ipsec 隧道备份技术

认真学习，报效祖国

998人浏览 · 2025-09-17 12:30:55

认真学习，报效祖国 · 2025-09-17 12:30:55 发布

1 拓扑

2 配置

2.1 交换机的配置

<sw1>display current-configuration
#
sysname sw1
#
cluster enable
ntdp enable
ndp enable
#
drop illegal-mac alarm
#
diffserv domain default
#
drop-profile default
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http
#
interface Vlanif1
ip address 10.1.1.254 255.255.255.0
#
interface MEth0/0/1
#
interface Ethernet0/0/1
#
interface Ethernet0/0/2
#
interface Ethernet0/0/3
#
interface Ethernet0/0/4
#
interface Ethernet0/0/5
#
interface Ethernet0/0/6
#
interface Ethernet0/0/7
#
interface Ethernet0/0/8
#
interface Ethernet0/0/9
#
interface Ethernet0/0/10
#
interface Ethernet0/0/11
#
interface Ethernet0/0/12
#
interface Ethernet0/0/13
#
interface Ethernet0/0/14
#
interface Ethernet0/0/15
#
interface Ethernet0/0/16
#
interface Ethernet0/0/17
#
interface Ethernet0/0/18
#
interface Ethernet0/0/19
#
interface Ethernet0/0/20
#
interface Ethernet0/0/21
#
interface Ethernet0/0/22
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack1
ip address 172.16.1.1 255.255.255.0
#
ip route-static 0.0.0.0 0.0.0.0 10.1.1.250
#
user-interface con 0
user-interface vty 0 4
#
return

2.2 fw1 的配置

role system-admin
role device-admin
role device-admin(monitor)
role audit-admin
bind manager-user audit-admin role audit-admin
bind manager-user admin role system-admin
#
l2tp-group default-lns
#
interface GigabitEthernet0/0/0
undo shutdown
ip binding vpn-instance default
ip address 1.1.1.1 255.255.255.0
alias GE0/METH
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.1.1.1 255.255.255.0
vrrp vrid 1 virtual-ip 10.1.1.250 active
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#
interface GigabitEthernet1/0/1
undo shutdown
ip address 20.1.1.1 255.255.255.0
vrrp vrid 2 virtual-ip 20.1.1.250 active
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
ipsec policy 1
#
interface GigabitEthernet1/0/2
undo shutdown
#
interface GigabitEthernet1/0/3
undo shutdown
#
interface GigabitEthernet1/0/4
undo shutdown
#
interface GigabitEthernet1/0/5
undo shutdown
#
interface GigabitEthernet1/0/6
undo shutdown
#
interface Virtual-if0
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/0
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1
#
firewall zone dmz
set priority 50
add interface GigabitEthernet0/0/0
#
ip route-static 172.16.1.0 255.255.255.0 10.1.1.254
ip route-static 172.16.2.0 255.255.255.0 20.1.1.254
#
undo ssh server compatible-ssh1x enable
ssh authentication-type default password
ssh server cipher aes256_ctr aes128_ctr
ssh server hmac sha2_256 sha1
ssh client cipher aes256_ctr aes128_ctr
ssh client hmac sha2_256 sha1
#
firewall detect ftp
#
user-interface con 0
authentication-mode aaa
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
user-interface vty 16 20
#
pki realm default
#
sa
#
location
#
multi-linkif
mode proportion-of-weight
#
right-manager server-group
#
device-classification
device-group pc
device-group mobile-terminal
device-group undefined-group
#
user-manage server-sync tsm
#
security-policy
rule name hrp
source-zone dmz
source-zone local
destination-zone dmz
destination-zone local
source-address 1.1.1.0 mask 255.255.255.0
destination-address 1.1.1.0 mask 255.255.255.0
action permit
rule name vrrp
source-zone local
source-zone trust
source-zone untrust
destination-zone local
destination-zone trust
source-address 10.1.1.0 mask 255.255.255.0
destination-address 10.1.1.0 mask 255.255.255.0
action permit
rule name vrrp-1
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
source-address 20.1.1.0 mask 255.255.255.0
destination-address 20.1.1.0 mask 255.255.255.0
action permit
rule name fangixng
source-zone trust
source-zone untrust
destination-zone trust
destination-zone untrust
source-address 172.16.1.0 mask 255.255.255.0
source-address 172.16.2.0 mask 255.255.255.0
destination-address 172.16.1.0 mask 255.255.255.0
destination-address 172.16.2.0 mask 255.255.255.0
action permit
rule name 1
source-zone trust
destination-zone untrust
source-address 172.16.1.0 mask 255.255.255.0
action permit
rule name 2
source-zone untrust
destination-zone trust
source-address 172.16.2.0 mask 255.255.255.0
action permit
#
auth-policy
#
traffic-policy
#
policy-based-route
#
nat-policy
#
quota-policy
#
pcp-policy
#
dns-transparent-policy
#
rightm-policy
#
return

