数据中心防火墙部署

1、红塔烟草(集团)万兆以太网建设项目数据中心防火墙部署改造方案(V1.4)北京联信永益信息技术有限公司2010年2月目录一、概述错误！未指定书签。二、人员及时间.错误！未指定书签。1、参与人员.错误！未指定书签。2、操作时间.错误！未指定书签。三、业务影响错误！未指定书签。四、前期准备工作.错误！未指定书签。五、网络拓扑图.错误！未指定书签。六、数据中心设备配置 错误！未指定书签。1.数据中心两台6509E设备VSS部署及设备配置错误！未指定书签。2.数据中心两台6509E防火墙FWS透明模式配置错误！未指定书签。七、防火墙失效切换测试 错误！未指定书签八、 应急方案 错误!未指定书签亠、概述数

2、据中心网络现状：一台部署在商务楼 4楼机房数据中心汇聚交换机6509E 与一台部署在技术中心机房数据中心汇聚交换机6509E分别通过1条10GE上联到核心6509E交换机，两台汇聚交换机之间通过一条 10GE链路Trunk互联；放 置在商务楼的数据中心服务器和放置在技术中心的数据中心服务器通过单链路， 分别连接到对应区域的数据中心交换机上，所有服务器网关指向部署在商务楼4楼数据中心交换机上对应的vian实地址。两台数据中心交换机上分别部署一块 FWS防火墙模块，通过Failover技术实现对数据中心网络安全保护。本次工程将部署在技术中心的数据汇聚 6509E交换机搬迁到商务楼1楼新机 房，在两

3、台数据中心 6509E 设备上部署 VSS，采用 VirtualSwitchi ngSupervisor72010GE引擎板卡上的万兆以太网上行链路端口进行互联，同时使用两条万兆链路进行捆绑，保证VSS系统的可靠性。采用两条10GE链路捆绑与核心设备互联，同时对防火墙模块部署透明模式。二、人员及时间1、参与人员序号姓名职责手机1卢立杰项目经理（整体协调）2何沿平割接操作（设备调试）3扎西割接操作（配合设备调试）4朱洺奇监督协调5代宁厂商技术支持2、操作时间2010年2月9 日-2010年2月9日三、业务影响本次割接操作将对数据中心6509E设备部署VSS同时，防火墙FWSM模块 部署透明模式，

4、对数据中心网络进行规划和调试。 因此会影响数据中心服务器与 集团网络间的互相访问。四、前期准备工作以下为联信永益需要准备的工作1、软件版本测试通过；2、核对设备配置、端口类型、端口状态；3、文件序号文件名称数量1割接方案3份2测试报告3份4、工具序号物品名称数量1静电带12十字、一字螺丝刀2以下为红塔集团信息网络科需要准备的工作1、配合割接人员进入机房； 2、提供con sole配置权限登陆口令;五、网络拓扑图现状：数据中心FWSM路由模式拓扑图备注：1、HT_SWLDA_4F_6509E_01、HT_SWLDA_1F_6509E_01 设备上的InterfaceVlan411接口为OSPF路

5、由协议报文传递使用。2、Vla n402 为服务器业务使用（in side 接口）； Via n413、Vla n414 为两台 6509E 设备上防火墙模块的 Failover协议使用，HT_SWLDA_4F_6509E_01上的防火墙 模块为 Primary，HT_SWLDA_ 仆_6509E_011的防火墙模块为 Sec on dary;Vlan412为两台6509E与其防火墙模块的 Outside接口连接使用，两台 6509E的InterfaceVlan412 接口启用 HSRP协议，HT_SWLDA_4F_6509E_01 为 Active, HT_SWLDA_1F_6509E_01

6、 为 Standby。改造后：数据中心FWSMg明模式拓扑图备注：1、Gi1/3/48、Gi2/3/48 接口为 BFD 使用。2、 vla n402 为服务器业务使用；vla n402 为 in side 接口； Vla n413、Vla n414 为两 台6509E设备上防火墙模块的Failover协议使用，商务楼4楼6509E设备上的防 火墙模块为Primary，商务楼1楼6509E上的防火墙模块为 Secondary; Vlan412 为两台6509E与其防火墙模块的Outside接口连接使用，vlan402服务器的网关 指向vlan412的接口 ip地址。六、数据中心设备配置1. 数

7、据中心两台6509E设备VSS部署及设备配置割接内容：两台数据中心6509E设备调试割接时间：2010.02.07割接地点：商务楼4楼、商务楼1楼 操作人：配置：联信永益：卢立杰电话： 联信永益：何沿平 联信永益：扎西配合人：信息科：朱洺奇电话：1、备份设备配置copyr unnin gbootflash:wr2、两台数据中心6509E设备间互联链路及VSS调试switchvirtualdoma in 100? switch1?!in terfaceport-cha nn el110 switchvirtualli nk1 n oshut!in terfacera ngeTe n5/4-5 c

