect ip-nexthop 10.100.1.2
 quit
traffic behavior to-cu
 redirect ip-nexthop 10.101.1.2
 quit

# ---------- 流策略：按顺序组合 ----------
traffic policy dual-wan
 classifier ct-res behavior to-ct
 classifier cu-res behavior to-cu
 quit

# ---------- 应用在 Trust 区入方向 ----------
interface GigabitEthernet1/0/1
 traffic-policy dual-wan inbound
 quit

# ---------- 源 NAT：内网访问互联网，两个出口都要 NAT ----------
nat address-group 1
 mode pat
 section 0 10.100.1.1 10.100.1.1
 quit
nat address-group 2
 mode pat
 section 0 10.101.1.1 10.101.1.1
 quit

nat-policy
 rule name outbound-ct
  source-zone trust
  destination-zone untrust
  action source-nat address-group 1
  quit
 quit

# ---------- 服务器映射：对外发布 Web 服务，走电信 ----------
nat server web-server protocol tcp global 10.100.1.1 80 inside 192.168.20.10 80

security-policy
 # 内网出外网：放行
 rule name trust-to-untrust
  source-zone trust
  destination-zone untrust
  action permit
  quit
 # 外网访问 Web 服务器
 rule name untrust-to-web
  source-zone untrust
  destination-zone trust
  destination-address 192.168.20.10 32
  destination-port 80
  action permit
  quit
 # 默认拒绝（华为默认就是拒绝，写出来是为了明确）
 rule name default
  action deny
  quit
 quit

# ---------- IKE 提议（第一阶段） ----------
ike proposal 10
 encryption-algorithm aes-cbc-256
 authentication-algorithm sha2-256
 dh group14
 quit

# ---------- IPSec 提议（第二阶段） ----------
ipsec proposal branch-prop
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256
 quit

# ---------- IKE 对等体：主隧道走电信 ----------
ike peer branch-ct v1
 pre-shared-key cipher Branch@IPSec2026
 ike-proposal 10
 remote-address 203.0.113.10
 quit

# 备隧道走联通
ike peer branch-cu v1
 pre-shared-key cipher Branch@IPSec2026
 ike-proposal 10
 remote-address 203.0.113.10
 local-address 10.101.1.1
 quit

# ---------- 感兴趣流 ----------
acl number 3400
 rule 10 permit ip source 192.168.0.0 0.0.255.255 destination 10.50.0.0 0.0.255.255
 quit

# ---------- IPSec 策略 ----------
ipsec policy branch-policy 10 isakmp
 security acl 3400
 ike-peer branch-ct
 proposal branch-prop
 quit

# 应用到电信出口接口
interface GigabitEthernet1/0/2
 ipsec policy branch-policy
 quit

# 定义观察口
observe-port 1 interface GigabitEthernet1/0/8
# 把电信出口入方向流量镜像到观察口
interface GigabitEthernet1/0/2
 port-mirroring to observe-port 1 inbound
 port-mirroring to observe-port 1 outbound
 quit

# 对办公网段整体限速，给仓储和服务器留余量
traffic classifier limited-user operator or
 if-match acl 3500
 quit
traffic behavior limit-50m
 car cir 51200 cbs 3200000
 quit
traffic policy user-limit
 classifier limited-user behavior limit-50m
 quit

acl number 3500
 rule 10 permit ip source 192.168.10.0 0.0.0.255
 quit

interface GigabitEthernet1/0/1
 traffic-policy user-limit inbound
 quit

system-view
sysname CORE

vlan 10
vlan 11
vlan 20
vlan 200
quit

interface Vlan-interface10
 ip address 192.168.10.1 255.255.255.0
 quit
interface Vlan-interface11
 ip address 192.168.11.1 255.255.255.0
 quit
interface Vlan-interface20
 ip address 192.168.20.1 255.255.255.0
 quit
interface Vlan-interface200
 ip address 10.200.1.1 255.255.255.252
 quit

ip route-static 0.0.0.0 0 10.200.1.2
ip route-static 10.50.0.0 255.255.0.0 10.200.1.2

dhcp enable
dhcp server ip-pool office
 network 192.168.10.0 mask 255.255.255.0
 gateway-list 192.168.10.1
 dns-list 114.114.114.114
 quit

interface GigabitEthernet1/0/1
 description to-CORE
 ip address 10.200.1.2 255.255.255.252
 quit
interface GigabitEthernet1/0/2
 description to-CT-telecom
 ip address 10.100.1.1 255.255.255.252
 quit
interface GigabitEthernet1/0/3
 description to-CU-unicom
 ip address 10.101.1.1 255.255.255.252
 quit

security-zone name Trust
 import interface GigabitEthernet1/0/1
 quit
security-zone name Untrust
 import interface GigabitEthernet1/0/2
 import interface GigabitEthernet1/0/3
 quit

nqa entry admin ct
 type icmp-echo
  destination ip 10.100.1.2
  frequency 1000
  probe count 3
  reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only
  quit
 quit

nqa entry admin cu
 type icmp-echo
  destination ip 10.101.1.2
  frequency 1000
  probe count 3
  reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only
  quit
 quit

