H3CIRF堆叠VRRP双机热备IPSecvpan

第一部分： VRRP双机热备

1:链路聚合

[H3C]sys Sw1
[Sw1]int GigabitEthernet 1/0/6
[Sw1-GigabitEthernet1/0/6]port link-mode route
[Sw1-GigabitEthernet1/0/6]ip address 192.168.100.2 24

[H3C]sys R1
[R1]int GigabitEthernet 0/0
[R1-GigabitEthernet0/0]ip address 192.168.100.1 24

[R1]int GigabitEthernet 0/1
[R1-GigabitEthernet0/1]ip address 192.168.101.1 24
[R1-GigabitEthernet0/1]quit
[R1]int GigabitEthernet 0/2
[R1-GigabitEthernet0/2]ip address 12.1.1.1 24
 

[H3C]sys Sw2
[Sw2]int GigabitEthernet 1/0/6
[Sw2-GigabitEthernet1/0/6]port link-mode route
[Sw2-GigabitEthernet1/0/6]ip address 192.168.101.2 24
 

[R2]undo in en
[R2]sys R2
[R2]int GigabitEthernet 0/0
[R2-GigabitEthernet0/0]ip add 12.1.1.2 24
[R2-GigabitEthernet0/0]int gi 0/1
[R2-GigabitEthernet0/1]ip add 23.1.1.2 24
[R2-GigabitEthernet0/1]quit
[R2]int LoopBack 0
[R2-LoopBack0]ip address 2.2.2.2 24

[H3C]undo in en
[H3C]sys R3
[R3]int gi 0/0
[R3-GigabitEthernet0/0]ip add 23.1.1.3 24
[R3-GigabitEthernet0/0]int gi 5/0
[R3-GigabitEthernet5/0]ip address 13.1.1.3 24
 

[Sw1]int Bridge-Aggregation 1
[Sw1-Bridge-Aggregation1]quit
[Sw1]int range GigabitEthernet 1/0/1 GigabitEthernet 1/0/2
[Sw1-if-range]port link-aggregation group 1
[Sw1-if-range]quit
[Sw1]dis link-aggregation verbose  (查看链路聚合)

[Sw2]int Bridge-Aggregation 1
[Sw2-Bridge-Aggregation1]quit
[Sw2]int range GigabitEthernet 1/0/1 GigabitEthernet 1/0/2
[Sw2-if-range]port link-aggregation group 1
 

[H3C]undo in en
[H3C]sys SW3
[SW3]vlan 2
[SW3-vlan2]vlan 999
[SW3]int range GigabitEthernet 1/0/3 GigabitEthernet 1/0/4
[SW3-if-range]port access vlan 2
[SW3-if-range]quit
[SW3]int range GigabitEthernet 1/0/1 GigabitEthernet 1/0/2
[SW3-if-range]port link-type trunk
[SW3-if-range]port trunk permit vlan 2 999
 

[SW4]undo in en
[SW4]vlan 3
[SW4-vlan3]vlan 999
[SW4-vlan999]quit
[SW4]int GigabitEthernet 1/0/4
[SW4-GigabitEthernet1/0/4]port access vlan 3
[SW4-GigabitEthernet1/0/4]quit
[SW4]int range GigabitEthernet 1/0/2 GigabitEthernet 1/0/1
[SW4-if-range]port link-type trunk
[SW4-if-range]port trunk permit vlan 3 999
 

[Sw1]vlan 2
[Sw1-vlan2]vlan 3
[Sw1-vlan3]vlan 999
[Sw1-vlan999]quit
[Sw1]int GigabitEthernet 1/0/3
[Sw1-GigabitEthernet1/0/3]port link-type trunk
[Sw1-GigabitEthernet1/0/3]port trunk permit vlan 2 999
[Sw1-GigabitEthernet1/0/3]quit
[Sw1]int GigabitEthernet 1/0/4
[Sw1-GigabitEthernet1/0/4]port link-type trunk
[Sw1-GigabitEthernet1/0/4]port trunk permit vlan 3 999
[Sw1-GigabitEthernet1/0/4]quit
[Sw1]int Bridge-Aggregation 1
[Sw1-Bridge-Aggregation1]port link-type trunk
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
[Sw1-Bridge-Aggregation1]port trunk permit vlan 2 3 999
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
 