8、ha nn el-group110mode on n oshut!platformhardwarevslpfcmodepfc3c switchc onv ertmodevirtualswitchvirtualdoma in 100switch2!in terfaceport-cha nn el120switchvirtualli nk2n oshut!in terfacera ngeTe n5/4-5cha nn el-group120mode onn oshut!platformhardwarevslpfcmodepfc3c switchc onv ertmodevirtual!switch

9、acceptmodevirtual!in terfacegigabitethern et1/3/48 descriptio nV SS_FOR_BFD no switchportipaddress77252bfdi nterval100min_rx100multiplier3n oshutin terfacegigabitether net2/3/48 descriptio nV SS_FOR_BFD no switchportipaddress81.252bfdi nterval100min_rx100multiplier3n oshut!switchvirtualdoma in 100du

10、al-activedetecti onbfddual-activepairi nterfaceg1/3/48i nterfaceg2/3/48bfd3、核心6509E设备基础信息配置调试host nameHT_SWLDA_4F_6509E_01!servicetimestampsdebugdatetimelocaltime servicetimestampslogdatetimelocaltime!clocktimez on eGMT8!no ipdoma in-lookupin terfaceLoopbackl ipaddress2 n oshut!loggi ngfacilitylocal

11、6loggi ngsource-i nterfaceLoopbacklloggi ngloggi ng!sn mp-serverco mmun ityho ngtpublicROsn mp-serverco mmun ityho ngtprivateRW!lineconO exec-timeout50 loggi ngsynchronous password0adm inht logi nlin evty04exec-timeout50password0adm inht logi n!n tpserver!4、设备接口及路由调试HT_BONE_4F_6509E_：1!in terfacePor

12、t-cha nn el6no switchportdescriptio neo nn ecttoHT_SWLDA_4F_6509E_01 ipaddressn oshut!in terfaceTe nGigabitEthernet1/4/1no switchportno ipaddressdescriptio neo nn ecttoHT_SWLDA_4F_6509E_01 cha nn el-group6mode onn oshut!in terfaceTe nGigabitEthernet2/4/1no switchportno ipaddressdescriptionconnecttoH

13、T SWLDA 4F 6509E 01 cha nn el-group6mode on n oshut!routerospf877no passive-i nterfacePort-cha nn el6non etwork0.0.0.3area0!HT_SWLDA_4F_6509E_01!in terfacePort-cha nn el6no switchportdescriptio nconn ecttoHT_B0NE_4F_6509E_01 ipaddressn oshut!in terfaceTe nGigabitEthernet1/1/1no switchportdescriptio

14、nconn ecttoHT_BONE_4F_6509E_01 cha nn el-group6mode onn oshut!in terfaceTe nGigabitEthernet2/1/1no switchportdescriptio nconn ecttoHT_BONE_4F_6509E_01 cha nn el-group6mode onn oshut!Vian 402Vian 403Vian 404Vian 405Vian 406Vla n411Via n412Via n413Via n414Via n500n ames niffer!in terfaceVia n403 ipadd

15、ress ipfiow in gress ipfiowegress n oshutin terfaceVla n404ipaddress ipflow in gress ipflowegress n oshut!in terfaceVla n405 ipaddress ipflow in gress ipflowegress n oshut!in terfaceVla n406 ipaddress ipflow in gress ipflowegress n oshut!in terfaceVla n412ipaddress10.96.0.10 ipflow in gress ipfloweg

16、ressn oshut!routerospf877router-idlog-adjace ncy-cha nges passive-i nterfacedefault no passive-i nterfaceTe nGigabitEthernet1/1/1 no passive-i nterfaceTe nGigabitEthernet2/1/1 no passive-i nterfaceport-cha nn el6n etwork0.0.0.63area0 network0.0.0.63area0 network0.0.0.63area0 network0.0.0.63area0 net

17、work0.0.0.0area0 network0.0.0.3area0 network10.96.0.00.0.0.255area0!in terfaceGigabitEthernet1/3/1 switchportswitchportaccessvla n402 switchportmodeaccessload-i nterval30 n oshut!in terfaceGigabitEthernet1/3/2descripti on co nn ecttoHT_SWLDA_1F_3750_01 switchportswitchporttr unken capsulati on dot1q

18、 switchportmodetru nk spa nnin g-treeportfast n oshut!in terfaceGigabitEthernet1/3/3descriptio neo nn ecttoHT_JSZXDA_2F_3750_01 switchportswitchporttr unken capsulati on dotlq switchportmodetru nk spa nnin g-treeportfast n oshut!in terfaceGigabitEthernet1/7/1 switchportswitchportaccessvla n403 switc

