山石网科HA高可靠性实验分享
主备模式
AP/AA的配置必须保持一致，但是在Peer mode下不可以保证
OTI双活数据中心
优先级100，小优
主动发生抢占
实验拓扑
配置过程：
SG-6000# configure
SG-6000(config)#hostname HS-A
HS-B(config)#
HS-A(config)# interface ethernet0/4 //指定外网接口
HS-A(config-if-eth0/4)# zone untrust //指定外网接口为Untrust
HS-A(config-if-eth0/4)# ip add 200.0.0.10/24 // 配置IP地址
HS-A(config-if-eth0/4)# manage ping //打开ping
HS-A(config-if-eth0/4)#int ethernet0/1
HS-A(config-if-eth0/1)#zone trust
HS-A(config-if-eth0/1)#ip add 192.168.10.1/24
HS-A(config-if-eth0/1)#manage ping
HS-A(config-if-eth0/1)# manage http //打开http
HS-A(config-vrouter)# ip route 0.0.0.0/0 200.0.0.1 // 默认路由
HS-A(config-vrouter)# snatrule from any to any service any eifethernet0/4 trans-to eif-ip mode dynamicport //配置snat
HS-A(config-policy)# rule from any to any from-zone trust to-zoneuntrust service any permit //放行流量
查看：
HS-A(config)# show policy
Total rules count: 1
S: Rule Status (E -Enabled; D - Disabled)
Flag: * - NeedApplication Identification
S - Log Session Start; E - Log Session End; D - Log Policy Deny
F - Drop Fragment; P - Permit Unknown Application; W - Web Redirect
Default action DENY.Default log OFF. Check to-self OFF. Session rematch ON
====================================================================================================================
S Id Name RBNS_Attr Source Destination Service Application Action Flag
--------------------------------------------------------------------------------------------------------------------
trust => untrust
E 1 Any Any Any PERMIT ------
====================================================================================================================
HS-A(config)#
HS-A(config)# show config uration vrouter
ip vrouter"twin-mode-vr"
exit
ip vrouter"trust-vr"
snatrule id 1 from address-book"Any" to address-book "Any" service "Any" eifethernet0/4 trans-to eif-ip mode dynamicport
ip route 0.0.0.0/0 200.0.0.1
exit
HS-A(config)#
配置HA监控对象
HS-A(config)# track track1 //配置track
HS-A(config-trackip)# ? // 可配置的track的内容
arp Configure track arp address
dns Configure track dns address
http Configure track http address orhost
icmp Configure track ip address orhost
icmp6 Configure track ip ipv6 addressor host
interface Configure track interface
ndp Configure track ndp address
tcp Configure track tcp address orhost
threshold Configure track threshold
traffic-condition Configure traffic condition
-
auxswitch Switch aux port to subcard
clear Reset functions or clear thescreen
debug Debugging functions
delete Delete a file
end Exit from configure mode
exec Perform command operation
exit Exit from Track IP Profileconfiguration mode
help CLI help
no Negate a command or reset todefault
ping Test network connectivity
remove Remove files
rollback Rollback startup with one backup
save Save configuration
show Show running system information
terminal Configure terminal line parameters
traceroute Trace route to destination
undebug Negate debugging functions
unset Back to the default configuration
HS-A(config-trackip)#
HS-A(config-trackip)#interface eth0/4
HS-A(config-trackip)#interface eth0/1
HS-A(config-trackip)#
HS-A(config-trackip)#interface eth0/1 ?
weight Configure track if weight // 默认255
查看：
HS-A(config)# showtrack track1
======================================================================================================================
Track name:track1;track ID:1; local:no
threshold:255; delaythreshold:255; bandwidth threshold:255
used type:not used; status:UNKNOWN; link_status: UNKNOWN // 未调用
bind interface:;snat cnt:0
I:interval;T:threshold; W:weight; S:status; M:mode
F:failed;SU:successful; UN:unknown
HWMK:high watermark;LWMK:low watermark; DW:delay weight
FLAG:link statusflag; N:normal; L:long-delay; O:overload
track interface:
----------------------------------------------------------------------------------------------------------------------
Track interface weight status
----------------------------------------------------------------------------------------------------------------------
ethernet0/4 255 unknown
ethernet0/1 255 unknown
----------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------
HS-A(config)#
配置监控对象
HS-A(config)# hagroup 0
HS-A(config-ha-group)#priority 99
配置HS-B
HS-B# configure
HS-B(config)# hagroup 0
查看：
HS-B(config-ha-group)#show ha group 0
HA Group id=0
state N/A
priority 100
preempt N/A
monitor
HA total peer number 0
HS-A(config)# ha link interface eth0/3 // 配置HA-link
HS-A(config)# ha link ip 1.1.1.1/24 //配置HA-link的接口IP地址
HS-B(config)# ha link ip 1.1.1.2/24 //对端IP地址
HS-B(config)# ping 1.1.1.1 //测试
Sending ICMP packetsto 1.1.1.1
Seq ttl time(ms)
1 128 7.47
2 128 2.12
调用HA 簇：
HS-A(config)# hacluster 1
HS-B(config)# ha cluster 1
问题：在B上先加入簇1 ，B成为master不同步，A不抢占
成功log：
HS-B(config)# hacluster 1
2020-03-07 16:53:13,Event CRIT@FLOW: The local device 0010008416670930 in the VirtualSecurity Device group 0 changed state from Standalone to Init.
