防火墙RBM联动ospf组网的源进源出如何配置（防火墙ospf引入默认路由）
问题描述：
防火墙RBM联动ospf组网的源进源出如何配置
组网及组网描述：
HA联动路由三层主备直路组网典型配置举例
1. 组网需求
如图1-
2. 组网图
图1-
3. 配置步骤
确保主备设备的软硬件环境一致
# 在配置HA功能之前，请先保证主/备设备的硬件环境和软件环境的一致性。
配置Router A
# 配置接口GigabitEthernet1/0/7的IPv4地址为2.1.1.2/24。
# 配置接口GigabitEthernet1/0/8的IPv4地址为2.1.10.2/24。
# 配置OSPF路由协议，保证路由可达，具体步骤略。
配置Router B
# 配置接口GigabitEthernet1/0/7的IPv4地址为10.1.1.2/24。
# 配置接口GigabitEthernet1/0/8的IPv4地址为10.1.10.2/24。
# 配置OSPF路由协议，保证路由可达，具体步骤略。
(4) 配置Device A
a. 配置接口IPv4地址
# 根据组网图中规划的信息，配置各接口的IPv4地址，具体配置步骤如下。
<DeviceA> system-view
[DeviceA] interface gigabitethernet 1/0/1
[DeviceA-GigabitEthernet1/0/1] ip address 2.1.1.1 255.255.255.0
[DeviceA-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
b. 配置接口加入安全域。
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[DeviceA] security-zone name untrust
[DeviceA-security-zone-Untrust] import interface gigabitethernet 1/0/1
[DeviceA-security-zone-Untrust] quit
[DeviceA] security-zone name trust
[DeviceA-security-zone-Trust] import interface gigabitethernet 1/0/2
[DeviceA-security-zone-Trust] quit
c. 配置OSPF，保证路由可达
# 配置设备上的OSPF功能，OSPF协议自身的链路开销值建议保持默认配置即可。
[DeviceA] router id 2.1.1.1
[DeviceA] ospf
[DeviceA-ospf-1] area 0
[DeviceA-ospf-1-area-0.0.0.0] network 2.1.1.0 0.0.0.255
[DeviceA-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255
[DeviceA-ospf-1-area-0.0.0.0] quit
[DeviceA-ospf-1] quit
d. 配置安全策略，允许所需的业务报文通过
此部分安全策略只需在主管理设备配置，HA组网完成后，从管理设备会自动同步这些安全策略配置信息。
# 配置名称为trust-untrust的安全策略规则，使
[DeviceA] security-policy ip
[DeviceA-security-policy-ip] rule name trust-untrust
[DeviceA-security-policy-ip-3-trust-untrust] source-zone trust
[DeviceA-security-policy-ip-3-trust-untrust] destination-zone untrust
[DeviceA-security-policy-ip-3-trust-untrust] source-ip-subnet
[DeviceA-security-policy-ip-3-trust-untrust] action pass
[DeviceA-security-policy-ip-3-trust-untrust] quit
# 配置安全策略规则，允许OSPF协议报文通过，保证OSPF邻居的建立和路由的学习。
[DeviceA-security-policy-ip] rule name ospf1
[DeviceA-security-policy-ip-4-ospf1] source-zone trust
[DeviceA-security-policy-ip-4-ospf1] destination-zone local
[DeviceA-security-policy-ip-4-ospf1] service ospf
[DeviceA-security-policy-ip-4-ospf1] action pass
[DeviceA-security-policy-ip-4-ospf1] quit
[DeviceA-security-policy-ip] rule name ospf2
[DeviceA-security-policy-ip-5-ospf2] source-zone local
[DeviceA-security-policy-ip-5-ospf2] destination-zone trust
[DeviceA-security-policy-ip-5-ospf2] service ospf
[DeviceA-security-policy-ip-5-ospf2] action pass
[DeviceA-security-policy-ip-5-ospf2] quit
[DeviceA-security-policy-ip] rule name ospf3
[DeviceA-security-policy-ip-6-ospf3] source-zone untrust
[DeviceA-security-policy-ip-6-ospf3] destination-zone local
[DeviceA-security-policy-ip-6-ospf3] service ospf
[DeviceA-security-policy-ip-6-ospf3] action pass
