Web: Example for Configuring Hot Standby (Load Balancing) of Virtual Systems on Firewalls Connecting to Upstream Routers Through the Public System and Downstream Subnets Through Virtual Systems

Procedure

1. Create virtual systems vsysa and vsysb and assign interfaces to them.
   

   The virtual system names and IDs on FW_A and FW_B must be the same. After the virtual systems are created, you can choose System > Virtual System > Virtual System and check whether the virtual system names and configuration sequences are consistent in Virtual System List.

   1. Click Dashboard on the main menu of FW_A. In Device Information area, click Configure on the line of Virtual System to enable the virtual system function.

      

   2. On FW_A, choose System > Virtual System > Resource Class and click Add to configure a resource class.

      

   3. On FW_A, choose System > Virtual System > Virtual System to create virtual systems vsysa and vsysb and allocate interfaces and resources to them.

      Click Add, select the Basic Settings tab, enter the virtual system name and select the resource class r1. The following part uses vsysa as an example.

      

      Select the Interface Settings tab to allocate interfaces GE0/0/2 and GE0/0/3 to the virtual systems vsysa and vsysb respectively. The following part uses vsysa as an example.

      

   4. By referring to the preceding procedure, create virtual systems vsysa and vsysb on FW_B and allocate interfaces to them.
2. Configure interfaces.
   1. Configure the public system interfaces on FW_A.

      On FW_A, choose Network > Interface, click Edit on the line of an interface to configure the upstream interface, heartbeat interface, and virtual interface Virtual-if0 of the public system. The IP address for virtual interface Virtual-if0 can be any value that is not in conflict with the IP addresses of other interfaces.

      Interface	GigabitEthernet 0/0/1	GigabitEthernet 0/0/7	Virtual-if0
      Security Zone	untrust	dmz	trust
      IP Address	192.168.0.2/30	10.10.0.1/24	172.16.0.1/24

   2. Configure the interfaces of virtual system vsysa on FW_A.

      On FW_A, choose Network > Interface, click Edit on the line of an interface to configure the downstream interface and virtual interface Virtual-if1 of virtual system vsysa. The IP address for virtual interface Virtual-if1 can be any value that is not in conflict with the IP addresses of other interfaces.

      

      The ID of a virtual interface is automatically assigned based on existing IDs in the system. Therefore, in actual configurations, the interface might not be Virtual-if1. You can view the mapping between the virtual system and virtual interface in Interface List.

      Interface	GigabitEthernet 0/0/2	Virtual-if1
      Virtual System	vsysa	vsysa
      Security Zone	trust	untrust
      IP Address	10.3.1.2/24	172.16.1.1/24

   3. Configure the interfaces of virtual system vsysb on FW_A.

      On FW_A, choose Network > Interface, click Edit on the line of an interface to configure the downstream interface and virtual interface Virtual-if2 of virtual system vsysb. The IP address for virtual interface Virtual-if2 can be any value that is not in conflict with the IP addresses of other interfaces.

      Interface	GigabitEthernet 0/0/3	Virtual-if2
      Virtual System	vsysb	vsysb
      Security Zone	trust	untrust
      IP Address	10.3.2.2/24	172.16.2.1/24

   4. Configure the public system interfaces on FW_B.

      On FW_B, choose Network > Interface, click Edit on the line of an interface to configure the upstream interface, heartbeat interface, and virtual interface Virtual-if0 of the public system. The IP address for virtual interface Virtual-if0 can be any value that is not in conflict with the IP addresses of other interfaces.

      Interface	GigabitEthernet 0/0/1	GigabitEthernet 0/0/7	Virtual-if0
      Security Zone	untrust	dmz	trust
      IP Address	192.168.0.10/30	10.10.0.2/24	172.16.0.2/24

   5. Configure the interfaces of virtual system vsysa on FW_B.

      On FW_B, choose Network > Interface, click Edit on the line of an interface to configure the downstream interface and virtual interface Virtual-if1 of virtual system vsysa. The IP address for virtual interface Virtual-if1 can be any value that is not in conflict with the IP addresses of other interfaces.

      Interface	GigabitEthernet 0/0/2	Virtual-if1
      Virtual System	vsysa	vsysa
      Security Zone	trust	untrust
      IP Address	10.3.1.3/24	172.16.1.2/24

   6. Configure the interfaces of virtual system vsysb on FW_B.

      On FW_B, choose Network > Interface, click Edit on the line of an interface to configure the downstream interface and virtual interface Virtual-if2 of virtual system vsysb. The IP address for virtual interface Virtual-if2 can be any value that is not in conflict with the IP addresses of other interfaces.

