华为USG6000V 多ISP接入Internet（基于ISP目的地址的多出口）

逃离我推掉我的手 2022-05-21 09:59 350阅读 0赞

## 一、组网需求 ##

1、如图所示，某企业在网络边界处部署了NGFW作为安全网关，并分别从运营商ISP1和ISP2处购买了宽带上网服务，实现内部网络接入Internet的需求。  
具体需求如下：  
研发部门和市场部门中的PC可以通过运营商ISP1和ISP2访问Internet，要求去往特定目的地址的流量必须经由相应的运营商来转发。

当一条链路出现故障时，流量可以被及时切换到另一条链路上，避免业务中断。

2、网络拓扑

![70][]

3、配置思路

配置接口的地址，并将接口加入相应的安全区域。在配置接口GigabitEthernet 1/0/0和GigabitEthernet 1/0/2的地址时，分别指定默认网关为1.1.1.254和2.2.2.254。  
配置多条静态路由，使去往特定目的地址的流量经由相应的运营商来转发。  
配置安全策略，允许内部网络中的PC访问Internet。  
配置NAT策略，提供源地址转换功能。  
在运营商ISP1和ISP2网络的设备上配置回程路由，该配置由运营商完成。

规划内部网络中PC的地址，并将内部网络中PC的网关设置为10.3.0.254

## 二、操作步骤 ##

1、配置防火墙接口IP地址

<USG6000V1>system-view 
    [USG6000V1]interface GigabitEthernet  1/0/1
    [USG6000V1-GigabitEthernet1/0/1]ip address  10.3.0.254 24
    [USG6000V1-GigabitEthernet1/0/1]service-manage ping permit 
    [USG6000V1-GigabitEthernet1/0/1]q
    [USG6000V1]interface GigabitEthernet  1/0/0
    [USG6000V1-GigabitEthernet1/0/0]ip address  202.1.1.1 24
    [USG6000V1-GigabitEthernet1/0/0]service-manage ping permit 
    [USG6000V1-GigabitEthernet1/0/0]q
    [USG6000V1]interface GigabitEthernet  1/0/2
    [USG6000V1-GigabitEthernet1/0/2]ip address  202.1.2.1 24
    [USG6000V1-GigabitEthernet1/0/2]service-manage ping  permit  
    [USG6000V1-GigabitEthernet1/0/2]q

2、加入对应安全区域

[USG6000V1]firewall zone trust 
    [USG6000V1-zone-trust]add  interface  GigabitEthernet  1/0/1
    [USG6000V1-zone-trust]q
    
    [USG6000V1]firewall zone name ISP1
    [USG6000V1-zone-ISP1]set priority 10
    [USG6000V1-zone-ISP1]add  interface  GigabitEthernet  1/0/0
    [USG6000V1-zone-ISP1]q
    
    [USG6000V1]firewall zone  name  ISP2
    [USG6000V1-zone-ISP2]set priority 15
    [USG6000V1-zone-ISP2]add  interface  GigabitEthernet  1/0/2
    [USG6000V1-zone-ISP2]q

3、配置静态路由

[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.1.1.254
    [USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.1.2.254

4、配置安全策略，允许内部网络PC访问Internet

[USG6000V1]security-policy 
    [USG6000V1-policy-security]rule name trus_ISP1
    [USG6000V1-policy-security-rule-trus_ISP1]source-zone trust 
    [USG6000V1-policy-security-rule-trus_ISP1]destination-zone ISP1
    [USG6000V1-policy-security-rule-trus_ISP1]source-address  10.3.0.0 24
    [USG6000V1-policy-security-rule-trus_ISP1]action  permit 
    [USG6000V1-policy-security-rule-trus_ISP1]q
    
    [USG6000V1]security-policy 
    [USG6000V1-policy-security]rule name trust_ISP2
    [USG6000V1-policy-security-rule-trust_ISP2]source-zone  trust 
    [USG6000V1-policy-security-rule-trust_ISP2]destination-zone ISP2
    [USG6000V1-policy-security-rule-trust_ISP2]source-address 10.3.0.0 24
    [USG6000V1-policy-security-rule-trust_ISP2]action  permit 
    [USG6000V1-policy-security-rule-trust_ISP2]q

5、配置NAT地址池

[USG6000V1]nat address-group address1
    [USG6000V1-address-group-address1]section 202.1.1.10 202.1.1.12
    [USG6000V1-address-group-address1]mode pat
    [USG6000V1-address-group-address1]q
    
    [USG6000V1]nat address-group address2
    [USG6000V1-address-group-address2]section 202.1.2.10 202.1.2.12 
    [USG6000V1-address-group-address2]mode pat 
    [USG6000V1-address-group-address2]q

6、配置NAT策略

[USG6000V1]nat-policy 
    [USG6000V1-policy-nat]rule name nat_isp1
    [USG6000V1-policy-nat-rule-nat_isp1]source-zone trust 
    [USG6000V1-policy-nat-rule-nat_isp1]destination-zone ISP1
    [USG6000V1-policy-nat-rule-nat_isp1]source-address  10.3.0.0 24
    [USG6000V1-policy-nat-rule-nat_isp1]action nat address-group address1 
    [USG6000V1-policy-nat-rule-nat_isp1]q
    
    [USG6000V1]nat-policy 
    [USG6000V1-policy-nat]rule name nat_ips2
    [USG6000V1-policy-nat-rule-nat_ips2]source-zone  trust 
    [USG6000V1-policy-nat-rule-nat_ips2]destination-zone ISP2
    [USG6000V1-policy-nat-rule-nat_ips2]source-address 10.3.0.0 24
    [USG6000V1-policy-nat-rule-nat_ips2]action  nat address-group address2
    [USG6000V1-policy-nat-rule-nat_ips2]q

7、ISP配置接口IP

<Huawei>system-view
    [Huawei]sysname ISP1
    [ISP1]interface  GigabitEthernet  0/0/0
    [ISP1-GigabitEthernet0/0/0]ip address  202.1.1.254 24
    [ISP1-GigabitEthernet0/0/0]q
    
    <Huawei>system-view  
    [Huawei]sysname ISP2
    [ISP2]interface  GigabitEthernet 0/0/0
    [ISP2-GigabitEthernet0/0/0]ip address  202.1.2.254 24
    [ISP2-GigabitEthernet0/0/0]q

8、ISP配置路由

[ISP1]ip route-static 10.3.0.0 24 202.1.1.1
    [ISP2]ip route-static 10.3.0.0 24 202.1.2.1

9、内网PC测试ping，查看防火墙nat会话

[USG6000V1]display  firewall session table
     Current Total Sessions : 10
     icmp  VPN: public --> public  10.3.0.1:33768[202.1.2.10:2049] --> 202.1.2.254:2
    048
     icmp  VPN: public --> public  10.3.0.1:36328[202.1.1.10:2058] --> 202.1.1.254:2
    048
     icmp  VPN: public --> public  10.3.0.1:36840[202.1.1.10:2060] --> 202.1.1.254:2
    048
     icmp  VPN: public --> public  10.3.0.1:35048[202.1.1.10:2053] --> 202.1.1.254:2
    048

[70]: /images/20220521/9cd6d0124b0e47a39539880ddfc77200.png