企业官网建设流程全解析

设备列表

IP地址规划

AR1

AR2

ISP

防火墙管理地址

FW1：192.168.0.1

FW2：192.168.0.2

Trust区域

FW1-FW2心跳链路：10.1.1.0/30

FW1：10.1.1.1

FW2：10.1.1.2

PC地址

PC1:

IP:
192.168.2.100

MASK:
255.255.255.0

网关:
192.168.2.1

PC2:

IP:
192.168.2.200

MASK:
255.255.255.0

网关:
192.168.2.1

LSW1配置

<Huawei> system-view [Huawei] sysname LSW1 [LSW1] vlan 2 [LSW1-vlan2] quit [LSW1] interface GigabitEthernet 0/0/3 [LSW1-GigabitEthernet0/0/3] port link-type access [LSW1-GigabitEthernet0/0/3] port default vlan 2 [LSW1-GigabitEthernet0/0/3] quit [LSW1] interface GigabitEthernet 0/0/1 [LSW1-GigabitEthernet0/0/1] port link-type access [LSW1-GigabitEthernet0/0/1] port default vlan 2 [LSW1-GigabitEthernet0/0/1] quit [LSW1] interface GigabitEthernet 0/0/2 [LSW1-GigabitEthernet0/0/2] port link-type trunk [LSW1-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 [LSW1-GigabitEthernet0/0/2] quit

LSW2 配置

<Huawei> system-view [Huawei] sysname LSW2 [LSW2] vlan 2 [LSW2-vlan2] quit [LSW2] interface GigabitEthernet 0/0/3 [LSW2-GigabitEthernet0/0/3] port link-type access [LSW2-GigabitEthernet0/0/3] port default vlan 2 [LSW2-GigabitEthernet0/0/3] quit [LSW2] interface GigabitEthernet 0/0/1 [LSW2-GigabitEthernet0/0/1] port link-type access [LSW2-GigabitEthernet0/0/1] port default vlan 2 [LSW2-GigabitEthernet0/0/1] quit [LSW2] interface GigabitEthernet 0/0/2 [LSW2-GigabitEthernet0/0/2] port link-type trunk [LSW2-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 [LSW2-GigabitEthernet0/0/2] quit

LSW3 配置

<Huawei> system-view [Huawei] sysname LSW3 [LSW3] interface Vlanif 1 [LSW3-Vlanif1] ip address 192.168.0.3 255.255.255.0 [LSW3-Vlanif1] quit

ISP 路由器配置（模拟公网）

<Huawei> system-view [Huawei] sysname ISP [ISP] interface GigabitEthernet 0/0/0 [ISP-GigabitEthernet0/0/0] ip address 12.0.0.2 255.255.255.0 [ISP-GigabitEthernet0/0/0] quit [ISP] interface GigabitEthernet 0/0/1 [ISP-GigabitEthernet0/0/1] ip address 13.0.0.2 255.255.255.0 [ISP-GigabitEthernet0/0/1] quit [ISP] interface LoopBack 0 [ISP-LoopBack0] ip address 100.1.1.1 255.255.255.0 [ISP-LoopBack0] quit [ISP] ip route-static 10.0.0.0 255.0.0.0 12.0.0.1 [ISP] ip route-static 10.0.0.0 255.0.0.0 13.0.0.1 preference 70

AR1 路由器配置

<Huawei> system-view [Huawei] sysname AR1 [AR1] interface GigabitEthernet 0/0/0 [AR1-GigabitEthernet0/0/0] ip address 10.1.2.1 255.255.255.0 [AR1-GigabitEthernet0/0/0] quit [AR1] interface GigabitEthernet 0/0/1 [AR1-GigabitEthernet0/0/1] ip address 10.1.4.1 255.255.255.0 [AR1-GigabitEthernet0/0/1] quit [AR1] interface GigabitEthernet 0/0/2 [AR1-GigabitEthernet0/0/2] ip address 12.0.0.1 255.255.255.0 [AR1-GigabitEthernet0/0/2] quit [AR1] ospf 1 router-id 1.1.1.1 [AR1-ospf-1] area 0 [AR1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255 [AR1-ospf-1-area-0.0.0.0] network 10.1.4.0 0.0.0.255 [AR1-ospf-1-area-0.0.0.0] quit [AR1-ospf-1] default-route-advertise [AR1-ospf-1] quit [AR1] ip route-static 0.0.0.0 0.0.0.0 12.0.0.2

