中兴VRRP+MSTP配置指南.docx

中兴VRRP+MSTP配置指南拓扑图注：应该按照这种方式连接设备拓扑说明：两台89做为核心，交换机上必须配置：VRRP、MSTP、静态路由指向防火墙；两台核心之间必须用心跳线连起来，最好是做smartgroup链路聚合，然后聚合端口使用TRUNK模式。配置实例例如，内网有2个业务VLAN，分别是VLAN 10和VLAN 20，上联防火墙的是VLAN 100，假设防火墙的内网口地址是192.168.100.1。假设两台89之间都使用gei_1/23和gei_1/24口连接起来。8908-1配置（主）：定义所有VLAN：conf tvlan 10name yewu1exitvlan 20name yewu2exitvlan 100name to-firewallexit配置网关地址，做VRRP的所有网关地址，必须分配三个地址，其中两个地址是Intvlan的实际地址，一个是VRRP的浮动地址：intvlan 10ip add 192.168.10.252 255.255.255.0vrrp 1 ip 192.168.10.254exitintvlan 20ip add 192.168.20.252 255.255.255.0vrrp 2 ip 192.168.20.254exitintvlan 100ip add 192.168.100.252 255.255.255.0vrrp 3 ip 192.168.100.254exit配置STP和优先级：spanning-tree enablespanning-treemst instance 0 priority 0 定义聚合端口smartgroup：interface smartgroup1exit把23和24加入聚合端口：interface gei_1/23smartgroup 1 mode onexitinterface gei_1/24smartgroup 1 mode onexit把聚合端口配置成trunk模式，并将所有VLAN 透传：interface smartgroup1switchport mode trunkswitchport trunk vlan 10switchport trunk vlan 20switchport trunk vlan 100exit配置静态路由：ip route 0.0.0.0 0.0.0.0 192.168.100.18908-2配置（备）：conf tvlan 10name yewu1exitvlan 20name yewu2exitvlan 100name to-firewallexitintvlan 10ip add 192.168.10.253vrrp 1 ip 192.168.10.254exitintvlan 20ip add 192.168.20.253vrrp 2 ip 192.168.20.254exitintvlan 100ip add 192.168.100.253vrrp 3 ip 192.168.100.254exitspanning-tree enablespanning-treemst instance 0 priority 4096 interface smartgroup1exitinterface gei_1/23smartgroup 1 mode onexitinterface gei_1/24smartgroup 1 mode onexitinterface smartgroup1switchport mode trunkswitchport trunk vlan 10switchport trunk vlan 20switchport trun