      Interface	GigabitEthernet 0/0/3	Virtual-if2
      Virtual System	vsysb	vsysb
      Security Zone	trust	untrust
      IP Address	10.3.2.3/24	172.16.2.2/24

3. Configures static routes.
   1. Configure static routes on FW_A.

      In the public system, choose Network > Route > Static Route and click Add to configure a static route to guide the return traffic from the Internet to employees in vsysa.

      

      By referring to the preceding procedure, configure a static route to guide the return traffic from the Internet to employees in vsysb.

      

      By referring to the preceding procedure, configure a static route to guide the Internet access traffic from employees in vsysa to the public system.

      

      In this example, the network topology and route configuration are simplified. If vsysa only needs to communicate with the Internet, set Destination Address/Mask to 0.0.0.0/0.0.0.0. That is, all packets are sent to the public system. In practice, for accurate routing information, you shall set Destination Address/Mask to a specific Internet address range that the intranet users are allowed to access. Incorrect route configuration may result in communication failure of multiple LANs connected with vsysa.

      

      By referring to the preceding procedure, configure a static route to guide the Internet access traffic from employees in vsysb to the public system.

      

      In this example, the network topology and route configuration are simplified. If vsysb only needs to communicate with the Internet, set Destination Address/Mask to 0.0.0.0/0.0.0.0. That is, all packets are sent to the public system. In practice, for accurate routing information, you shall set Destination Address/Mask to a specific Internet address range that the intranet users are allowed to access. Incorrect route configuration may result in communication failure of multiple LANs connected with vsysb.

      

   2. Configure the following static routes on FW_B. The configuration method is the same as that for FW_A.
      • Static route that guides the return traffic from the Internet to employees in vsysa
      • Static route that guides the return traffic from the Internet to employees in vsysb
      • Static route that guides the Internet access traffic from employees in vsysa to the public system
      • Static route that guides the Internet access traffic from employees in vsysb to the public system

4. Configure OSPF.
   1. On FW_A, choose Network > Route > OSPF, click Add to create OSPF 100, click on the line of OSPF 100, click Add, and set the following area parameters.

      

   2. By referring to the preceding procedure, configure OSPF on FW_B.

      

5. Configure the Link-Group function to ensure that the upstream and downstream interfaces are in the same state.
   1. On FW_A, choose System > High Availability > Link-Group > Link-Group, click on the line of Link-Group1, and set the following parameters. Add the public system interface (upstream interface) and virtual system interfaces (downstream interfaces) to the same Link-Group on FW_A.

      

   2. On FW_B, add the public system upstream interface and virtual system downstream interfaces to the same link-Group. The configuration method is the same as that for FW_A.
6. Configure hot standby.
   1. On FW_A, choose System > High Availability > Dual-System Hot Standby, click Edit, select the Enable check box following Dual-System Hot Standby, and set the following parameters.

      

      

      

   2. On FW_B, set the following hot standby parameters.

      

      

   3. To prevent port conflicts in address translation on the FWs in load balancing mode, configure available port ranges on FW_A and FW_B. Currently, the configuration cannot be performed on the web UI. Click CLI Console in the lower right corner of the page to display the CLI configuration page and configure it on the CLI.
      

      In the hot standby load balancing scenario, If NAPT is configured, the FWs may have conflicting public ports. To prevent such conflicts, configure respective NAT resources (including public IP addresses and ports) for the FWs. You can run the hrp nat resource primary-group command on the active FW. The standby FW will automatically generate the hrp nat resource secondary-group command (if you run the hrp nat resource secondary-group command on the active FW, the standby FW will automatically generate the hrp nat resource primary-group command).

      Perform the following configuration on FW_A:

      HRP_M[FW_A] hrp nat resource primary-group

      Perform the following configuration on FW_B:

      HRP_S[FW_B] hrp nat resource secondary-group

7. Configure security policies.
   

   Security policies can be backed up. That is, policies configured on FW_A can be automatically synchronized to FW_B. If you have configured security policies separately on FW_A and FW_B before configuring hot standby, ensure that their configurations and the sequences in which they are configured are the same on FW_A and FW_B. Otherwise, services may become abnormal after active/standby switchover.

