1675581338,

问题描述：

V7盒式防火墙冗余口与下联交换机VLAN虚接口直连ping不通问题，如拓扑中，两台防火墙和两台交换机均做了IRF，防火墙以冗余口Reth3(172.16.0.1/30)与交换机的互联，交换机上使用的是VLAN1虚接口（172.16.0.2/30），域间策略都已放通，但是两者互ping不通，在交换机上能学到对方的arp信息，这是什么原因呢？

测试：

<SW>ping 172.16.0.1

Ping 172.16.0.1 (172.16.0.1): 56 data bytes, press CTRL_C to break

Request time out

Request time out

Request time out

Request time out

Request time out

--- Ping statistics for 172.16.0.1 ---

5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss

<SW>

<SW>dis arp

  Type: S-Static   D-Dynamic   O-Openflow   R-Rule   M-Multiport  I-Invalid

IP address       MAC address    SVLAN/VSI Interface/Link ID        Aging Type

172.16.0.1       10fa-a259-0100 1         GE1/0/5                  1     D

192.168.10.2     10ff-53f9-0506 10        GE1/0/1                  1     D

<SW>dis ip int b

*down: administratively down

(s): spoofing  (l): loopback

Interface                Physical Protocol IP Address      Description

MGE0/0/0                 down     down     --              --

Vlan1                    up       up       172.16.0.2      --

Vlan10                   up       up       192.168.10.1    --

Vlan20                   up       up       192.168.20.1    --

[Firewall]dis ip int b *down: administratively down (s): spoofing  (l): loopback Interface                Physical Protocol IP Address      Description GE1/0/5                  up       up       --              -- GE2/0/5                  up       up       --              -- Reth1                    up       up       122.224.151.34  -- Reth2                    up       up       192.168.11.1    --

Reth3                    up       up       172.16.0.1      --

涉及的相关接口都是UP的，而且

防火墙配置：

#

 IRF domain 10

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 30

 irf member 2 priority 15

#

 security-zone intra-zone default permit

#

Track 1 interface GigabitEthernet1/0/0 physical

#

track 2 interface GigabitEthernet1/0/1 physical

#

track 3 interface GigabitEthernet1/0/5 physical

#

track 4 interface GigabitEthernet2/0/0 physical

#

track 5 interface GigabitEthernet2/0/1 physical

#

track 6 interface GigabitEthernet2/0/5 physical

#

vlan 1

#

irf-port 1/2

 port group interface GigabitEthernet1/0/10

 port group interface GigabitEthernet1/0/11

#

irf-port 2/1

 port group interface GigabitEthernet2/0/10

 port group interface GigabitEthernet2/0/11

#

interface Reth1

 ip address 122.224.151.34 255.255.255.224

 member interface GigabitEthernet1/0/0 priority 255

 member interface GigabitEthernet2/0/0 priority 50

#

interface Reth2

 ip address 192.168.11.1 255.255.255.0

 member interface GigabitEthernet1/0/1 priority 255

 member interface GigabitEthernet2/0/1 priority 50

#

interface Reth3

 ip address 172.16.0.1 255.255.255.252

 member interface GigabitEthernet1/0/5 priority 255

 member interface GigabitEthernet2/0/5 priority 50

#

interface GigabitEthernet1/0/0

 port link-mode route

 combo enable copper

#

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

#

interface GigabitEthernet1/0/5

 port link-mode route

 combo enable copper

 combo enable copper

#

interface GigabitEthernet2/0/0

 port link-mode route

 combo enable copper

#

interface GigabitEthernet2/0/1

 port link-mode route

 combo enable copper

#

interface GigabitEthernet2/0/5

 port link-mode route

 combo enable copper

#

object-policy ip 1

 rule 0 pass

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/5

 import interface GigabitEthernet2/0/5

 import interface Reth3

#

zone-pair security source Any destination Any

 object-policy apply ip 1

#

zone-pair security source Local destination Trust

 object-policy apply ip 1

#

zone-pair security source Trust destination Local

 object-policy apply ip 1

#

 ip route-static 192.168.10.0 24 172.16.0.2

#

redundancy group KKK

 member interface Reth1

 member interface Reth2

 member interface Reth3

 node 1

  bind slot 1

  priority 100

  track 1 interface GigabitEthernet1/0/0

  track 2 interface GigabitEthernet1/0/1

  track 3 interface GigabitEthernet1/0/5

 node 2

  bind slot 2

  priority 50

  track 4 interface GigabitEthernet2/0/0

  track 5 interface GigabitEthernet2/0/1

  track 6 interface GigabitEthernet2/0/5

#

交换机配置：

#

 irf domain 20

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 30

 irf member 2 priority 15

#

vlan 1

#

vlan 10

#

vlan 20

#

irf-port 1/2

 port group interface Ten-GigabitEthernet1/0/50

 port group interface Ten-GigabitEthernet1/0/51

#

irf-port 2/1

 port group interface Ten-GigabitEthernet2/0/50

 port group interface Ten-GigabitEthernet2/0/51

#

interface Vlan-interface1

 ip address 172.16.0.2 255.255.255.252

#

interface Vlan-interface10

 ip address 192.168.10.1 255.255.255.0

#

interface Vlan-interface20

 ip address 192.168.20.1 255.255.255.0

#

interface GigabitEthernet1/0/5

 port link-mode bridge

 combo enable fiber

#

interface GigabitEthernet2/0/5

 port link-mode bridge

 combo enable fiber

#

 ip route-static 0.0.0.0 0 172.16.0.1

#

组网及组网描述：

(0)

3

模拟器reth口有问题，还在解决中

(0)

回复xxx [x] 已采纳 姜小涛 姜小涛 五段 粉丝：0人 关注：0人

防火墙能通过reth口学习到交换机172.16.0.2地址的ARP信息吗？用的是模拟器测试的吗？配置没看出啥问题最好找真机环境

(0)

刚开始看到过一次，后来没动过配置，但是看不到了（将arp老化时间改为1分钟，交换机上也依旧能学习到Reth3的arp信息） Firewall>dis arp Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid IP address MAC address SVID Interface Aging Type <Firewall>

LionelMessi 发表时间：

刚开始看到过一次，后来没动过配置，但是看不到了（将arp老化时间改为1分钟，交换机上也依旧能学习到Reth3的arp信息）

Firewall>dis arp

   Type: S-Static    D-Dynamic    O-Openflow   R-Rule   I-Invalid

IP address      MAC address    SVID     Interface                Aging Type

(1)

是模拟器测试的吗？是的话将模拟器F1060重启下，或者只用2台设备（防火墙 reth口连交换机vlan口）测试下直连问题

姜小涛 发表时间：

还是不行，看配置没什么问题吧？交换机上用access口与上面三层口互联？

LionelMessi 发表时间：,V7盒式防火墙冗余口与下联交换机VLAN虚接口直连ping不通问题