[DeviceA-security-policy-ip-6-ospf3] quit
[DeviceA-security-policy-ip] rule name ospf4
[DeviceA-security-policy-ip-7-ospf4] source-zone local
[DeviceA-security-policy-ip-7-ospf4] destination-zone untrust
[DeviceA-security-policy-ip-7-ospf4] service ospf
[DeviceA-security-policy-ip-7-ospf4] action pass
[DeviceA-security-policy-ip-7-ospf4] quit
[DeviceA-security-policy-ip] quit
e. 配置高可靠性
# 配置Track项监控接口状态。
[DeviceA] track 1 interface gigabitethernet 1/0/1
[DeviceA-track-1] quit
[DeviceA] track 2 interface gigabitethernet 1/0/2
[DeviceA-track-2] quit
# 使用两台Device进行HA组网，Device A作为主设备，Device B作为备设备。当Device A或其链路发生故障时，由Device B接替Device A继续工作，保证业务不中断。
[DeviceA] remote-backup group
[DeviceA-remote-backup-group] remote-ip 10.2.1.2
[DeviceA-remote-backup-group] local-ip 10.2.1.1
[DeviceA-remote-backup-group] >gigabitethernet 1/0/3
[DeviceA-remote-backup-group] device-role primary
RBM_P[DeviceA-remote-backup-group] undo backup-mode
RBM_P[DeviceA-remote-backup-group] hot-backup enable
RBM_P[DeviceA-remote-backup-group] configuration auto-sync enable
RBM_P[DeviceA-remote-backup-group] configuration sync-check interval 12
# 开启HA调整备设备上动态路由协议OSPF的开销值功能，并以绝对方式对外通告开销值，绝对值为6000。
RBM_P[DeviceA-remote-backup-group] adjust-cost ospf enable absolute 6000
# 配置HA与序号为1和2的Track项联动。
RBM_P[DeviceA-remote-backup-group] track 1
RBM_P[DeviceA-remote-backup-group] track 2
RBM_P[DeviceA-remote-backup-group] quit
f. 配置安全业务
# 以上有关HA的配置部署完成后，可以配置各种安全业务。对于HA支持配置信息备份的功能模块仅需要在此主管理设备上（Device A）进行配置即可。
(5) 配置Device B
a. 配置接口IPv4地址
# 根据组网图中规划的信息，配置各接口的IPv4地址，具体配置步骤如下。
<DeviceB> system-view
[DeviceB] interface gigabitethernet 1/0/1
[DeviceB-GigabitEthernet1/0/1] ip address 2.1.10.1 255.255.255.0
[DeviceB-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
b. 配置接口加入安全域。
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[DeviceB] security-zone name untrust
[DeviceB-security-zone-Untrust] import interface gigabitethernet 1/0/1
[DeviceB-security-zone-Untrust] quit
[DeviceB] security-zone name trust
[DeviceB-security-zone-Trust] import interface gigabitethernet 1/0/2
[DeviceB-security-zone-Trust] quit
c. 配置OSPF，保证路由可达
# 配置设备上的OSPF功能，OSPF协议自身的链路开销值建议保持默认配置即可。
[DeviceB] router id 2.1.10.1
[DeviceB] ospf
[DeviceB-ospf-1] area 0
[DeviceB-ospf-1-area-0.0.0.0] network 2.1.10.0 0.0.0.255
[DeviceB-ospf-1-area-0.0.0.0] network 10.1.10.0 0.0.0.255
[DeviceB-ospf-1-area-0.0.0.0] quit
[DeviceB-ospf-1] quit
d. 配置高可靠性
# 配置Track项监控接口状态。
[DeviceB] track 1 interface gigabitethernet 1/0/1
[DeviceB-track-1] quit
[DeviceB] track 2 interface gigabitethernet 1/0/2
[DeviceB-track-2] quit
# 使用两台Device进行HA组网，Device A作为主设备，Device B作为备设备。当Device A或其链路发生故障时，由Device B接替Device A继续工作，保证业务不中断。
[DeviceB] remote-backup group
[DeviceB-remote-backup-group] remote-ip 10.2.1.1
[DeviceB-remote-backup-group] local-ip 10.2.1.2
