Web: Example for Deploying Firewalls in In-path Mode and Connecting to Switches in Upstream and Downstream Directions

Procedure

1. Configure interfaces and perform the basic network configurations.
   1. Configure interfaces on FW_A.

      1. Choose Network > Interface.

      2. Click GE0/0/1, set the following parameters, and click OK.

         Security zone	untrust
         IPv4
         IP Address	10.2.0.1/24

      3. Repeat the preceding steps to set the following parameters for the GE0/0/3 interface.

         Security zone	trust
         IPv4
         IP Address	10.3.0.1/24

      4. Repeat the preceding steps to set the following parameters for the GE0/0/7 interface.

         Security zone	dmz
         IPv4
         IP Address	10.10.0.1/24

   2. Configure the interfaces on FW_B.

      1. Choose Network > Interface.

      2. Click GE0/0/1, set the following parameters, and click OK.

         Zone	untrust
         IPv4
         IP Address	10.2.0.2/24

      3. Repeat the preceding steps to set the following parameters for the GE0/0/3 interface.

         Security zone	trust
         IPv4
         IP Address	10.3.0.2/24

      4. Repeat the preceding steps to set the following parameters for the GE0/0/7 interface.

         Security zone	dmz
         IPv4
         IP Address	10.10.0.2/24

2. Configure static routes.
   1. Configure a default route on the FW_A.

      1. Choose Network > Route > Static Route.

         

      2. In Static Route List, click Add, configure a default route based on the following parameter values, and click OK.

         Protocol	IPv4
         Destination Address/Mask	0.0.0.0/0.0.0.0
         Interface	GigabitEthernet0/0/1
         Next Hop	1.1.1.10

   2. Configure a default route on the FW_B.

      1. Choose Network > Route > Static Route.

      2. In Static Route List, click Add, configure a default route based on the following parameter values, and click OK.

         Protocol	IPv4
         Destination Address/Mask	0.0.0.0/0.0.0.0
         Interface	GigabitEthernet0/0/1
         Next Hop	1.1.1.10

3. Configure dual-system hot standby.
   1. Configure dual-system hot standby on FW_A.
      1. Choose System > High Availability > Dual-System Hot Standby and click Edit.

         

      2. Enable Dual-System Hot Standby, set the parameters as follows, and click OK.

         

   2. Configure dual-system hot standby on FW_B.
      1. Choose System > High Availability > Dual-System Hot Standby and click Edit.

      2. Enable Dual-System Hot Standby, set the parameters as follows, and click OK.

         

   3. To prevent port conflicts in address translation on the FWs in load balancing mode, configure available port ranges on FW_A and FW_B. Currently, the configuration cannot be performed on the web UI. Click CLI Console in the lower right corner of the page to display the CLI configuration page and configure it on the CLI.
      

      In the hot standby load balancing scenario, If NAPT is configured, the FWs may have conflicting public ports. To prevent such conflicts, configure respective NAT resources (including public IP addresses and ports) for the FWs. You can run the hrp nat resource primary-group command on the active FW. The standby FW will automatically generate the hrp nat resource secondary-group command (if you run the hrp nat resource secondary-group command on the active FW, the standby FW will automatically generate the hrp nat resource primary-group command).

      Perform the following configuration on FW_A:

      HRP_M[FW_A] hrp nat resource primary-group

      Perform the following configuration on FW_B:

      HRP_S[FW_B] hrp nat resource secondary-group

4. Configure default routes on the Intranet devices to set virtual IP address 10.3.0.3 of VRRP backup group 3 as the next hop for certain devices and virtual IP address 10.3.0.4 of VRRP backup group 4 as the next hop for the other devices.
5. Configure a security policy.

   The security policy configurations on FW_A will be automatically backed up to FW_B.

   1. Choose Policy > Security Policy > Security Policy.
   2. Click Add Security Policy, configure security policies and set the parameters as follows, and then click OK.

      Name	policy_sec
      Source Zone	trust
      Destination Zone	untrust
      Source Address/Region	10.3.0.0/24
      Action	Permit

6. Configure a NAT policy to allow intranet users to access the Internet.

   NAT policies configured on FW_A are automatically backed up to FW_B.

   1. Choose Policy > NAT Policy > NAT Policy.

      

   2. Click the Source Translation Address Pool tab, click Add, configure a NAT address pool and set the parameters as follows, and then click OK.

      Name	addressgroup1
      IP Address Range	1.1.2.5-1.1.2.8

   3. Click the NAT Policy tab, click Add, configure NAT policy policy_nat and set the parameters as follows, and then click OK.

      Name	policy_nat
      NAT Type	NAT
      NAT Mode	Source address translation
      Source Zone	trust
      Destination Type	Destination Zone: untrust
      Source Address Translated To	IP Addresses in the IP Address Pool
      Source Translation Address Pool	addressgroup1