HS-B(config)#2020-03-07 16:53:14, Event CRIT@FLOW: The local device 0010008416670930 in the Virtual Security Device group 0changed state from Init to Hello.
2020-03-07 16:53:14,Event CRIT@FLOW: The HA peer device 0010025169456692 in the Virtual Security Device group 0 wasdiscovered.
2020-03-07 16:53:17,Event CRIT@FLOW: The local device 0010008416670930 in the VirtualSecurity Device group 0 changed state from Hello to Backup.
2020-03-07 16:53:21,Event WARNING@NET: interface ethernet0/4 turn to protocol up
2020-03-07 16:53:21,Event WARNING@NET: WAN interface IP address changes to 200.0.0.10
2020-03-07 16:53:22,Network INFO@NET: Route in VR trust-vr that has IP address 0.0.0.0/0 throughnexthop 200.0.0.1 with precedence 1 is created
2020-03-07 16:53:22,Event CRIT@SECURITY: The user "SYSTEM" created a policy (id 1)
2020-03-07 16:53:22,Event CRIT@SECURITY: The user "SYSTEM" modified the policy (id 1),the "action" has been set: "PERMIT"
2020-03-07 16:53:22,Event CRIT@SECURITY: The user "SYSTEM" modified the policy (id 1),the "src-zone" has been modified: Any->trust
2020-03-07 16:53:22,Event CRIT@SECURITY: The user "SYSTEM" modified the policy (id 1),the "dst-zone" has been modified: Any->untrust
2020-03-07 16:53:22,Event CRIT@SECURITY: The user "SYSTEM" modified the policy (id 1),the "src-addr" has been added: Any
2020-03-07 16:53:22,Event CRIT@SECURITY: The user "SYSTEM" modified the policy (id 1),the "dst-addr" has been added: Any
2020-03-07 16:53:22,Event CRIT@SECURITY: The user "SYSTEM" modified the policy (id 1),the "service" has been added: Any
2020-03-07 16:53:21,Event CRIT@FLOW: HA configuration batch synchronization succeeded
HS-B(B)(config)#show policy
Total rules count: 1
S: Rule Status (E -Enabled; D - Disabled)
Flag: * - NeedApplication Identification
S - Log Session Start; E - Log Session End; D - Log Policy Deny
F - Drop Fragment; P - Permit Unknown Application; W - Web Redirect
Default action DENY.Default log OFF. Check to-self OFF. Session rematch ON
====================================================================================================================
S Id Name RBNS_Attr Source Destination Service Application Action Flag
--------------------------------------------------------------------------------------------------------------------
trust => untrust
E 1 Any Any Any PERMIT ------
====================================================================================================================
HS-B(B)(config)#
HS-B(B)(config)#show interface
H:physicalstate;A:admin state;L:link state;P:protocol state;U:up;D:down;K:ha keep up
========================================================================================================
Interface name IP address/mask Zone name H A L P MAC address Description
--------------------------------------------------------------------------------------------------------
ethernet0/0 0.0.0.0/0 trust U U U D 5000.0004.0000 ------
ethernet0/1 0.0.0.0/0 NULL U U U D 5000.0004.0001 ------
ethernet0/2 0.0.0.0/0 NULL U U U D 5000.0004.0002 ------
ethernet0/3 0.0.0.0/0 HA U U U D 5000.0004.0003 ------
ethernet0/4 200.0.0.10/24 untrust U U U U 5000.0004.0004 ------
ethernet0/5 0.0.0.0/0 NULL U U U D 5000.0004.0005 ------
ethernet0/6 0.0.0.0/0 NULL U U U D 5000.0004.0006 ------
ethernet0/7 0.0.0.0/0 NULL U U U D 5000.0004.0007 ------
vswitchif1 0.0.0.0/0 NULL D U D D 001c.545a.1f13 ------
========================================================================================================
HS-B(B)(config)#
HS-B(B)(config)#show ha group 0
HA Group id=0
state Backup
priority 100
preempt N/A
monitor
HA total peer number 1
HA peer information:
device id 0010025169456692
ip 1.1.1.1
state Master
priority 99
HS-B(B)(config)#
VPCS> ip 192.168.10.10/24 192.168.10.1
Checking forduplicate address...
PC1 : 192.168.10.10255.255.255.0 gateway 192.168.10.1
VPCS> ip 192.168.10.20/24 192.168.10.1
Checking forduplicate address...