# 关联 track
track 1 nqa entry admin ct reaction 1
track 2 nqa entry admin cu reaction 1

# 浮动静态路由
ip route-static 0.0.0.0 0 10.100.1.2 track 1
ip route-static 0.0.0.0 0 10.101.1.2 preference 70 track 2

# 匹配电信资源
acl advanced 3100
 rule 10 permit ip destination 106.0.0.0 0.255.255.255
 rule 20 permit ip destination 180.0.0.0 0.255.255.255
 quit

# 匹配联通资源
acl advanced 3200
 rule 10 permit ip destination 110.0.0.0 0.255.255.255
 rule 20 permit ip destination 210.0.0.0 0.255.255.255
 quit

# 策略路由：电信
policy-based-route to-ct permit node 10
 if-match acl 3100
 apply next-hop 10.100.1.2
 quit

# 策略路由：联通
policy-based-route to-cu permit node 20
 if-match acl 3200
 apply next-hop 10.101.1.2
 quit

# 应用到 Trust 接口
interface GigabitEthernet1/0/1
 ip policy-based-route to-ct
 ip policy-based-route to-cu
 quit

# 内网出外网 NAT
acl basic 2000
 rule 10 permit source 192.168.0.0 0.0.255.255
 quit

interface GigabitEthernet1/0/2
 nat outbound 2000
 quit
interface GigabitEthernet1/0/3
 nat outbound 2000
 quit

# 服务器映射（NAT Server）
interface GigabitEthernet1/0/2
 nat server protocol tcp global current-interface 80 inside 192.168.20.10 80
 quit

security-policy ip
 rule name trust-to-untrust
  source-zone Trust
  destination-zone Untrust
  action pass
  quit
 rule name untrust-to-web
  source-zone Untrust
  destination-zone Trust
  destination-ip 192.168.20.10
  service tcp destination-port 80
  action pass
  quit
quit

# 第一阶段
ike profile branch-ct
 keychain branch-key
  pre-shared-key simple Branch@IPSec2026
  quit
 exchange-mode aggressive
 quit

ike keychain branch-key
 pre-shared-key address 203.0.113.10 32 key simple Branch@IPSec2026
 quit

# 第二阶段
ipsec transform-set branch-prop
 esp encryption-algorithm aes-cbc-256
 esp authentication-algorithm sha256
 quit

# IPSec 策略
ipsec policy branch-policy 10 isakmp
 security acl 3400
 remote-address 203.0.113.10
 ike-profile branch-ct
 transform-set branch-prop
 quit

acl advanced 3400
 rule 10 permit ip source 192.168.0.0 0.0.255.255 destination 10.50.0.0 0.0.255.255
 quit

interface GigabitEthernet1/0/2
 ipsec apply policy branch-policy
 quit

# 定义镜像组
mirroring-group 1 local
mirroring-group 1 mirroring-port GigabitEthernet1/0/2 both
mirroring-group 1 monitor-port GigabitEthernet1/0/8

# 查看电信出口的实时流量
display interface GigabitEthernet1/0/2

   □ 备份现有配置（display current-configuration 导出存档）
   □ 确认两条链路的运营商网关地址、带宽、公网 IP
   □ 确认对外服务器当前用的公网 IP（改 NAT 会导致外部访问中断）
   □ 选业务低谷窗口（夜间 22:00 之后）
   □ 通知相关部门

# 查看 PBR 命中情况（华为）
display traffic policy statistics interface GigabitEthernet1/0/1 inbound

# 查看 NQA 探测结果（华为）
display nqa results test-instance admin ct

NQA entry(admin ct) test result:
    Destination : 10.100.1.2
    Status      : success        ← 断开后会变成 failed
    ...

# 查看路由表中主备路由状态
display ip routing-table 0.0.0.0

# 查看 IPSec SA 是否建立（华为）
display ipsec sa

# 看 IKE 对等体状态
display ike sa