t8nSV,防火墙板卡虚拟化
2台核心交换机做虚拟化的时候,配置了2台防火墙板卡,这种组网环境下,防火墙板卡应该做虚拟化吗?板卡做虚拟化应该怎么做?
2
配置较多可以参考H3C官网典型配置开局案例:
SecBlade III FW的接口配置步骤
(1) 创建ACL,允许内网1
(2) 创建聚合口RAG1和RAG2,将Slot 1和Slot 2的4个内联口分别加入聚合口RAG1和RAG2 [H3C]interface Route-Aggregation 1
[H3C-Route-Aggregation1]quit
[H3C]interface Ten-GigabitEthernet 1/
[H3C-Ten-GigabitEthernet1/
[H3C-Ten-GigabitEthernet1/
依次将Ten1/
# [H3C]interface Route-Aggregation 2
[H3C-Route-Aggregation2]quit
[H3C]interface Ten-GigabitEthernet 2/
[H3C-Ten-GigabitEthernet2/
[H3C-Ten-GigabitEthernet2/
[H3C]interface Route-Aggregation 1.4
[H3C-Route-Aggregation1.4
[H3C-Route-Aggregation1.4
其他聚合子接口的配置略。
(3) 创建冗余口并应用NAT和冗余组的配置 #创建冗余口Reth2,IP地址为222.173.111.5
[H3C] interface Reth 2
[H3C-Reth2] ip address 222.173.111.5
[H3C-Reth2] nat outbound 35
[H3C-Reth2] nat server global 222.173.111.6
[H3C-Reth2] member interface Route-Aggregation1.4
(4) 将冗余口加入安全域并配置域间策略 #将内网接口Reth1和MAD检测接口vlan-interface3加入trust域
[H3C]security-zone name Trust
[H3C-security-zone-Trust]import interface reth 1
[H3C-security-zone-Trust] import interface Vlan-interface3
配 置关键点及注意事项: 堆叠的两台设备需采用相同的型号,使用相同的版本。 SecBlade III FW的堆叠口请使用前面板的光口。 防火墙内联口需要聚合,并配置子接口作为上下行,再做冗余。 目前防火墙插卡不允许跨框流量,需要配置冗余组。
2
,防火墙板卡虚拟化