2.3 fw2 的配置

role system-admin
role device-admin
role device-admin(monitor)
role audit-admin
bind manager-user audit-admin role audit-admin
bind manager-user admin role system-admin
#
l2tp-group default-lns
#
interface GigabitEthernet0/0/0
undo shutdown
ip binding vpn-instance default
ip address 1.1.1.2 255.255.255.0
alias GE0/METH
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.1.1.2 255.255.255.0
vrrp vrid 1 virtual-ip 10.1.1.250 standby
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#
interface GigabitEthernet1/0/1
undo shutdown
ip address 20.1.1.2 255.255.255.0
vrrp vrid 2 virtual-ip 20.1.1.250 standby
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
ipsec policy 1
#
interface GigabitEthernet1/0/2
undo shutdown
#
interface GigabitEthernet1/0/3
undo shutdown
#
interface GigabitEthernet1/0/4
undo shutdown
#
interface GigabitEthernet1/0/5
undo shutdown
#
interface GigabitEthernet1/0/6
undo shutdown
#
interface Virtual-if0
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/0
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/1
#
firewall zone dmz
set priority 50
add interface GigabitEthernet0/0/0
#
ip route-static 172.16.1.0 255.255.255.0 10.1.1.254
ip route-static 172.16.2.0 255.255.255.0 20.1.1.254
#
undo ssh server compatible-ssh1x enable
ssh authentication-type default password
ssh server cipher aes256_ctr aes128_ctr
ssh server hmac sha2_256 sha1
ssh client cipher aes256_ctr aes128_ctr
ssh client hmac sha2_256 sha1
#
firewall detect ftp
#
user-interface con 0
authentication-mode aaa
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
user-interface vty 16 20
#
pki realm default
#
sa
#
location
#
multi-linkif
mode proportion-of-weight
#
right-manager server-group
#
device-classification
device-group pc
device-group mobile-terminal
device-group undefined-group
#
user-manage server-sync tsm
#
security-policy
rule name hrp
source-zone dmz
source-zone local
destination-zone dmz
destination-zone local
source-address 1.1.1.0 mask 255.255.255.0
destination-address 1.1.1.0 mask 255.255.255.0
action permit
rule name vrrp
source-zone local
source-zone trust
source-zone untrust
destination-zone local
destination-zone trust
source-address 10.1.1.0 mask 255.255.255.0
destination-address 10.1.1.0 mask 255.255.255.0
action permit
rule name vrrp-1
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
source-address 20.1.1.0 mask 255.255.255.0
destination-address 20.1.1.0 mask 255.255.255.0
action permit
rule name fangixng
source-zone trust
source-zone untrust
destination-zone trust
destination-zone untrust
source-address 172.16.1.0 mask 255.255.255.0
source-address 172.16.2.0 mask 255.255.255.0
destination-address 172.16.1.0 mask 255.255.255.0
destination-address 172.16.2.0 mask 255.255.255.0
action permit
rule name 1
source-zone trust
destination-zone untrust
source-address 172.16.1.0 mask 255.255.255.0
action permit
rule name 2
source-zone untrust
destination-zone trust
source-address 172.16.2.0 mask 255.255.255.0
action permit
#
auth-policy
#
traffic-policy
#
policy-based-route
#
nat-policy
#
quota-policy
#
pcp-policy
#
dns-transparent-policy
#
rightm-policy
#
return

