设备列表设备名称路由器AR1路由器AR2运营商路由ISP防火墙FW1防火墙FW2交换机LSW1交换机LSW2三层交换机LSW3PCPC1PCPC2IP地址规划AR1接口IPGE0/0/010.1.2.2/24GE0/0/110.1.4.1/24GE0/0/212.0.0.1/24AR2接口IPGE0/0/010.1.3.1/24GE0/0/110.1.4.2/24GE0/0/213.0.0.1/24ISP接口IPGE0/0/012.0.0.2/24GE0/0/113.0.0.2/24GE0/0/210.0.0.1/24防火墙管理地址FW1192.168.0.1FW2192.168.0.2Trust区域FW1-FW2心跳链路10.1.1.0/30FW110.1.1.1FW210.1.1.2PC地址PC1:IP:192.168.2.100MASK:255.255.255.0网关:192.168.2.1PC2:IP:192.168.2.200MASK:255.255.255.0网关:192.168.2.1LSW1配置Huawei system-view [Huawei] sysname LSW1 [LSW1] vlan 2 [LSW1-vlan2] quit [LSW1] interface GigabitEthernet 0/0/3 [LSW1-GigabitEthernet0/0/3] port link-type access [LSW1-GigabitEthernet0/0/3] port default vlan 2 [LSW1-GigabitEthernet0/0/3] quit [LSW1] interface GigabitEthernet 0/0/1 [LSW1-GigabitEthernet0/0/1] port link-type access [LSW1-GigabitEthernet0/0/1] port default vlan 2 [LSW1-GigabitEthernet0/0/1] quit [LSW1] interface GigabitEthernet 0/0/2 [LSW1-GigabitEthernet0/0/2] port link-type trunk [LSW1-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 [LSW1-GigabitEthernet0/0/2] quitLSW2 配置Huawei system-view [Huawei] sysname LSW2 [LSW2] vlan 2 [LSW2-vlan2] quit [LSW2] interface GigabitEthernet 0/0/3 [LSW2-GigabitEthernet0/0/3] port link-type access [LSW2-GigabitEthernet0/0/3] port default vlan 2 [LSW2-GigabitEthernet0/0/3] quit [LSW2] interface GigabitEthernet 0/0/1 [LSW2-GigabitEthernet0/0/1] port link-type access [LSW2-GigabitEthernet0/0/1] port default vlan 2 [LSW2-GigabitEthernet0/0/1] quit [LSW2] interface GigabitEthernet 0/0/2 [LSW2-GigabitEthernet0/0/2] port link-type trunk [LSW2-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 [LSW2-GigabitEthernet0/0/2] quitLSW3 配置Huawei system-view [Huawei] sysname LSW3 [LSW3] interface Vlanif 1 [LSW3-Vlanif1] ip address 192.168.0.3 255.255.255.0 [LSW3-Vlanif1] quitISP 路由器配置模拟公网Huawei system-view [Huawei] sysname ISP [ISP] interface GigabitEthernet 0/0/0 [ISP-GigabitEthernet0/0/0] ip address 12.0.0.2 255.255.255.0 [ISP-GigabitEthernet0/0/0] quit [ISP] interface GigabitEthernet 0/0/1 [ISP-GigabitEthernet0/0/1] ip address 13.0.0.2 255.255.255.0 [ISP-GigabitEthernet0/0/1] quit [ISP] interface LoopBack 0 [ISP-LoopBack0] ip address 100.1.1.1 255.255.255.0 [ISP-LoopBack0] quit [ISP] ip route-static 10.0.0.0 255.0.0.0 12.0.0.1 [ISP] ip route-static 10.0.0.0 255.0.0.0 13.0.0.1 preference 70AR1 路由器配置Huawei system-view [Huawei] sysname AR1 [AR1] interface GigabitEthernet 0/0/0 [AR1-GigabitEthernet0/0/0] ip address 10.1.2.1 255.255.255.0 [AR1-GigabitEthernet0/0/0] quit [AR1] interface GigabitEthernet 0/0/1 [AR1-GigabitEthernet0/0/1] ip address 10.1.4.1 255.255.255.0 [AR1-GigabitEthernet0/0/1] quit [AR1] interface GigabitEthernet 0/0/2 [AR1-GigabitEthernet0/0/2] ip address 12.0.0.1 255.255.255.0 [AR1-GigabitEthernet0/0/2] quit [AR1] ospf 1 router-id 1.1.1.1 [AR1-ospf-1] area 0 [AR1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255 [AR1-ospf-1-area-0.0.0.0] network 10.1.4.0 0.0.0.255 [AR1-ospf-1-area-0.0.0.0] quit [AR1-ospf-1] default-route-advertise [AR1-ospf-1] quit [AR1] ip route-static 0.0.0.0 0.0.0.0 12.0.0.2AR2 路由器配置Huawei system-view [Huawei] sysname AR2 [AR2] interface GigabitEthernet 0/0/0 [AR2-GigabitEthernet0/0/0] ip address 10.1.3.1 255.255.255.0 [AR2-GigabitEthernet0/0/0] quit [AR2] interface GigabitEthernet 0/0/1 [AR2-GigabitEthernet0/0/1] ip address 10.1.4.2 255.255.255.0 [AR2-GigabitEthernet0/0/1] quit [AR2] interface GigabitEthernet 0/0/2 [AR2-GigabitEthernet0/0/2] ip address 13.0.0.1 255.255.255.0 [AR2-GigabitEthernet0/0/2] quit [AR2] ospf 1 router-id 2.2.2.2 [AR2-ospf-1] area 0 [AR2-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255 [AR2-ospf-1-area-0.0.0.0] network 10.1.4.0 0.0.0.255 [AR2-ospf-1-area-0.0.0.0] quit [AR2-ospf-1] default-route-advertise [AR2-ospf-1] quit [AR2] ip route-static 0.0.0.0 0.0.0.0 13.0.0.2FW1 基础配置USG6000V system-view [USG6000V] sysname FW1 [FW1] interface GigabitEthernet 1/0/0 [FW1-GigabitEthernet1/0/0] ip address 10.1.2.254 255.255.255.0 [FW1-GigabitEthernet1/0/0] quit [FW1] firewall zone untrust [FW1-zone-untrust] add interface GigabitEthernet 1/0/0 [FW1-zone-untrust] quit [FW1] interface GigabitEthernet 1/0/1 [FW1-GigabitEthernet1/0/1] ip address 192.168.2.252 255.255.255.0 [FW1-GigabitEthernet1/0/1] quit [FW1] firewall zone trust [FW1-zone-trust] add interface GigabitEthernet 1/0/1 [FW1-zone-trust] quit [FW1] interface GigabitEthernet 1/0/2 [FW1-GigabitEthernet1/0/2] ip address 10.1.1.1 255.255.255.252 [FW1-GigabitEthernet1/0/2] quit [FW1] firewall zone dmz [FW1-zone-dmz] add interface GigabitEthernet 1/0/2 [FW1-zone-dmz] quit [FW1] ospf 1 router-id 10.1.2.254 [FW1-ospf-1] area 0 [FW1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255 [FW1-ospf-1-area-0.0.0.0] quit [FW1-ospf-1] import-route static [FW1-ospf-1] quitFW2 基础配置USG6000V system-view [USG6000V] sysname FW2 [FW2] interface GigabitEthernet 0/0/0 [FW2-GigabitEthernet0/0/0] ip address 192.168.0.2 255.255.255.0 [FW2-GigabitEthernet0/0/0] quit [FW2] interface GigabitEthernet 1/0/0 [FW2-GigabitEthernet1/0/0] ip address 10.1.3.254 255.255.255.0 [FW2-GigabitEthernet1/0/0] quit [FW2] firewall zone untrust [FW2-zone-untrust] add interface GigabitEthernet 1/0/0 [FW2-zone-untrust] quit [FW2] interface GigabitEthernet 1/0/1 [FW2-GigabitEthernet1/0/1] ip address 192.168.2.253 255.255.255.0 [FW2-GigabitEthernet1/0/1] quit [FW2] firewall zone trust [FW2-zone-trust] add interface GigabitEthernet 1/0/1 [FW2-zone-trust] quit [FW2] interface GigabitEthernet 1/0/2 [FW2-GigabitEthernet1/0/2] ip address 10.1.1.2 255.255.255.252 [FW2-GigabitEthernet1/0/2] quit [FW2] firewall zone dmz [FW2-zone-dmz] add interface GigabitEthernet 1/0/2 [FW2-zone-dmz] quit [FW2] ospf 1 router-id 10.1.3.254 [FW2-ospf-1] area 0 [FW2-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255 [FW2-ospf-1-area-0.0.0.0] quit [FW2-ospf-1] import-route static [FW2-ospf-1] quitHRP 双机热备核心配置心跳链路与主备角色配置FW1 配置主设备[FW1] hrp interface GigabitEthernet 1/0/2 remote 10.1.1.2 [FW1] hrp priority 10 [FW1] hrp enable执行后命令提示符变为HRP_M[FW1]表示当前为双机主用设备。FW2 配置备设备[FW2] hrp interface GigabitEthernet 1/0/2 remote 10.1.1.1 [FW2] hrp enable执行后命令提示符变为HRP_S[FW2]表示当前为双机备用设备。VRRP 与 HRP 联动配置仅需在主设备 FW1 上配置自动同步至备设备HRP_M[FW1] interface GigabitEthernet 1/0/1 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 virtual-ip 192.168.2.254 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 priority 120 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 hrp track master HRP_M[FW1-GigabitEthernet1/0/1] quit安全策略配置HRP_M[FW1] security-policy HRP_M[FW1-policy-security] rule name hrp_heartbeat HRP_M[FW1-policy-security-rule-hrp_heartbeat] source-zone local HRP_M[FW1-policy-security-rule-hrp_heartbeat] destination-zone dmz HRP_M[FW1-policy-security-rule-hrp_heartbeat] action permit HRP_M[FW1-policy-security-rule-hrp_heartbeat] quit HRP_M[FW1-policy-security] rule name trust_to_untrust HRP_M[FW1-policy-security-rule-trust_to_untrust] source-zone trust HRP_M[FW1-policy-security-rule-trust_to_untrust] destination-zone untrust HRP_M[FW1-policy-security-rule-trust_to_untrust] source-address 192.168.2.0 24 HRP_M[FW1-policy-security-rule-trust_to_untrust] action permit HRP_M[FW1-policy-security-rule-trust_to_untrust] quit HRP_M[FW1-policy-security] quit会话快速备份配置开启实时会话同步保证主备切换时业务不中断HRP_M[FW1] hrp mirror session enable实验验证步骤基础连通性验证内网终端互通验证在 PC1 上执行 ping 命令测试与 PC2 的连通性PC ping 192.168.2.200 Reply from 192.168.2.200: bytes32 time1ms TTL128外网链路连通验证在 FW1 上 ping AR1 的互联地址验证外网链路正常HRP_M[FW1] ping 10.1.2.1 Reply from 10.1.2.1: bytes56 Sequence1 ttl255 time1 ms公网访问验证在 PC1 上 ping 公网模拟地址 100.1.1.1验证路由与安全策略生效PC ping 100.1.1.1 Reply from 100.1.1.1: bytes32 time10ms TTL252HRP 双机状态验证查看 HRP 主备状态HRP_M[FW1] display hrp state预期输出关键信息本端状态Master对端状态Slave心跳通道状态Up配置同步状态已同步完成查看 VRRP 状态HRP_M[FW1] display vrrp预期结果FW1 的 GE1/0/1 接口 VRRP 组 1 状态为 MasterFW2 上对应接口状态为 Backup。配置同步验证在主设备上新增一条测试安全策略HRP_M[FW1] security-policy HRP_M[FW1-policy-security] rule name test_sync HRP_M[FW1-policy-security-rule-test_sync] action permit HRP_M[FW1-policy-security-rule-test_sync] quit HRP_M[FW1-policy-security] quit在备设备上查看策略是否存在HRP_S[FW2] display security-policy rule name test_sync实验总结本次实验成功实现防火墙主备模式双机热备完成了心跳链路搭建、主备角色选举、配置自动同步、VRRP 网关联动等核心功能。HRP 心跳链路是双机热备的核心负责主备状态协商、配置批量 / 实时同步、会话表备份等关键功能。主备切换过程中内网终端无感知业务仅出现毫秒级丢包有效保障了网络的高可用性。启用 HRP 后所有业务配置仅需在主设备操作备设备自动同步大幅降低了运维复杂度与配置不一致风险。
