组网及说明
网络拓扑图
本案例是采用HCL模拟器中的F1060防火墙来实现IRF功能，其中设备1代表IRF成员1,设备2代表IRF成员2，都分别使用GI 1/0/2口和GI 1/0/3口作为IRF的端口。
配置步骤
1、将设备1作为IRF成员1，设备2作为IRF成员2
2、将物理端口分别绑定到IRF端口
3、启动IRF功能
4、测试IRF
关键配置
1、1号设备关键配置点如下：
[H3C]irf member 1 renumber 1 //将1号设备配置为IRF成员1 [H3C]int range GigabitEthernet 1/0/2 to GigabitEthernet 1/0/3 [H3C-if-range]shutdown [H3C-if-range]quit [H3C]irf-port 1/1 //将物理端口绑定到IRF端口 [H3C-irf-port1/1]port group interface GigabitEthernet 1/0/2 [H3C-irf-port1/1]port group interface GigabitEthernet 1/0/3 [H3C-irf-port1/1]quit [H3C]int range GigabitEthernet 1/0/2 to GigabitEthernet 1/0/3 [H3C-if-range]undo shutdown [H3C-if-range]quit [H3C]irf-port-configuration active //激活IRF [H3C]save //保存配置
2、2号设备关键配置点如下：
[H3C]irf member 1 renumber 2 //将2号设备配置为IRF成员2 [H3C]int range GigabitEthernet 1/0/2 to GigabitEthernet 1/0/3 [H3C-if-range]shutdown [H3C-if-range]quit [H3C]irf-port 1/2 //将物理端口绑定到IRF口 [H3C-irf-port1/2]port group interface GigabitEthernet 1/0/2 [H3C-irf-port1/2]port group interface GigabitEthernet 1/0/3 [H3C-irf-port1/2]quit [H3C]int range GigabitEthernet 1/0/2 to GigabitEthernet 1/0/3 [H3C-if-range]undo shutdown [H3C-if-range]quit [H3C]irf-port-configuration active //激活IRF [H3C]save //保存配置
3、分别重启设备1和设备2
4、测试
<H3C>dis irf //查看IRF成员信息，发现设备1和设备2的信息都在一起 MemberID Role Priority CPU-Mac Description *+1 Master 1 30d3-7ef9-0104 --- 2 Standby 1 30d4-7d89-0204 --- -------------------------------------------------- * indicates the device is the master. + indicates the device through which the user logs in. The bridge MAC of the IRF is: 30d3-7ef9-0100 Auto upgrade : yes Mac persistent : 6 min Domain ID : 0 <H3C><H3C>dis irf link //查看IRF链路均为UP Member 1 IRF Port Interface Status 1 GigabitEthernet1/0/2 UP GigabitEthernet1/0/3 UP 2 disable -- Member 2 IRF Port Interface Status 1 disable -- 2 GigabitEthernet2/0/2 UP GigabitEthernet2/0/3 UP <H3C><H3C>dis irf configuration //查看IRF配置信息 MemberID NewID IRF-Port1 IRF-Port2 1 1 GigabitEthernet1/0/2 disable GigabitEthernet1/0/3 2 2 disable GigabitEthernet2/0/2 GigabitEthernet2/0/3 <H3C><H3C>dis irf topology //查看IRF拓扑信息 Topology Info ------------------------------------------------------------------------- IRF-Port1 IRF-Port2 MemberID Link neighbor Link neighbor Belong To 2 DIS --- UP 1 30d3-7ef9-0104 1 UP 2 DIS --- 30d3-7ef9-0104 <H3C>
至此F1060防火墙的IRF已配置完成！