AR2 路由器配置

<Huawei> system-view [Huawei] sysname AR2 [AR2] interface GigabitEthernet 0/0/0 [AR2-GigabitEthernet0/0/0] ip address 10.1.3.1 255.255.255.0 [AR2-GigabitEthernet0/0/0] quit [AR2] interface GigabitEthernet 0/0/1 [AR2-GigabitEthernet0/0/1] ip address 10.1.4.2 255.255.255.0 [AR2-GigabitEthernet0/0/1] quit [AR2] interface GigabitEthernet 0/0/2 [AR2-GigabitEthernet0/0/2] ip address 13.0.0.1 255.255.255.0 [AR2-GigabitEthernet0/0/2] quit [AR2] ospf 1 router-id 2.2.2.2 [AR2-ospf-1] area 0 [AR2-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255 [AR2-ospf-1-area-0.0.0.0] network 10.1.4.0 0.0.0.255 [AR2-ospf-1-area-0.0.0.0] quit [AR2-ospf-1] default-route-advertise [AR2-ospf-1] quit [AR2] ip route-static 0.0.0.0 0.0.0.0 13.0.0.2

FW1 基础配置

<USG6000V> system-view [USG6000V] sysname FW1 [FW1] interface GigabitEthernet 1/0/0 [FW1-GigabitEthernet1/0/0] ip address 10.1.2.254 255.255.255.0 [FW1-GigabitEthernet1/0/0] quit [FW1] firewall zone untrust [FW1-zone-untrust] add interface GigabitEthernet 1/0/0 [FW1-zone-untrust] quit [FW1] interface GigabitEthernet 1/0/1 [FW1-GigabitEthernet1/0/1] ip address 192.168.2.252 255.255.255.0 [FW1-GigabitEthernet1/0/1] quit [FW1] firewall zone trust [FW1-zone-trust] add interface GigabitEthernet 1/0/1 [FW1-zone-trust] quit [FW1] interface GigabitEthernet 1/0/2 [FW1-GigabitEthernet1/0/2] ip address 10.1.1.1 255.255.255.252 [FW1-GigabitEthernet1/0/2] quit [FW1] firewall zone dmz [FW1-zone-dmz] add interface GigabitEthernet 1/0/2 [FW1-zone-dmz] quit [FW1] ospf 1 router-id 10.1.2.254 [FW1-ospf-1] area 0 [FW1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255 [FW1-ospf-1-area-0.0.0.0] quit [FW1-ospf-1] import-route static [FW1-ospf-1] quit

FW2 基础配置

<USG6000V> system-view [USG6000V] sysname FW2 [FW2] interface GigabitEthernet 0/0/0 [FW2-GigabitEthernet0/0/0] ip address 192.168.0.2 255.255.255.0 [FW2-GigabitEthernet0/0/0] quit [FW2] interface GigabitEthernet 1/0/0 [FW2-GigabitEthernet1/0/0] ip address 10.1.3.254 255.255.255.0 [FW2-GigabitEthernet1/0/0] quit [FW2] firewall zone untrust [FW2-zone-untrust] add interface GigabitEthernet 1/0/0 [FW2-zone-untrust] quit [FW2] interface GigabitEthernet 1/0/1 [FW2-GigabitEthernet1/0/1] ip address 192.168.2.253 255.255.255.0 [FW2-GigabitEthernet1/0/1] quit [FW2] firewall zone trust [FW2-zone-trust] add interface GigabitEthernet 1/0/1 [FW2-zone-trust] quit [FW2] interface GigabitEthernet 1/0/2 [FW2-GigabitEthernet1/0/2] ip address 10.1.1.2 255.255.255.252 [FW2-GigabitEthernet1/0/2] quit [FW2] firewall zone dmz [FW2-zone-dmz] add interface GigabitEthernet 1/0/2 [FW2-zone-dmz] quit [FW2] ospf 1 router-id 10.1.3.254 [FW2-ospf-1] area 0 [FW2-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255 [FW2-ospf-1-area-0.0.0.0] quit [FW2-ospf-1] import-route static [FW2-ospf-1] quit