设备列表设备名称路由器AR1路由器AR2运营商路由ISP防火墙FW1防火墙FW2交换机LSW1交换机LSW2三层交换机LSW3PCPC1PCPC2IP地址规划AR1接口IPGE0/0/010.1.2.2/24GE0/0/110.1.4.1/24GE0/0/212.0.0.1/24AR2接口IPGE0/0/010.1.3.1/24GE0/0/110.1.4.2/24GE0/0/213.0.0.1/24ISP接口IPGE0/0/012.0.0.2/24GE0/0/113.0.0.2/24GE0/0/210.0.0.1/24防火墙管理地址FW1192.168.0.1FW2192.168.0.2Trust区域FW1-FW2心跳链路10.1.1.0/30FW110.1.1.1FW210.1.1.2PC地址PC1:IP:192.168.2.100MASK:255.255.255.0网关:192.168.2.1PC2:IP:192.168.2.200MASK:255.255.255.0网关:192.168.2.1LSW1配置Huawei system-view [Huawei] sysname LSW1 [LSW1] vlan 2 [LSW1-vlan2] quit [LSW1] interface GigabitEthernet 0/0/3 [LSW1-GigabitEthernet0/0/3] port link-type access [LSW1-GigabitEthernet0/0/3] port default vlan 2 [LSW1-GigabitEthernet0/0/3] quit [LSW1] interface GigabitEthernet 0/0/1 [LSW1-GigabitEthernet0/0/1] port link-type access [LSW1-GigabitEthernet0/0/1] port default vlan 2 [LSW1-GigabitEthernet0/0/1] quit [LSW1] interface GigabitEthernet 0/0/2 [LSW1-GigabitEthernet0/0/2] port link-type trunk [LSW1-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 [LSW1-GigabitEthernet0/0/2] quitLSW2 配置Huawei system-view [Huawei] sysname LSW2 [LSW2] vlan 2 [LSW2-vlan2] quit [LSW2] interface GigabitEthernet 0/0/3 [LSW2-GigabitEthernet0/0/3] port link-type access [LSW2-GigabitEthernet0/0/3] port default vlan 2 [LSW2-GigabitEthernet0/0/3] quit [LSW2] interface GigabitEthernet 0/0/1 [LSW2-GigabitEthernet0/0/1] port link-type access [LSW2-GigabitEthernet0/0/1] port default vlan 2 [LSW2-GigabitEthernet0/0/1] quit [LSW2] interface GigabitEthernet 0/0/2 [LSW2-GigabitEthernet0/0/2] port link-type trunk [LSW2-GigabitEthernet0/0/2] port trunk allow-pass vlan 2 [LSW2-GigabitEthernet0/0/2] quitLSW3 配置Huawei system-view [Huawei] sysname LSW3 [LSW3] interface Vlanif 1 [LSW3-Vlanif1] ip address 192.168.0.3 255.255.255.0 [LSW3-Vlanif1] quitISP 路由器配置模拟公网Huawei system-view [Huawei] sysname ISP [ISP] interface GigabitEthernet 0/0/0 [ISP-GigabitEthernet0/0/0] ip address 12.0.0.2 255.255.255.0 [ISP-GigabitEthernet0/0/0] quit [ISP] interface GigabitEthernet 0/0/1 [ISP-GigabitEthernet0/0/1] ip address 13.0.0.2 255.255.255.0 [ISP-GigabitEthernet0/0/1] quit [ISP] interface LoopBack 0 [ISP-LoopBack0] ip address 100.1.1.1 255.255.255.0 [ISP-LoopBack0] quit [ISP] ip route-static 10.0.0.0 255.0.0.0 12.0.0.1 [ISP] ip route-static 10.0.0.0 255.0.0.0 13.0.0.1 preference 70AR1 路由器配置Huawei system-view [Huawei] sysname AR1 [AR1] interface GigabitEthernet 0/0/0 [AR1-GigabitEthernet0/0/0] ip address 10.1.2.1 255.255.255.0 [AR1-GigabitEthernet0/0/0] quit [AR1] interface GigabitEthernet 0/0/1 [AR1-GigabitEthernet0/0/1] ip address 10.1.4.1 255.255.255.0 [AR1-GigabitEthernet0/0/1] quit [AR1] interface GigabitEthernet 0/0/2 [AR1-GigabitEthernet0/0/2] ip address 12.0.0.1 255.255.255.0 [AR1-GigabitEthernet0/0/2] quit [AR1] ospf 1 router-id 1.1.1.1 [AR1-ospf-1] area 0 [AR1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255 [AR1-ospf-1-area-0.0.0.0] network 10.1.4.0 0.0.0.255 [AR1-ospf-1-area-0.0.0.0] quit [AR1-ospf-1] default-route-advertise [AR1-ospf-1] quit [AR1] ip route-static 0.0.0.0 0.0.0.0 12.0.0.2AR2 路由器配置Huawei system-view [Huawei] sysname AR2 [AR2] interface GigabitEthernet 0/0/0 [AR2-GigabitEthernet0/0/0] ip address 10.1.3.1 255.255.255.0 [AR2-GigabitEthernet0/0/0] quit [AR2] interface GigabitEthernet 0/0/1 [AR2-GigabitEthernet0/0/1] ip address 10.1.4.2 255.255.255.0 [AR2-GigabitEthernet0/0/1] quit [AR2] interface GigabitEthernet 0/0/2 [AR2-GigabitEthernet0/0/2] ip address 13.0.0.1 255.255.255.0 [AR2-GigabitEthernet0/0/2] quit [AR2] ospf 1 router-id 2.2.2.2 [AR2-ospf-1] area 0 [AR2-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255 [AR2-ospf-1-area-0.0.0.0] network 10.1.4.0 0.0.0.255 [AR2-ospf-1-area-0.0.0.0] quit [AR2-ospf-1] default-route-advertise [AR2-ospf-1] quit [AR2] ip route-static 0.0.0.0 0.0.0.0 13.0.0.2FW1 基础配置USG6000V system-view [USG6000V] sysname FW1 [FW1] interface GigabitEthernet 1/0/0 [FW1-GigabitEthernet1/0/0] ip address 10.1.2.254 255.255.255.0 [FW1-GigabitEthernet1/0/0] quit [FW1] firewall zone untrust [FW1-zone-untrust] add interface GigabitEthernet 1/0/0 [FW1-zone-untrust] quit [FW1] interface GigabitEthernet 1/0/1 [FW1-GigabitEthernet1/0/1] ip address 192.168.2.252 255.255.255.0 [FW1-GigabitEthernet1/0/1] quit [FW1] firewall zone trust [FW1-zone-trust] add interface GigabitEthernet 1/0/1 [FW1-zone-trust] quit [FW1] interface GigabitEthernet 1/0/2 [FW1-GigabitEthernet1/0/2] ip address 10.1.1.1 255.255.255.252 [FW1-GigabitEthernet1/0/2] quit [FW1] firewall zone dmz [FW1-zone-dmz] add interface GigabitEthernet 1/0/2 [FW1-zone-dmz] quit [FW1] ospf 1 router-id 10.1.2.254 [FW1-ospf-1] area 0 [FW1-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255 [FW1-ospf-1-area-0.0.0.0] quit [FW1-ospf-1] import-route static [FW1-ospf-1] quitFW2 基础配置USG6000V system-view [USG6000V] sysname FW2 [FW2] interface GigabitEthernet 0/0/0 [FW2-GigabitEthernet0/0/0] ip address 192.168.0.2 255.255.255.0 [FW2-GigabitEthernet0/0/0] quit [FW2] interface GigabitEthernet 1/0/0 [FW2-GigabitEthernet1/0/0] ip address 10.1.3.254 255.255.255.0 [FW2-GigabitEthernet1/0/0] quit [FW2] firewall zone untrust [FW2-zone-untrust] add interface GigabitEthernet 1/0/0 [FW2-zone-untrust] quit [FW2] interface GigabitEthernet 1/0/1 [FW2-GigabitEthernet1/0/1] ip address 192.168.2.253 255.255.255.0 [FW2-GigabitEthernet1/0/1] quit [FW2] firewall zone trust [FW2-zone-trust] add interface GigabitEthernet 1/0/1 [FW2-zone-trust] quit [FW2] interface GigabitEthernet 1/0/2 [FW2-GigabitEthernet1/0/2] ip address 10.1.1.2 255.255.255.252 [FW2-GigabitEthernet1/0/2] quit [FW2] firewall zone dmz [FW2-zone-dmz] add interface GigabitEthernet 1/0/2 [FW2-zone-dmz] quit [FW2] ospf 1 router-id 10.1.3.254 [FW2-ospf-1] area 0 [FW2-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255 [FW2-ospf-1-area-0.0.0.0] quit [FW2-ospf-1] import-route static [FW2-ospf-1] quitHRP 双机热备核心配置心跳链路与主备角色配置FW1 配置主设备[FW1] hrp interface GigabitEthernet 1/0/2 remote 10.1.1.2 [FW1] hrp priority 10 [FW1] hrp enable执行后命令提示符变为HRP_M[FW1]表示当前为双机主用设备。FW2 配置备设备[FW2] hrp interface GigabitEthernet 1/0/2 remote 10.1.1.1 [FW2] hrp enable执行后命令提示符变为HRP_S[FW2]表示当前为双机备用设备。VRRP 与 HRP 联动配置仅需在主设备 FW1 上配置自动同步至备设备HRP_M[FW1] interface GigabitEthernet 1/0/1 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 virtual-ip 192.168.2.254 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 priority 120 HRP_M[FW1-GigabitEthernet1/0/1] vrrp vrid 1 hrp track master HRP_M[FW1-GigabitEthernet1/0/1] quit安全策略配置HRP_M[FW1] security-policy HRP_M[FW1-policy-security] rule name hrp_heartbeat HRP_M[FW1-policy-security-rule-hrp_heartbeat] source-zone local HRP_M[FW1-policy-security-rule-hrp_heartbeat] destination-zone dmz HRP_M[FW1-policy-security-rule-hrp_heartbeat] action permit HRP_M[FW1-policy-security-rule-hrp_heartbeat] quit HRP_M[FW1-policy-security] rule name trust_to_untrust HRP_M[FW1-policy-security-rule-trust_to_untrust] source-zone trust HRP_M[FW1-policy-security-rule-trust_to_untrust] destination-zone untrust HRP_M[FW1-policy-security-rule-trust_to_untrust] source-address 192.168.2.0 24 HRP_M[FW1-policy-security-rule-trust_to_untrust] action permit HRP_M[FW1-policy-security-rule-trust_to_untrust] quit HRP_M[FW1-policy-security] quit会话快速备份配置开启实时会话同步保证主备切换时业务不中断HRP_M[FW1] hrp mirror session enable实验验证步骤基础连通性验证内网终端互通验证在 PC1 上执行 ping 命令测试与 PC2 的连通性PC ping 192.168.2.200 Reply from 192.168.2.200: bytes32 time1ms TTL128外网链路连通验证在 FW1 上 ping AR1 的互联地址验证外网链路正常HRP_M[FW1] ping 10.1.2.1 Reply from 10.1.2.1: bytes56 Sequence1 ttl255 time1 ms公网访问验证在 PC1 上 ping 公网模拟地址 100.1.1.1验证路由与安全策略生效PC ping 100.1.1.1 Reply from 100.1.1.1: bytes32 time10ms TTL252HRP 双机状态验证查看 HRP 主备状态HRP_M[FW1] display hrp state预期输出关键信息本端状态Master对端状态Slave心跳通道状态Up配置同步状态已同步完成查看 VRRP 状态HRP_M[FW1] display vrrp预期结果FW1 的 GE1/0/1 接口 VRRP 组 1 状态为 MasterFW2 上对应接口状态为 Backup。配置同步验证在主设备上新增一条测试安全策略HRP_M[FW1] security-policy HRP_M[FW1-policy-security] rule name test_sync HRP_M[FW1-policy-security-rule-test_sync] action permit HRP_M[FW1-policy-security-rule-test_sync] quit HRP_M[FW1-policy-security] quit在备设备上查看策略是否存在HRP_S[FW2] display security-policy rule name test_sync实验总结本次实验成功实现防火墙主备模式双机热备完成了心跳链路搭建、主备角色选举、配置自动同步、VRRP 网关联动等核心功能。HRP 心跳链路是双机热备的核心负责主备状态协商、配置批量 / 实时同步、会话表备份等关键功能。主备切换过程中内网终端无感知业务仅出现毫秒级丢包有效保障了网络的高可用性。启用 HRP 后所有业务配置仅需在主设备操作备设备自动同步大幅降低了运维复杂度与配置不一致风险。