[Sw2]vlan 2
[Sw2-vlan2]vlan 3
[Sw2-vlan3]vlan 999
[Sw2-vlan999]quit
[Sw2]int GigabitEthernet 1/0/3
[Sw2-GigabitEthernet1/0/3]port link-type trunk
[Sw2-GigabitEthernet1/0/3]port trunk permit vlan 3 999
[Sw2-GigabitEthernet1/0/3]quit
[Sw2]int GigabitEthernet 1/0/4
[Sw2-GigabitEthernet1/0/4]port link-type trunk
[Sw2-GigabitEthernet1/0/4]port trunk permit vlan 2 999
[Sw2-GigabitEthernet1/0/4]quit
[Sw2]int Bridge-Aggregation 1
[Sw2-Bridge-Aggregation1]port link-type trunk
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
[Sw2-Bridge-Aggregation1]port trunk permit vlan 2 3 999
Configuring GigabitEthernet1/0/1 done.
Configuring GigabitEthernet1/0/2 done.
 

vlan（svi）配置

[Sw1]int vlan 2
[Sw1-Vlan-interface2]ip add 192.168.2.254 24
[Sw1]int Vlan 3
[Sw1-Vlan-interface3]ip address 192.168.3.254 24
 

[Sw2]int vlan 2
[Sw2-Vlan-interface2]ip address 192.168.2.253 24
[Sw2-Vlan-interface2]quit
[Sw2]int vlan 3
[Sw2-Vlan-interface3]ip address 192.168.3.253 24
 

MSTP配置

 
[Sw1]stp region-configuration
[Sw1-mst-region]region-name aa
[Sw1-mst-region]revision-level 1
[Sw1-mst-region]instance 1 vlan 2
[Sw1-mst-region]instance 2 vlan 3
[Sw1-mst-region]active region-configuration
[Sw1-mst-region]quit
[Sw1]stp instance 1 root primary
[Sw1]stp instance 2 root secondary

[Sw2]stp region-configuration
[Sw2-mst-region]region-name aa
[Sw2-mst-region]revision-level 1
[Sw2-mst-region]instance 1 vlan 2
[Sw2-mst-region]instance 2 vlan 3
[Sw2-mst-region]active region-configuration
[Sw2-mst-region]quit
[Sw2]stp instance 1 root secondary
[Sw2]stp instance 2 root primary
 

[SW3]stp region-configuration
[SW3-mst-region]region-name aa
[SW3-mst-region]revision-level 1
[SW3-mst-region]instance 1 vlan 2
[SW3-mst-region]instance 2 vlan 3
[SW3-mst-region]active region-configuration
 

[SW4]stp region-configuration
[SW4-mst-region]region-name aa
[SW4-mst-region]revision-level 1
[SW4-mst-region]instance 1 vlan 2
[SW4-mst-region]instance 2 vlan 3
[SW4-mst-region]active region-configuration
 

VRRP配置

[Sw1]int vlan 2
[Sw1-Vlan-interface2]vrrp  vrid 2 virtual-ip 192.168.2.1
[Sw1-Vlan-interface2]vrrp vrid 2 priority 105
[Sw1-Vlan-interface2]quit
[Sw1]int vlan 3
[Sw1-Vlan-interface3]vrrp  vrid 3 virtual-ip 192.168.3.1
 

[Sw2]int vlan 2
[Sw2-Vlan-interface2]vrrp vrid 2 virtual-ip 192.168.2.1
[Sw2-Vlan-interface2]quit
[Sw2]int vlan 3
[Sw2-Vlan-interface3]vrrp  vrid 3 virtual-ip 192.168.3.1
[Sw2-Vlan-interface3]vrrp  vrid 3 priority  105

BFD（监测）

[Sw1]track 1 interface GigabitEthernet 1/0/6
[Sw1-track-1]quit
[Sw1]track 2 interface GigabitEthernet 1/0/3
[Sw1-track-2]quit
[Sw1]int Vlan 2
[Sw1-Vlan-interface2]vrrp vrid 2 track 1 priority reduced
[Sw1-Vlan-interface2]vrrp  vrid 2 track 2 priority reduced

[Sw2]track 1 interface GigabitEthernet 1/0/6
[Sw2-track-1]quit
[Sw2]track 2 int GigabitEthernet 1/0/3
[Sw2-track-2]quit
[Sw2]int Vlan 3
[Sw2-Vlan-interface3]vrrp vrid 3 track 1 priority reduced
[Sw2-Vlan-interface3]vrrp  vrid 3 track 2 priority  reduced
 

DHCP（配置）

[R1]dhcp enable
[R1]dhcp server ip-pool vlan2
[R1-dhcp-pool-vlan2]network 192.168.2.0 24
[R1-dhcp-pool-vlan2]gateway-list 192.168.2.1
[R1-dhcp-pool-vlan2]dns-list 114.114.114.114
[R1-dhcp-pool-vlan2]quit
[R1]dhcp server forbidden-ip 192.168.2.250 192.168.2.254
[R1]dhcp server ip-pool  vlan3
[R1-dhcp-pool-vlan3]network 192.168.3.0 24
[R1-dhcp-pool-vlan3]gateway-list 192.168.3.1
[R1-dhcp-pool-vlan3]dns-list 114.114.114.114
[R1]dhcp server forbidden-ip 192.168.3.250 192.168.3.254（禁止分配IP地址范围）