PC2 : 192.168.10.20 255.255.255.0 gateway192.168.10.1
VPCS> ping 192.168.10.1 //测试成功
84 bytes from192.168.10.1 icmp_seq=1 ttl=128 time=3.608 ms
84 bytes from192.168.10.1 icmp_seq=2 ttl=128 time=1.813 ms
84 bytes from192.168.10.1 icmp_seq=3 ttl=128 time=1.490 ms
^C
VPCS>
VPCS> ping192.168.10.1
84 bytes from192.168.10.1 icmp_seq=1 ttl=128 time=2.844 ms
84 bytes from192.168.10.1 icmp_seq=2 ttl=128 time=1.328 ms
84 bytes from192.168.10.1 icmp_seq=3 ttl=128 time=1.423 ms
^C
VPCS> ping200.0.0.1
84 bytes from200.0.0.1 icmp_seq=1 ttl=254 time=5.417 ms
84 bytes from200.0.0.1 icmp_seq=2 ttl=254 time=2.997 ms
^C
VPCS>
配置ISP的ssh
ISP(config)#aaanew-model
ISP(config)#ipdomain-name cisco
ISP(config)#usernamecisco secret 123456
ISP(config)#enablesecret 123456
ISP(config)#cryptokey generate rsa general-keys modulus 1024
ISP(config)#ip sshauthentication-retries 5
ISP(config)#ip sshtime-out 30
ISP(config)#line vty0 4
ISP(config-line)#transportinput ssh
Telnet 22端口测试
如果不加track，HA切换会失败
HS-A(M)(config)# hagroup 0
HS-A(M)(config-ha-group)#monitor track track1
测试track
HS-A(M)(config)#interface ethernet0/4
HS-A(M)(config-if-eth0/4)#shu
HS-A(M)(config-if-eth0/4)#shutdown
2020-03-07 17:20:14,Event WARNING@NET: interface ethernet0/4 turn to admin down
2020-03-07 17:20:14,Event CRIT@NET: interface ethernet0/4 turn to physical down
2020-03-07 17:20:14,Event WARNING@NET: HS-A(M)(config-if-eth0/4)# interface ethernet0/4 turn toprotocol down
2020-03-07 17:20:14,Event WARNING@NET: interface ethernet0/4 turn to link down
2020-03-07 17:20:14,Event CRIT@NET: track: track1 interface: ethernet0/4 item failed
2020-03-07 17:20:14,Event CRIT@FLOW: HA group 0 change realtime priority from 99 to 3099
2020-03-07 17:20:14,Event CRIT@FLOW: The local device 0010025169456692 in the VirtualSecurity Device group 0 changed state from Master to Link Failed.
HS-A(F)(config-if-eth0/4)#
HS-A(F)(config-if-eth0/4)#show track track1
======================================================================================================================
Track name:track1;track ID:1; local:no
threshold:255; delaythreshold:255; bandwidth threshold:255
used type:ha;status:FAILED; link_status: FAILED
bind interface:;snat cnt:0
I:interval;T:threshold; W:weight; S:status; M:mode
F:failed;SU:successful; UN:unknown
HWMK:high watermark;LWMK:low watermark; DW:delay weight
FLAG:link statusflag; N:normal; L:long-delay; O:overload
track interface:
----------------------------------------------------------------------------------------------------------------------
Track interface weight status
----------------------------------------------------------------------------------------------------------------------
ethernet0/4 255 failed
ethernet0/1 255 successful
----------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------
HS-A(F)(config-if-eth0/4)#
HS-B(M)# show track track1 //track也会同步到备上面但是不会调用
======================================================================================================================
Track name:track1;track ID:1; local:no
threshold:255; delaythreshold:255; bandwidth threshold:255
used type:not used;status:UNKNOWN; link_status: UNKNOWN
bind interface:;snat cnt:0
I:interval;T:threshold; W:weight; S:status; M:mode
F:failed;SU:successful; UN:unknown
HWMK:high watermark;LWMK:low watermark; DW:delay weight
FLAG:link statusflag; N:normal; L:long-delay; O:overload
track interface:
----------------------------------------------------------------------------------------------------------------------
Track interface weight status
----------------------------------------------------------------------------------------------------------------------
ethernet0/4 255 unknown
ethernet0/1 255 unknown
----------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------
HS-B(M)#
配置抢占
HS-A(F)(config-if-eth0/4)# no shu //恢复接口
2020-03-07 17:25:06,Event WARNING@NET: interface ethernet0/4 turn to admin up
HS-A(F)(config-if-eth0/4)#2020-03-07 17:25:07, Event CRIT@NET: interface ethernet0/4 turn to physical up
2020-03-07 17:25:07,Event WARNING@NET: interface ethernet0/4 turn to link up
2020-03-07 17:25:07,Event CRIT@NET: track: track1 interface: ethernet0/4 item recover
2020-03-07 17:25:07,Event CRIT@NET: track: track1 interface: ethernet0/1 item recover
2020-03-07 17:25:07,Event WARNING@NET: interface ethernet0/4 turn to protocol up
2020-03-07 17:25:07,Event CRIT@FLOW: HA group 0 change realtime priority from 3099 to 99
2020-03-07 17:25:07,Event CRIT@FLOW: The local device 0010025169456692 in the VirtualSecurity Device group 0 changed state from Link Failed to Backup.
管理HS
HS-A(B)(config-if-eth0/1)#manage ip 192.168.10.253
山石相关文档，后台联系小编获取回复“加群”添加小编