HRP 双机热备核心配置

心跳链路与主备角色配置

FW1 配置（主设备）

[FW1] hrp interface GigabitEthernet 1/0/2 remote 10.1.1.2 [FW1] hrp priority 10 [FW1] hrp enable

执行后命令提示符变为HRP_M[FW1]，表示当前为双机主用设备。

FW2 配置（备设备）

[FW2] hrp interface GigabitEthernet 1/0/2 remote 10.1.1.1 [FW2] hrp enable

执行后命令提示符变为HRP_S[FW2]，表示当前为双机备用设备。

VRRP 与 HRP 联动配置

仅需在主设备 FW1 上配置，自动同步至备设备：

HRP_M[FW1] interface GigabitEthernet 1/0/1 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 virtual-ip 192.168.2.254 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 priority 120 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 hrp track master HRP_M[FW1-GigabitEthernet1/0/1] quit

安全策略配置

HRP_M[FW1] security-policy HRP_M[FW1-policy-security] rule name hrp_heartbeat HRP_M[FW1-policy-security-rule-hrp_heartbeat] source-zone local HRP_M[FW1-policy-security-rule-hrp_heartbeat] destination-zone dmz HRP_M[FW1-policy-security-rule-hrp_heartbeat] action permit HRP_M[FW1-policy-security-rule-hrp_heartbeat] quit HRP_M[FW1-policy-security] rule name trust_to_untrust HRP_M[FW1-policy-security-rule-trust_to_untrust] source-zone trust HRP_M[FW1-policy-security-rule-trust_to_untrust] destination-zone untrust HRP_M[FW1-policy-security-rule-trust_to_untrust] source-address 192.168.2.0 24 HRP_M[FW1-policy-security-rule-trust_to_untrust] action permit HRP_M[FW1-policy-security-rule-trust_to_untrust] quit HRP_M[FW1-policy-security] quit

会话快速备份配置

开启实时会话同步，保证主备切换时业务不中断

HRP_M[FW1] hrp mirror session enable

实验验证步骤

基础连通性验证

1. 内网终端互通验证在 PC1 上执行 ping 命令，测试与 PC2 的连通性

   PC> ping 192.168.2.200 Reply from 192.168.2.200: bytes=32 time<1ms TTL=128

2. 外网链路连通验证在 FW1 上 ping AR1 的互联地址，验证外网链路正常

   HRP_M[FW1] ping 10.1.2.1 Reply from 10.1.2.1: bytes=56 Sequence=1 ttl=255 time=1 ms

3. 公网访问验证在 PC1 上 ping 公网模拟地址 100.1.1.1，验证路由与安全策略生效

   PC> ping 100.1.1.1 Reply from 100.1.1.1: bytes=32 time=10ms TTL=252

   HRP 双机状态验证

查看 HRP 主备状态

HRP_M[FW1] display hrp state

预期输出关键信息：

• 本端状态：Master
• 对端状态：Slave
• 心跳通道状态：Up
• 配置同步状态：已同步完成

查看 VRRP 状态

HRP_M[FW1] display vrrp

预期结果：FW1 的 GE1/0/1 接口 VRRP 组 1 状态为 Master；FW2 上对应接口状态为 Backup。

配置同步验证

1. 在主设备上新增一条测试安全策略

   HRP_M[FW1] security-policy HRP_M[FW1-policy-security] rule name test_sync HRP_M[FW1-policy-security-rule-test_sync] action permit HRP_M[FW1-policy-security-rule-test_sync] quit HRP_M[FW1-policy-security] quit

2. 在备设备上查看策略是否存在

   HRP_S[FW2] display security-policy rule name test_sync

   实验总结

• 本次实验成功实现防火墙主备模式双机热备，完成了心跳链路搭建、主备角色选举、配置自动同步、VRRP 网关联动等核心功能。
• HRP 心跳链路是双机热备的核心，负责主备状态协商、配置批量 / 实时同步、会话表备份等关键功能。
• 主备切换过程中，内网终端无感知，业务仅出现毫秒级丢包，有效保障了网络的高可用性。
• 启用 HRP 后所有业务配置仅需在主设备操作，备设备自动同步，大幅降低了运维复杂度与配置不一致风险。