   1. Configure the security policy for the public system.

      In the public system of FW_A, choose Policy > Security Policy > Security Policy, click Add Security Policy, and set the following parameters to configure a security policy for the public system to allow intranet users to access the Internet. When configuring the security policy for the public system, you do not need to specify the IP address range. When configuring the security policy for the virtual system, you need to specify the IP addresses of the intranet employees to configure a strict security policy.

      Name	policy_sec
      Source zone	trust
      Destination zone	untrust
      Action	Permit

   2. Configure security policies in vsysa.

      Select vsysa from the Virtual System drop-down list in the upper right corner on FW_A to access vsysa. Choose Policy > Security Policy > Security Policy, click Add Security Policy and configure the following security policy to isolate vsysa from vsysb. Because routes have been configured in the public system to divert the return traffic to vsysa and vsysb, vsysa and vsysb can communicate with each other through the public system. To isolate them from each other, you must configure this security policy in vsysa.

      Name	vsysa_to_vsysb
      Source zone	trust
      Destination zone	untrust
      Source Address/Region	10.3.1.0 24
      Destination Address/Region	10.3.2.0 24
      Action	Deny

      By referring to the preceding procedure, in virtual system vsysa of FW_A, set the following parameters to configure a security policy for vsysa to allow intranet users to access the Internet.

      Name	policy_sec
      Source zone	trust
      Destination zone	untrust
      Source Address/Region	10.3.1.0 24
      Action	Permit

   3. Configure security policies in vsysb.

      Select vsysb from the Virtual System drop-down list in the upper right corner on FW_A to access vsysb. Choose Policy > Security Policy > Security Policy, click Add Security Policy and configure the following security policy to isolate vsysa from vsysb. Because routes have been configured in the public system to divert the return traffic to vsysa and vsysb, vsysa and vsysb can communicate with each other through the public system. To isolate them from each other, you must configure this security policy in vsysb.

      Name	vsysb_to_vsysa
      Source zone	trust
      Destination zone	untrust
      Source Address/Region	10.3.2.0 24
      Destination Address/Region	10.3.1.0 24
      Action	Deny

      By referring to the preceding procedure, in virtual system vsysb of FW_A, set the following parameters to configure a security policy for vsysb to allow intranet users to access the Internet.

      Name	policy_sec
      Source zone	trust
      Destination zone	untrust
      Source Address/Region	10.3.2.0 24
      Action	Permit

8. Configure a NAT policy.

   On FW_A, configure a NAT policy for the public system to allow intranet users to access the Internet. The NAT policy configured on FW_A can be automatically synchronized to FW_B.

   1. Select public from the Virtual System drop-down list in the upper right corner on FW_A to access the public system.
   2. Choose Policy > NAT Policy > NAT Policy > Source Translation Address Pool, click Add and configure a NAT address pool based on the following parameter values.

      

   3. Choose Policy > NAT Policy > NAT Policy > NAT Policy, click Add and configure a NAT policy based on the following parameter values.

      

9. Configure routers.
   

   The following part uses Huawei routers to illustrate the configuration.

   # Configure Router1.

   [router1] interface GigabitEthernet 0/0/1
   [router1-GigabitEthernet0/0/1] ip address 192.168.0.1 30
   [router1-GigabitEthernet0/0/1] quit
   [router1] interface GigabitEthernet 0/0/2
   [router1-GigabitEthernet0/0/2] ip address 192.168.0.5 30
   [router1-GigabitEthernet0/0/2] quit
   [router1] ospf 100
   [router1-ospf-100] default-route-advertise
   [router1-ospf-100] area 0
   [router1-ospf-100-area-0.0.0.0] network 192.168.0.0 0.0.0.3
   [router1-ospf-100-area-0.0.0.0] quit
   [router1-ospf-100] quit

   # Configure Router2.

   [router2] interface GigabitEthernet 0/0/1
   [router2-GigabitEthernet0/0/1] ip address 192.168.0.9 30
   [router2-GigabitEthernet0/0/1] quit
   [router2] interface GigabitEthernet 0/0/2
   [router2-GigabitEthernet0/0/2] ip address 192.168.0.6 30
   [router2-GigabitEthernet0/0/2] quit
   [router2] ospf 100
   [router2-ospf-100] default-route-advertise
   [router2-ospf-100] area 0
   [router2-ospf-100-area-0.0.0.0] network 192.168.0.8 0.0.0.3
   [router2-ospf-100-area-0.0.0.0] quit
   [router2-ospf-100] quit