策略路由和NAT实现负载均衡实例(华为防火墙).docx

一、组网需求：
1.正常情况下10.0.0.2从出口12.12.12.0NAT转化成100.0.0.0的地址，20.0.0.2从出口13.13.13.0NAT转化成200.0.0.0的地址，实现负载均衡。
2.FW双出口的某一条链路down，所有用户NAT成同一地址段出去，实现链路冗余。
二、实验组网

四、关键配置
USG5360(V100R003C01SPC007)：

ipaddress-set100and200typeobject
address010.0.0.0mask24
address120.0.0.0mask24
#
ipaddress-set10.0.0.2typeobject
address010.0.0.0mask24
#
ipaddress-set20.0.0.2typeobject
address020.0.0.0mask24
#
aclnumber3001
rule0permitipsource10.0.0.00.255.255.255
aclnumber3002
rule0permitipsource20.0.0.00.255.255.255
#
nataddress-group100NAT1100.0.0.1100.0.0.100
nataddress-group200NAT2200.0.0.1200.0.0.100
#
trafficclassifier12
if-matchacl3001
trafficclassifier13
if-matchacl3002
#
trafficbehavior12
remarkip-nexthop12.12.12.2output-interfaceGigabitEthernet0/0/0
trafficbehavior13
remarkip-nexthop13.13.13.2output-interfaceGigabitEthernet0/0/1
#
qospolicyre
classifier12behavior12
classifier13behavior13
#
interfaceGigabitEthernet0/0/0
ipaddress12.12.12.1255.255.255.252
#
interfaceGigabitEthernet0/0/1
ipaddress13.13.13.1255.255.255.252
#
interfaceGigabitEthernet0/0/2
ipaddress20.0.0.1255.255.255.0
#
interfaceGigabitEthernet0/0/3
ipaddress10.0.0.1255.255.255.0
#

firewallzonelocal

setpriority100
#
firewallzonetrust
setpriority85
qosapplypolicyreoutbound
addinterfaceGigabitEthernet0/0/2
addinterfaceGigabitEthernet0/0/3
#
firewallzoneuntrust
setpriority5
#
firewallzonenamet100
setpriority10
addinterfaceGigabitEthernet0/0/0
#
firewallzonenamet200
setpriority11
addinterfaceGigabitEthernet0/0/1
#
nat-policyinterzonetrustuntrustoutbound
#
nat-policyinterzonetrustt100outbound
policy0
actionsource-nat
policysourceaddress-set100and200
address-groupNAT1
#
nat-policyinterzonetrustt200outbound
policy0
actionsource-nat
policysourceaddress-set100and200
address-groupNAT2

#

iproute-static0.0.0.00.0.0.013.13.13.2
iproute-static0.0.0.00.0.0.012.12.12.2
#

五、实现原理
按照实验要求，如果我们用传统的NAT，将10.0.0.2nat成100.0.0.0/24网段，将20.0.0.2nat成200.0.0.0/24网段，这种方法是实现不了当FW双线上连线路任意断掉一条业务不断的实验要求。那么我们应如何解决这个问题呢？首先我们要了解防火墙的处理流程，如下图：

NAT实际上在防火