19、hportmodeaccess n oshut!in terfaceGigabitEthernet1/7/2 switchportswitchportaccessvla n403 switchportmodeaccess n oshut!in terfacera ngegi1/7/3- 10n oshut!in terfaceGigabitEthernet1/7/11 switchportswitchportaccessvla n403 switchportmodeaccess n oshut!in terfaceGigabitEthernet1/7/12 switchportswitchpo

20、rtaccessvla n402 switchportmodeaccessload-i nterval30 n oshut!in terfaceGigabitEthernet1/7/13 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/14 switchportswitchportaccessvla n402 switchp

21、ortmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/15 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/16 switchportswit

22、chportaccessvla n402 switchportmodeaccess load-i nterval30 n oshut!in terfaceGigabitEthernet1/7/17 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/18 switchportswitchportaccessvia n402 sw

23、itchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/7/19 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/20 switchpor

24、tswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/21 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGig

25、abitEthernet1/7/22 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/23 switchportswitchportaccessvla n402 switchportmodeaccess load-i nterval30storm-c on trolbroadcastlevel0.10 storm-c on

26、trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/7/24 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/25 switchportswitchportaccessvla n406 switchportmodeaccess storm-c on trolbr

27、oadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/26 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/27 switchportswitchportaccessvla n402 switchport

28、modeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/28 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/29 switchport switch

29、portaccessvia n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/7/30 switchport switchportaccessvla n402 switchportmodeaccessstorm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEth

30、ernet1/7/31 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/32 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10

31、n oshut!in terfaceGigabitEthernet1/7/33 switchport switchportaccessvla n402 switchportmodeaccessstorm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/34 switchport switchportaccessvla n402 switchportmodeaccess load-i nterval30storm-c on trolbroadcas

32、tlevelO.10 storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/7/35 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/36 switchportswitchportaccessvla n402 switchportmodeac

33、cess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/37 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/38 switchportswitchportacc

34、essvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/39 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshutin terfaceGigabitEthernet1/7

35、/40 switchport switchportaccessvia n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/7/41 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshu

36、t!in terfaceGigabitEthernet1/7/42 switchport switchportaccessvla n406 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/43 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on

37、 trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/44 switchport switchportaccessvla n403 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/45 switchport switchportaccessvla n403 switchportmodeaccessstorm-c on trol

38、broadcastlevelO.10 storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/7/46 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/47 switchport switchportaccessvla n402 switch

39、portmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/7/48 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/1 switchport sw

40、itchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/2 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshutin terfaceGigabit

41、Ethernet1/8/3 switchport switchportaccessvia n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/8/4 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.

42、IO n oshut!in terfaceGigabitEthernet1/8/5 switchport switchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/6 switchportswitchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroadcastlevelO.IO stor

43、m-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/7 switchport switchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/8 switchport switchportaccessvla n4O2 switchportmodeaccessstorm-c on

44、trolbroadcastlevelO.10 storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/8/9 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/10 switchportswitchportaccessvla n402 switc

45、hportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/11 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/12 switchportsw

46、itchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/13 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshutin terfaceGigabit

47、Ethernet1/8/14 switchport switchportaccessvia n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/8/15 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevel

48、O.IO n oshut!in terfaceGigabitEthernet1/8/16 switchport switchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/17 switchport switchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroadcastlevelO.IO

49、 storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/18 switchport switchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/19 switchport switchportaccessvla n4O2 switchportmodeaccessstor

50、m-c on trolbroadcastlevelO.10 storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/8/20 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/21 switchport switchportaccessvla

51、n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/22 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/23 s

52、witchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/24 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshutin t

53、erfaceGigabitEthernet1/8/25 switchport switchportaccessvia n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/8/26 switchport switchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolm

54、ulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/27 switchport switchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/28 switchport switchportaccessvla n4O2 switchportmodeaccess storm-c on trolbroad

55、castlevelO.IO storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/29 switchport switchportaccessvla n4O6 switchportmodeaccess storm-c on trolbroadcastlevelO.IO storm-c on trolmulticastlevelO.IO n oshut!in terfaceGigabitEthernet1/8/3O switchport switchportaccessvla n4O2 switchportm

56、odeaccessstorm-c on trolbroadcastlevelO.10 storm-c on trolmulticastlevelO.10 n oshut!in terfaceGigabitEthernet1/8/31 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/32 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terfaceGigabitEthernet1/8/33 switchportswitchportaccessvla n402 switchportmodeaccess storm-c on trolbroadcastlevel0.10 storm-c on trolmulticastlevel0.10 n oshut!in terf