2.4 sw2 的配置

<Huawei>display current-configuration
#
sysname Huawei
#
cluster enable
ntdp enable
ndp enable
#
drop illegal-mac alarm
#
diffserv domain default
#
drop-profile default
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http
#
interface Vlanif1
ip address 20.1.1.251 255.255.255.0
#
interface MEth0/0/1
#
interface Ethernet0/0/1
#
interface Ethernet0/0/2
#
interface Ethernet0/0/3
#
interface Ethernet0/0/4
#
interface Ethernet0/0/5
#
interface Ethernet0/0/6
#
interface Ethernet0/0/7
#
interface Ethernet0/0/8
#
interface Ethernet0/0/9
#
interface Ethernet0/0/10
#
interface Ethernet0/0/11
#
interface Ethernet0/0/12
#
interface Ethernet0/0/13
#
interface Ethernet0/0/14
#
interface Ethernet0/0/15
#
interface Ethernet0/0/16
#
interface Ethernet0/0/17
#
interface Ethernet0/0/18
#
interface Ethernet0/0/19
#
interface Ethernet0/0/20
#
interface Ethernet0/0/21
#
interface Ethernet0/0/22
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
user-interface con 0
user-interface vty 0 4
#
return

2.5 fw3 的配置

#
ip vpn-instance default
ipv4-family
#
time-range worktime
period-range 08:00:00 to 18:00:00 working-day
#
acl number 3000
rule 1 permit ip source 172.16.2.0 0.0.0.255 destination 172.16.1.0 0.0.0.255
#
ipsec proposal 1
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
#
ike proposal default
encryption-algorithm aes-256 aes-192 aes-128
dh group14
authentication-algorithm sha2-512 sha2-384 sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
ike proposal 1
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
ike peer fw
pre-shared-key %^%#r%H1=tEfZQCx[vK-Krl=E('lA}PiQ=\)LIM/eky0%^%#
ike-proposal 1
remote-address 20.1.1.250
#
ipsec policy 1 1 isakmp
security acl 3000
ike-peer fw
proposal 1
#
aaa
authentication-scheme default
authentication-scheme admin_local
authentication-scheme admin_radius_local
authentication-scheme admin_hwtacacs_local
authentication-scheme admin_ad_local
authentication-scheme admin_ldap_local
authentication-scheme admin_radius
authentication-scheme admin_hwtacacs
authentication-scheme admin_ad
authorization-scheme default
accounting-scheme default
domain default
service-type internetaccess ssl-vpn l2tp ike
internet-access mode password
reference user current-domain
manager-user audit-admin
password cipher @%@%k[&_0$!i72@,TNHQ(k-Bp8"l=UHP*W[Z0>4HQ+B."D'!8"op@%@%
service-type web terminal
level 15

manager-user api-admin
password cipher @%@%#+%kTgFovHT!N>;y44:!yho'He#yY93|[$#N1>-C2b>!ho*y@%@%
level 15

manager-user admin
password cipher @%@%;&w/Dhr2F3]_$+Sq"H,MX[Lt;#\LBjKo*,OZv@BrlOu%[LwX@%@%
service-type web terminal
level 15