[DeviceB-remote-backup-group] >gigabitethernet 1/0/3
[DeviceB-remote-backup-group] device-role secondary
RBM_S[DeviceB-remote-backup-group] undo backup-mode
RBM_S[DeviceB-remote-backup-group] hot-backup enable
RBM_S[DeviceB-remote-backup-group] configuration auto-sync enable
RBM_S[DeviceB-remote-backup-group] configuration sync-check interval 12
# 开启HA调整备设备上动态路由协议OSPF的开销值功能，并以绝对方式对外通告开销值，绝对值为6000。
RBM_S[DeviceB-remote-backup-group] adjust-cost ospf enable absolute 6000
# 配置HA与序号为1和2的Track项联动。
RBM_S[DeviceB-remote-backup-group] track 1
RBM_S[DeviceB-remote-backup-group] track 2
RBM_S[DeviceB-remote-backup-group] quit
(6) 配置Host
# 配置Host的默认网关为
4. 验证配置
Device A
# 以上配置完成后，通过执行以下显示命令可查看HA配置已生效，HA通道已建立。
RBM_P[DeviceA] display remote-backup-group status
Remote backup group information:
Backup mode: Active/standby
Device management role: Primary
Device running status: Active
Data channel interface: GigabitEthernet1/0/3
Local IP: 10.2.1.1
Remote IP: 10.2.1.2 Destination port: 60064
Control channel status: Connected
Keepalive interval： 1s
Keepalive count: 10
Configuration consistency check interval: 12 hour
Configuration consistency check result: Not Performed
Configuration backup status: Auto sync enabled
Session backup status: Hot backup enabled
Uptime since last switchover: 0 days, 3 hours, 11 minutes
Switchover records:
Time Status change Cause
# 以上配置完成后，通过查看Device A的OSPF路由信息，可看到Device A的Cost值小于Device B，上下行流量经过Device A转发。
RBM_P[DeviceA] display ospf interface
OSPF Process 1 with Router ID 2.1.1.1
Interfaces
Area: 0.0.0.0
IP Address Type State Cost Pri DR BDR
2.1.1.1 Broadcast BDR 1 1 2.1.1.2 2.1.1.1
10.1.1.1 Broadcast DR 1 1 10.1.1.1 10.1.1.2
Device B
# 以上配置完成后，通过执行以下显示命令可查看HA配置已生效，HA通道已建立。
RBM_S[DeviceB] display remote-backup-group status
Remote backup group information:
Backup mode: Active/standby
Device management role: Secondary
Device running status: Standby
Data channel interface: GigabitEthernet1/0/3
Local IP: 10.2.1.2
Remote IP: 10.2.1.1 Destination port: 60064
Control channel status: Connected
Keepalive interval： 1s
Keepalive count: 10
Configuration consistency check interval: 12 hour
Configuration consistency check result: Not Performed
Configuration backup status: Auto sync enabled
Session backup status: Hot backup enabled
Uptime since last switchover: 0 days, 3 hours, 11 minutes
Switchover records:
Time Status change Cause
# 以上配置完成后，通过查看Device B的OSPF路由信息，可看到Device A的Cost值小于Device B，上下行流量不经过Device B转发。
RBM_S[DeviceB] display ospf interface
OSPF Process 1 with Router ID 2.1.10.1
Interfaces
Area: 0.0.0.0
IP Address Type State Cost Pri DR BDR
2.1.10.1 Broadcast BDR 6000 1 2.1.10.2 2.1.10.1
10.1.10.1 Broadcast BDR 6000 1 10.1.10.2 10.1.10.1
暂无
源进源出怎么配置
13小时前回答暂无
你正在,防火墙RBM联动ospf组网的源进源出如何配置
