Nokia Network Voyager, Справочное руководство, Страница: 208 / 700

5
Configuring Interfaces
208 Voyager Reference Guide
and forwards the packets to the backup firewall. Perform the steps as
presented in the
Configuring OSPF Example and Configuring OSPF
Example sections. For this example, enable OSPF using the following
interface values:
IP Unit 1:
10.0.0.1
and
192.168.0.1
IP Unit 2:
10.0.0.2
and
192.168.1.1
IP Unit 3:
11.0.0.1
and
192.168.0.2
IP Unit 4:
11.0.0.2
and
192.168.1.2
Use iclid to show all OSPF neighbors. Each firewall should show two
neighbors and also show that the best route to the destination network is
through the corresponding HA GRE tunnel.
3.
VRRP-v2 provides redundancy in case one of the firewalls is lost.
Perform the steps as presented in the
“Creating a Virtual Router for an
Interface's Addresses in VRRPv2.” Use the following values to configure
VRRP-v2:
IP Unit 1: Enable VRRP on
192.168.0.1
with
192.168.0.2
as a backup
IP Unit 2: Enable VRRP on
192.168.1.1
with
192.168.1.2
as a backup
IP Unit 3: Enable VRRP on
192.168.0.2
with
192.168.0.1
as a backup
IP Unit 4: Enable VRRP on
192.168.1.2
with
192.168.1.1
as a backup
4.
HA GRE tunnels work by encapsulating the original packet and resending
the packet through the firewall. The first time the firewall sees the packet,
it has the original IP header; the second time, the packet has the end
points of the tunnels as the
src
and
dst
IP addresses.
The firewall needs to be configured to accept all packets with the original
IP header so the encapsulation can take place. An encrypt rule is then
defined to encrypt those packets matching the tunnel endpoints.