role system-admin
role device-admin
role device-admin(monitor)
role audit-admin
bind manager-user audit-admin role audit-admin
bind manager-user admin role system-admin
#
l2tp-group default-lns
#
interface GigabitEthernet0/0/0
undo shutdown
ip binding vpn-instance default
ip address 192.168.0.1 255.255.255.0
alias GE0/METH
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 20.1.1.254 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
ipsec policy 1
#
interface GigabitEthernet1/0/1
undo shutdown
#
interface GigabitEthernet1/0/2
undo shutdown
#
interface GigabitEthernet1/0/3
undo shutdown
#
interface GigabitEthernet1/0/4
undo shutdown
#
interface GigabitEthernet1/0/5
undo shutdown
#
interface GigabitEthernet1/0/6
undo shutdown
#
interface Virtual-if0
#
interface NULL0
#
interface LoopBack1
ip address 172.16.2.1 255.255.255.0
#
firewall zone local
set priority 100
#
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
#
firewall zone dmz
set priority 50
#
ip route-static 172.16.1.0 255.255.255.0 20.1.1.250
#
undo ssh server compatible-ssh1x enable
ssh authentication-type default password
ssh server cipher aes256_ctr aes128_ctr
ssh server hmac sha2_256 sha1
ssh client cipher aes256_ctr aes128_ctr
ssh client hmac sha2_256 sha1
#
firewall detect ftp
#
user-interface con 0
authentication-mode aaa
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
user-interface vty 16 20
#
pki realm default
#
sa
#
location
#
multi-linkif
mode proportion-of-weight
#
right-manager server-group
#
device-classification
device-group pc
device-group mobile-terminal
device-group undefined-group
#
user-manage server-sync tsm
#
security-policy
rule name 10.1.1.0
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
source-address 20.1.1.0 mask 255.255.255.0
destination-address 20.1.1.0 mask 255.255.255.0
action permit
rule name fangixng
source-zone local
source-zone trust
source-zone untrust
destination-zone local
destination-zone trust
destination-zone untrust
source-address 172.16.1.0 mask 255.255.255.0
source-address 172.16.2.0 mask 255.255.255.0
destination-address 172.16.1.0 mask 255.255.255.0
destination-address 172.16.2.0 mask 255.255.255.0
action permit
rule name 1
action permit
#
auth-policy
#
traffic-policy
#
policy-based-route
#
nat-policy
#
quota-policy
#
pcp-policy
#
dns-transparent-policy
#
rightm-policy
#
return

3 测试

这是fw1 的状态底下是fw2 的状态

HRP_S<fw2>display vrrp brief
2025-09-17 04:22:37.490
Total:2 Master:0 Backup:2 Non-active:0
VRID State Interface Type Virtual IP
----------------------------------------------------------------
1 Backup GE1/0/0 Vgmp 10.1.1.250
2 Backup GE1/0/1 Vgmp 20.1.1.250
HRP_S<fw2> dius
HRP_S<fw2> dis
HRP_S<fw2> display hr
HRP_S<fw2> display hrp sta
HRP_S<fw2> display hrp stat
HRP_S<fw2> display hrp state
2025-09-17 04:22:41.430
Role: standby, peer: active
Running priority: 45000, peer: 45000
Backup channel usage: 0.00%
Stable time: 0 days, 0 hours, 5 minutes
Last state change information: 2025-09-17 4:17:22 HRP core state changed, old_s
tate = abnormal(active), new_state = normal, local_priority = 45000, peer_priori
ty = 45000.

HRP_S<fw2> dis
HRP_S<fw2> display ip rou
HRP_S<fw2> display ip routing-table
HRP_S<fw2> display ip routing-table
2025-09-17 04:22:44.210
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 8 Routes : 8

Destination/Mask Proto Pre Cost Flags NextHop Interface

10.1.1.0/24 Direct 0 0 D 10.1.1.2 GigabitEthernet
1/0/0
10.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
1/0/0
20.1.1.0/24 Direct 0 0 D 20.1.1.2 GigabitEthernet
1/0/1
20.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
1/0/1
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
172.16.1.0/24 Static 60 0 RD 10.1.1.254 GigabitEthernet
1/0/0
172.16.2.0/24 Static 60 0 RD 20.1.1.254 GigabitEthernet
1/0/1

HRP_S<fw2> dis
HRP_S<fw2> display vrr
HRP_S<fw2> display vrrpbr
HRP_S<fw2>dis
HRP_S<fw2>display ik
HRP_S<fw2>display ike sa
2025-09-17 04:22:55.040