[Sw1]dhcp en
[Sw1]int vlan 2
[Sw1-Vlan-interface2]dhcp relay server-address 192.168.100.1
[Sw1-Vlan-interface2]dhcp select relay
[Sw1-Vlan-interface2]quit
[Sw1]int vlan 3
[Sw1-Vlan-interface3]dhcp relay server-address 192.168.100.1
[Sw1-Vlan-interface3]dhcp select relay
 

[Sw2]dhcp enable
[Sw2]int vlan 2
[Sw2-Vlan-interface2]dhcp relay server-address 192.168.101.1
[Sw2-Vlan-interface2]dhcp select relay
[Sw2-Vlan-interface2]quit
[Sw2]int Vlan 3
[Sw2-Vlan-interface3]dhcp relay server-address 192.168.101.1
[Sw2-Vlan-interface3]dhcp select relay
 

[R1]ospf 1 router-id 1.1.1.1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 192.168.100.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 192.168.101.0 0.0.0.255
 

[Sw1]ospf 1 router-id  11.11.11.11
[Sw1-ospf-1]area 0
[Sw1-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255
[Sw1-ospf-1-area-0.0.0.0]network 192.168.3.0 0.0.0.255
[Sw1-ospf-1-area-0.0.0.0]network 192.168.100.0 0.0.0.255
 

[Sw2]ospf 1 router-id 22.22.22.22
[Sw2-ospf-1]area 0
[Sw2-ospf-1-area-0.0.0.0]network  192.168.2.0 0.0.0.255
[Sw2-ospf-1-area-0.0.0.0]network  192.168.3.0 0.0.0.255
[Sw2-ospf-1-area-0.0.0.0]network  192.168.101.0 0.0.0.255
 

第二部分：IRF堆叠

[Sw5]irf member  1  priority   5  (默认优先级为1，提升优先级使其为主)
[Sw5]int  ran   Ten-GigabitEthernet  1/0/49   Ten-GigabitEthernet  1/0/50
[Sw5]shutdown
[Sw5]quit
[Sw5]irf-port  1/1     (设置堆叠编号)

[Sw5]port  group  inter    Ten-GigabitEthernet  1/0/49
[Sw5]port  group  inter    Ten-GigabitEthernet  1/0/50

[Sw6]irf member  1 renumber  2 

reboot  

save
[Sw6]int  ran   Ten-GigabitEthernet  2/0/49   Ten-GigabitEthernet  2/0/50
[Sw6]shutdown
[Sw6]quit
[Sw6]irf-port  2/2     (设置堆叠编号)

[Sw6]port  group  inter    Ten-GigabitEthernet  2/0/49
[Sw6]port  group  inter    Ten-GigabitEthernet  2/0/50

[Sw5]int   Ten-GigabitEthernet  1/0/49
[Sw5]undo  shutdown
[Sw5]int   Ten-GigabitEthernet  1/0/50
[Sw5]undo  shutdown
save

[Sw5]irf-port-configuration  active
[Sw5]save

[Sw6]int   Ten-GigabitEthernet 2/0/49
[Sw6]undo  shutdown
[Sw6]int   Ten-GigabitEthernet  2/0/50
[Sw6]undo  shutdown
save

[Sw6]irf-port-configuration  active
[Sw6]save

[Sw6]dis   irf    (查看堆叠)

[Sw7]int   Bridge-Aggregation  1
[Sw7]link-aggregation  mode  dynamic    (动态链路聚合)
[Sw7]int   ran  gi 1/0/1  gi 1/0/2
[Sw7]port  link-aggregation  group  1

[Sw8]int   Bridge-Aggregation 2
[Sw8]link-aggregation  mode  dynamic    (动态链路聚合)
[Sw8]int   ran  gi 1/0/1  gi 1/0/2
[Sw8]port  link-aggregation  group  2

[Sw5]int   Bridge-Aggregation  1
[Sw5]link-aggregation  mode  dynamic
[Sw5]int  Bridge-Aggregation 2
[Sw5]link-aggregation  mode dynamic
[Sw5]int  ran  gi 1/0/1  gi 2/0/2
[Sw5]port  link-aggregation  group 1
[Sw5]quit
[Sw5]int ran  gi 1/0/2  gi 2/0/1
[Sw5]port  link-aggregation  group  2