IKE SA information :
Conn-ID Peer VPN Flag(
s) Phase RemoteType RemoteID
--------------------------------------------------------------------------------
----------------------------------------------------
2 20.1.1.254:500 RD|S
v2:2 IP 20.1.1.254
1 20.1.1.254:500 RD|S
v2:1 IP 20.1.1.254

Number of IKE SA : 2
--------------------------------------------------------------------------------
----------------------------------------------------

Flag Description:
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
HRT--HEARTBEAT LKG--LAST KNOWN GOOD SEQ NO. BCK--BACKED UP
M--ACTIVE S--STANDBY A--ALONE NEG--NEGOTIATING

HRP_S<fw2> dis
HRP_S<fw2> display ips
HRP_S<fw2> display ipsec sa
2025-09-17 04:22:57.770

ipsec sa information:

===============================
Interface: GigabitEthernet1/0/1
===============================

-----------------------------
IPSec policy name: "1"
Sequence number : 1
Acl group : 3000
Acl rule : 1
Mode : ISAKMP
-----------------------------
Connection ID : 2
Encapsulation mode: Tunnel
Holding time : 0d 0h 10m 54s
Tunnel local : 20.1.1.250:500
Tunnel remote : 20.1.1.254:500
Flow source : 172.16.1.0/255.255.255.0 0/0-65535
Flow destination : 172.16.2.0/255.255.255.0 0/0-65535

[Outbound ESP SAs]
SPI: 192865222 (0xb7ee3c6)
Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
SA remaining key duration (kilobytes/sec): 10485736/2946
Max sent sequence-number: 36864
UDP encapsulation used for NAT traversal: N
SA encrypted packets (number/bytes): 300/25200

[Inbound ESP SAs]
SPI: 191114787 (0xb642e23)
Proposal: ESP-ENCRYPT-AES-256 ESP-AUTH-SHA2-256-128
SA remaining key duration (kilobytes/sec): 10485736/2946
Max received sequence-number: 704
UDP encapsulation used for NAT traversal: N
SA decrypted packets (number/bytes): 300/25200
Anti-replay : Enable
Anti-replay window size: 1024

fw3 的状态

如果断了一个接口看看流量是否不断

流量没有断

hrp enable
hrp interface GigabitEthernet0/0/0 remote 1.1.1.2
hrp timer hello 500
hrp preempt delay 5
hrp track interface GigabitEthernet1/0/0
hrp track interface GigabitEthernet1/0/1
#

hrp enable
hrp standby-device
hrp interface GigabitEthernet0/0/0 remote 1.1.1.1
hrp timer hello 500
hrp preempt delay 5
hrp track interface GigabitEthernet1/0/0
hrp track interface GigabitEthernet1/0/1

2048 AI社区

有“AI”的1024 = 2048，欢迎大家加入2048 AI社区

更多推荐

提示工程架构师如何准确评估AI提示系统效果？方法大剖析

你写了一个「生成营销文案」的Prompt，测试时觉得「挺好用」，上线后却发现用户点击率比旧文案低30%；你调了一个「客服问答」的Prompt，离线测试准确率95%，实际使用中却把「定制商品退货」的问题全答错了——提示工程的坑，从来不是「写不出Prompt」，而是「不知道Prompt好不好用」。把「感觉好用」变成「数据可测」：用「餐厅服务员考核」类比指标设计逻辑；把「抽样测试」变成「全场景覆盖」：用

2048 AI社区

《AI应用架构师：在AI驱动数字转型中铸就辉煌的引领者》

当企业谈论“数字转型”时，AI往往是最核心的驱动力——它能让零售企业实现个性化推荐，让制造企业预测设备故障，让金融机构识别欺诈交易。80%的AI项目无法落地为实际业务价值。问题出在哪里？不是算法不够先进，也不是算力不够强大，而是缺乏能连接“AI技术”与“业务需求”的架构设计数据团队抱怨“模型用的特征和业务实际不符”；工程团队吐槽“模型部署后延迟高得无法用”；业务团队困惑“为什么AI推荐的商品根本卖